shelfmark

mirror of https://github.com/calibrain/shelfmark.git synced 2026-09-24 09:00:22 +01:00

Author	SHA1	Message	Date
CaliBrain	2c6d6a02cd	ci: debounce dev image builds instead of building nightly (#1376 ) Replace the nightly cron and its check-changes job with a debounce. Every push to main starts dev-image-debounce.yml, which waits out the 60-minute wait timer on the dev-image-debounce environment, then dispatches the Docker workflow only if main still points at its commit. A burst of merges now publishes one dev image, an hour after the last merge. The Docker workflow keeps only its tag and workflow_dispatch triggers, so its history holds real builds only. The debounce workflow deletes its own finished runs, so no-op runs don't pile up either. Requires the dev-image-debounce environment with a 60-minute wait timer (Settings → Environments).	2026-09-21 02:38:06 -04:00
dependabot[bot]	4a0675e0d3	build(deps): bump the python-deps group with 4 updates (#1375 ) Bumps the python-deps group with 4 updates: [gevent](https://github.com/gevent/gevent), [emoji](https://github.com/carpedm20/emoji), [seleniumbase](https://github.com/seleniumbase/SeleniumBase) and [ruff](https://github.com/astral-sh/ruff). Updates `gevent` from 26.8.0 to 26.9.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gevent/gevent/commit/003c77a6f3da41c014dd415022fb61f9d91fc95d"><code>003c77a</code></a> Preparing release 26.9.0</li> <li><a href="https://github.com/gevent/gevent/commit/725ecc3e53dd74f3828f1cf189e1cbeaebbdfae9"><code>725ecc3</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2209">#2209</a> from bojanz/issue2207-resolve-result-on-setup-failure</li> <li><a href="https://github.com/gevent/gevent/commit/a5b68e812e8ddf65d13dfa117d8656fcb713d69b"><code>a5b68e8</code></a> Adjust the ThreadPool after an unexpected worker exit</li> <li><a href="https://github.com/gevent/gevent/commit/67a725659bd622ac476bd39019209e11a1f18f2b"><code>67a7256</code></a> Resolve the ThreadResult when worker task setup fails</li> <li><a href="https://github.com/gevent/gevent/commit/a3b307bb82cd9b875933a964e883015bf0ce18b2"><code>a3b307b</code></a> Add change note for <a href="https://redirect.github.com/gevent/gevent/issues/2211">#2211</a> / <a href="https://redirect.github.com/gevent/gevent/issues/2039">#2039</a> [skip ci]</li> <li><a href="https://github.com/gevent/gevent/commit/b0ec8d3b4cb7cde5799dc57d35f74267e3b8259a"><code>b0ec8d3</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2211">#2211</a> from afonsojanu/fix/subprocess-stdin-mode-missing-bi...</li> <li><a href="https://github.com/gevent/gevent/commit/29b00308c74a703e26178229f6edacf98a31a1cb"><code>29b0030</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2210">#2210</a> from Shivakarthikeya23/issue-1946</li> <li><a href="https://github.com/gevent/gevent/commit/47ea41c7e2bc8ca50785a60e929e7335c75fc308"><code>47ea41c</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2208">#2208</a> from bojanz/issue2206-skip-missing-hooks</li> <li><a href="https://github.com/gevent/gevent/commit/0ee0c838cf50255c40647109de5391f84630af6a"><code>0ee0c83</code></a> Report the full binary mode string from FileObjectPosix</li> <li><a href="https://github.com/gevent/gevent/commit/3f3dc574d2b1e5381ea70bfea0da565fd4fcd6c8"><code>3f3dc57</code></a> Fix AsyncResult accumulating traceback frames on repeated get()</li> <li>Additional commits viewable in <a href="https://github.com/gevent/gevent/compare/26.8.0...26.9.0">compare view</a></li> </ul> </details> <br /> Updates `emoji` from 2.15.0 to 2.16.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/carpedm20/emoji/releases">emoji's releases</a>.</em></p> <blockquote> <h2>v2.16.0</h2> <ul> <li>Update to Unicode 18.0</li> <li>Update translations to CLDR release-49-alpha2</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/carpedm20/emoji/blob/master/CHANGES.md">emoji's changelog</a>.</em></p> <blockquote> <h2>v2.16.0 (2026-09-16)</h2> <ul> <li>Update to Unicode 18.0</li> <li>Update translations to CLDR release-49-alpha2</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/carpedm20/emoji/commit/d5d59d591f8590ada989f0bdf31603b3fe84e103"><code>d5d59d5</code></a> Merge pull request <a href="https://redirect.github.com/carpedm20/emoji/issues/335">#335</a> from carpedm20/update-unicode-18.0</li> <li><a href="https://github.com/carpedm20/emoji/commit/7acc7f0740b0ded33c7450d788c6641b74e84e16"><code>7acc7f0</code></a> update to Unicode 18.0.0</li> <li>See full diff in <a href="https://github.com/carpedm20/emoji/compare/v2.15.0...v2.16.0">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.54.5 to 4.54.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.54.9 - MCP Server: Patch 17</h2> <h2>MCP Server: Patch 17</h2> <ul> <li><a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4508/changes/e323a9d851b58a99b8b55b041218f415652a9fd6">Update the MCP server</a></li> <li><a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4508/commits/bc88accb2909629f7b0af68be73bebf014c17373">Refresh Python dependencies</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 17 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4508">seleniumbase/SeleniumBase#4508</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.8...v4.54.9">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.8...v4.54.9</a></p> <h2>4.54.8 - Fix command injection and more</h2> <h2>Fix command injection and more</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7c8744798ed97616fe246effe982b93b0cc1d15e">Fix command injection in console scripts</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7c9871c812bf410164b3a6ed14aec9b9cfe2abd3">Fix issue with clearing a field that has autocomplete</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/969a36c19fb3a05eec50821ad6be63805a68e21a">Fix typos in behave_sb.py</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/47034f13729e9f24564c18ba1952b1307798f080">Refactor console scripts</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f7da99c23471a0f0a1101b0afd9a0a82d38a99ba">Update the MCP server</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4bc64fb41dcd6ea6030887456fe97de72a3443a7">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/c1b492a650c8077ae6ef43915b3a455fab8f4e8d">Update examples</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Fix command injection and more by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4507">seleniumbase/SeleniumBase#4507</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.7...v4.54.8">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.7...v4.54.8</a></p> <h2>4.54.7 - MCP Server: Patch 16</h2> <h2>MCP Server: Patch 16</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/534c0c124002bfb48e10a7198194c91c61f4d4db">Update the MCP server</a> --> annotations and docstrings</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4a5453ee14dff60599b058669eaff025488b75d2">Refresh Python dependencies</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 16 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4505">seleniumbase/SeleniumBase#4505</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.6...v4.54.7">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.6...v4.54.7</a></p> <h2>4.54.6 - MCP Server: Patch 15</h2> <h2>MCP Server: Patch 15</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/fbc665f3cb19ea6e5eb4ed6ffcf4eec32e4d9580">Add tool annotations to the MCP Server</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4503">seleniumbase/SeleniumBase#4503</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a406b7f277de3a56dc3d83d4b5466dbca34a35e4">Update the Dockerfile</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/8c9805f870bd1a2a0bb9b8ef79e710848a9e81f2">Update CDP Mode</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7f488faed38e8afce01d18b30291906e75dfe72d">Update uv</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b4910211a8e801eebab9f0b1a6679bf1077ac53f">Update CDP Mode examples</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 15 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4504">seleniumbase/SeleniumBase#4504</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ddd0f047e522c584221176bccf078784cac03b00"><code>ddd0f04</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4508">#4508</a> from seleniumbase/mcp-server-patch-17</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/918078082a49b2a57f3a33fc9a4149973f780e64"><code>9180780</code></a> Version 4.54.9</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/bc88accb2909629f7b0af68be73bebf014c17373"><code>bc88acc</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/d10f01b50168d62aea34bdc756ae249f75fdf642"><code>d10f01b</code></a> Update MCP versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/e323a9d851b58a99b8b55b041218f415652a9fd6"><code>e323a9d</code></a> Update the MCP server</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/52ceddcfbc466c937f88b322cfa69f11600b1e0a"><code>52ceddc</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4507">#4507</a> from seleniumbase/fix-command-injection-and-more</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/1b18c10456cc064ce38e7024913b285b3053197a"><code>1b18c10</code></a> Version 4.54.8</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/c1b492a650c8077ae6ef43915b3a455fab8f4e8d"><code>c1b492a</code></a> Update examples</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a64c668254f20c3384c9f0ec1635de7e9eba45ce"><code>a64c668</code></a> Update MCP versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4bc64fb41dcd6ea6030887456fe97de72a3443a7"><code>4bc64fb</code></a> Refresh Python dependencies</li> <li>Additional commits viewable in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.5...v4.54.9">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.7 to 0.16.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.8</h2> <h2>Release Notes</h2> <p>Released on 2026-09-16.</p> <h3>Bug fixes</h3> <ul> <li>Visit functional <code>TypedDict</code> keyword arguments correctly (<a href="https://redirect.github.com/astral-sh/ruff/pull/28584">#28584</a>)</li> <li>[<code>flake8-simplify</code>] Detect nested <code>async with</code> under sync parent (<code>SIM117</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27821">#27821</a>)</li> <li>[<code>flake8-simplify</code>] Preserve operand order in <code>SIM109</code> fix (<a href="https://redirect.github.com/astral-sh/ruff/pull/27824">#27824</a>)</li> <li>[<code>pyupgrade</code>] Preserve required parentheses in multiline <code>UP040</code> fixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28164">#28164</a>)</li> <li>[<code>pyupgrade</code>] Skip <code>TypeVarTuple</code> and <code>ParamSpec</code> conversions with bounds or constraints (<code>UP040</code>, <code>UP046</code>, <code>UP047</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28505">#28505</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Add support for <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28459">#28459</a>)</li> <li>Recognize PEP-728 <code>TypedDict</code> class keywords (<a href="https://redirect.github.com/astral-sh/ruff/pull/28533">#28533</a>)</li> <li>Recognize quoted types in <code>typing.TypeForm</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28507">#28507</a>)</li> <li>Support conditional assignment to <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28491">#28491</a>)</li> <li>[<code>flake8-type-checking</code>] Prefer lazy imports over <code>TYPE_CHECKING</code> on Python 3.15 and later (<code>TC001</code>, <code>TC002</code>, <code>TC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28541">#28541</a>)</li> <li>[<code>pyupgrade</code>] Make the fix for <code>UP040</code> always unsafe (<a href="https://redirect.github.com/astral-sh/ruff/pull/28526">#28526</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending deprecated <code>ByteString</code> aliases (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28498">#28498</a>)</li> <li>[<code>ruff</code>, <code>flake8-use-pathlib</code>] Recognize the <code>parent_mode</code> argument (<code>RUF064</code>, <code>PTH103</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28528">#28528</a>)</li> <li>[<code>ruff</code>] Detect <code>\Z</code> in <code>pytest.raises()</code> match patterns (<code>RUF043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28598">#28598</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Use rule name and code in formatter incompatibility warnings (<a href="https://redirect.github.com/astral-sh/ruff/pull/28571">#28571</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>[<code>flake8-tidy-imports</code>] Add <code>extend-banned-api</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28644">#28644</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a></li> <li><a href="https://github.com/alzeph"><code>@alzeph</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/fredrikblau"><code>@fredrikblau</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/zsol"><code>@zsol</code></a></li> <li><a href="https://github.com/Aniket-a14"><code>@Aniket-a14</code></a></li> <li><a href="https://github.com/r-b-1"><code>@r-b-1</code></a></li> </ul> <h2>Install ruff 0.16.8</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh \| sh </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.8</h2> <p>Released on 2026-09-16.</p> <h3>Bug fixes</h3> <ul> <li>Visit functional <code>TypedDict</code> keyword arguments correctly (<a href="https://redirect.github.com/astral-sh/ruff/pull/28584">#28584</a>)</li> <li>[<code>flake8-simplify</code>] Detect nested <code>async with</code> under sync parent (<code>SIM117</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27821">#27821</a>)</li> <li>[<code>flake8-simplify</code>] Preserve operand order in <code>SIM109</code> fix (<a href="https://redirect.github.com/astral-sh/ruff/pull/27824">#27824</a>)</li> <li>[<code>pyupgrade</code>] Preserve required parentheses in multiline <code>UP040</code> fixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28164">#28164</a>)</li> <li>[<code>pyupgrade</code>] Skip <code>TypeVarTuple</code> and <code>ParamSpec</code> conversions with bounds or constraints (<code>UP040</code>, <code>UP046</code>, <code>UP047</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28505">#28505</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Add support for <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28459">#28459</a>)</li> <li>Recognize PEP-728 <code>TypedDict</code> class keywords (<a href="https://redirect.github.com/astral-sh/ruff/pull/28533">#28533</a>)</li> <li>Recognize quoted types in <code>typing.TypeForm</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28507">#28507</a>)</li> <li>Support conditional assignment to <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28491">#28491</a>)</li> <li>[<code>flake8-type-checking</code>] Prefer lazy imports over <code>TYPE_CHECKING</code> on Python 3.15 and later (<code>TC001</code>, <code>TC002</code>, <code>TC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28541">#28541</a>)</li> <li>[<code>pyupgrade</code>] Make the fix for <code>UP040</code> always unsafe (<a href="https://redirect.github.com/astral-sh/ruff/pull/28526">#28526</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending deprecated <code>ByteString</code> aliases (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28498">#28498</a>)</li> <li>[<code>ruff</code>, <code>flake8-use-pathlib</code>] Recognize the <code>parent_mode</code> argument (<code>RUF064</code>, <code>PTH103</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28528">#28528</a>)</li> <li>[<code>ruff</code>] Detect <code>\Z</code> in <code>pytest.raises()</code> match patterns (<code>RUF043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28598">#28598</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Use rule name and code in formatter incompatibility warnings (<a href="https://redirect.github.com/astral-sh/ruff/pull/28571">#28571</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>[<code>flake8-tidy-imports</code>] Add <code>extend-banned-api</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28644">#28644</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/VedantMadane"><code>@VedantMadane</code></a></li> <li><a href="https://github.com/alzeph"><code>@alzeph</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/fredrikblau"><code>@fredrikblau</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/zsol"><code>@zsol</code></a></li> <li><a href="https://github.com/Aniket-a14"><code>@Aniket-a14</code></a></li> <li><a href="https://github.com/r-b-1"><code>@r-b-1</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/62914c4b9b79a9e5004374a9c482ad2ed69290e1"><code>62914c4</code></a> Bump version to 0.16.8 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28648">#28648</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/c47e0cdc665f56536ce7f7a8ac40fa0ff3f79482"><code>c47e0cd</code></a> [ty] Bound aliased intersection expansion during inference (<a href="https://redirect.github.com/astral-sh/ruff/issues/28546">#28546</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ff4747b509ab4fffbe5689fcae39caa7503d1dcf"><code>ff4747b</code></a> renovate: update uv hashes correctly with setup-uv (<a href="https://redirect.github.com/astral-sh/ruff/issues/28621">#28621</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/94efeaa28630d80b2a74adf3c3963de99ed4ee29"><code>94efeaa</code></a> [ty] Compact reachable binding and declaration histories (<a href="https://redirect.github.com/astral-sh/ruff/issues/28349">#28349</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/50020fb1e8aa83b0826fa6f5f33a1e93c10cc60e"><code>50020fb</code></a> [ty] Avoid storing constraint nodes twice (<a href="https://redirect.github.com/astral-sh/ruff/issues/28375">#28375</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/446bb68da50014bb75f5ce1504a80c5883e3b0b2"><code>446bb68</code></a> [ty] Compare bound-method receivers before signatures (<a href="https://redirect.github.com/astral-sh/ruff/issues/28384">#28384</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/304ab86be5de6507e276ab09f5b43f44aeb92469"><code>304ab86</code></a> [<code>flake8-type-checking</code>] Prefer lazy imports over <code>TYPE_CHECKING</code> on 3.15+ (`...</li> <li><a href="https://github.com/astral-sh/ruff/commit/d940b244f7512427b0d87c7953e88c60e69f9bdf"><code>d940b24</code></a> [ty] Watch script dependencies in CLI watch mode (<a href="https://redirect.github.com/astral-sh/ruff/issues/28125">#28125</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/fe9f065a504127b11da72c2ff6d7813ddf3ce8ac"><code>fe9f065</code></a> [flake8-tidy-imports] Add <code>extend-banned-api</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28644">#28644</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/31131db44f057cce68fa6b95552b7db54167b0b3"><code>31131db</code></a> [ty] Support <code>type[A & B]</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/27124">#27124</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.7...0.16.8">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-21 00:44:08 -04:00
CaliBrain	e1c3f057ab	fix: bypass recordings, welib wrong-md5 links, footer build sha (#1364 ) (#1373 ) Debug screen recordings never started. Every bypass logged "Capturearea 1540x1050 at position 0.0 outside the screen size 1440x1880".We ask ffmpeg for the fingerprint screen size plus margin, the size wealso pass SeleniumBase as xvfb_metrics. SeleniumBase builds thatdisplay with use_xauth=True, the image ships no xauth binary, so itfalls back to a fixed 1440x1880 Xvfb and the requested size neverexists. Drop -video_size so x11grab records the whole screen, whateversize it turned out to be. welib could hand back a link for a different book. Welib answers/md5/<md5> with a search for that md5; when it does not have the file,the resolver took the first "Download" on the results page (md5a2c1dc0c... resolved to auto_download/9c8cf85d...). On an /md5/<md5>page a GET/Download link is now only taken when its href names thatmd5; otherwise the source is reported as not having the file. Alsoremoves _get_download_urls_from_welib and _is_source_enabled: themd5-template branch in _get_urls_for_source always handles welib first,so that resolver could never run. The footer showed the build date instead of the commit. CI stampsBUILD_VERSION as <yyyy-mm-dd>-<sha> (pr-<sha> for PR images) and thefooter kept its first seven characters, so dev images read "Shelfmarkmain (2026-09)". Take the trailing commit sha instead: "main (`1a5b37d`)".The full BUILD_VERSION stays in the hover title	2026-09-21 00:15:41 -04:00
CaliBrain	d978896142	fix(auth): rename the API_KEY env var to SHELFMARK_API_KEY (#1374 )	2026-09-21 00:10:10 -04:00
Gavin McFallandClaude Fable 5.1	3b280009ae	feat(auth): static API_KEY (env) accepted as Bearer or X-Api-Key, cookie or key (#1366 ) Supersedes #1353, per the discussion in #1352: one `API_KEY` environment variable; when set, a request carrying it is authenticated as the first admin, and cookie sessions keep working exactly as before (cookie or key). Nothing else changes. No table, no UI, no settings-tab switch, no per-user keys. ## What - `API_KEY` (env). Unset → the feature is off and none of the new code runs. - `Authorization: Bearer <key>` or `X-Api-Key: <key>` on any existing `/api/` route authenticates that request as the first admin in `users.db` (`ORDER BY id`), or as a bare admin identity (`user_id="api"`, `is_admin=True`, no local user row) if the install has no admin yet. Per request only; nothing is persisted; the admin's role is read live, so deleting or demoting that user takes effect on the next request. - Both headers are checked and either may match. That is what makes the key usable behind a reverse proxy that injects its own `Authorization` header (oauth2-proxy, Authelia, forwardAuth): send the key in `X-Api-Key`. - A credential that is not* the key is ignored and the request continues on the normal session path, so proxy-forwarded tokens are unaffected. Without a valid session such a request gets the usual `401 {"error": "Unauthorized"}`, identical to a request with no credential, so there is nothing to probe. ## How - `shelfmark/config/env.py`: `API_KEY = os.getenv("API_KEY", "").strip()`. - `shelfmark/core/api_key.py`: `extract_api_key_candidates()` (Bearer token if the scheme is Bearer, then `X-Api-Key`) and `matches_api_key()` using `hmac.compare_digest` on bytes. - `shelfmark/core/user_db.py`: `UserDB.get_first_admin()`. - `shelfmark/main.py`: `api_key_auth_middleware` (`before_request`, registered before `proxy_auth_middleware`, which early-returns for keyed requests). Only `/api/` paths; `/api/health` and `/api/auth/*` exempt; no-op when `API_KEY` is unset or the auth mode is `none`. On a match it mirrors the proxy-auth pattern: `session.clear()` then populate `user_id` / `is_admin` / `db_user_id` for this request, `permanent = False`, `modified = False`, `g.api_key_auth = True`. An `after_request` hook guarantees no `Set-Cookie` is written for a keyed request even if a handler dirties the session. - `docs/api-access.md` (new), the `API_KEY` entry in `docs/environment-variables.md`, and a README link. ## Security - Constant-time compare; the key is never logged or echoed. - Keyed requests never mint or refresh a session cookie and ignore any cookie sent with them (a non-admin cookie plus the key yields admin for that request; the browser's own session is left untouched and usable). - The mismatch path touches neither the session nor `g`, so a stray bearer on a browser request can neither log the user out nor change how their cookie is refreshed. - Store errors during the admin lookup fail closed (`500 {"error": "Authentication error"}`), never to anonymous. - Verified against Flask's `save_session` / `should_set_cookie` ordering, and under auth modes `none`, `builtin`, `proxy`. ## Tests `tests/core/test_api_key_env.py` (36): extraction and matching; first-admin lookup; middleware behaviour on a guarded route and an admin route, with and without a user_db, `X-Api-Key`, both-headers combinations, no `Set-Cookie` when a handler dirties the session, incoming non-admin cookie ignored, browser cookie still usable after a keyed request, security headers, store error → 500, mismatch → guard's 401 / cookie path / permanent cookie untouched, unset → off, exempt paths and path probes, `none` and `proxy` modes, deleted and demoted first admin, a keyed write passing the guard. Existing auth suites unchanged. All CI gates green on the fork: https://github.com/gavinmcfall/shelfmark/pull/2 (CI-only draft). Also exercised against a running instance: 47 scripted checks including 150 concurrent requests, proxy-mode switching through the key, an unset-key restart, and a log scan for the key. ## Naming `API_KEY` as discussed. If you'd rather namespace it (`SHELFMARK_API_KEY`) to avoid clashing with other tools' env vars in shared compose files, it is a one-line change; say the word. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-21 00:00:42 -04:00
splitsec2	1a5b37d9d3	fix(deluge): send seeding ratio limit under Deluge's own keys (#1367 ) Deluge's per-torrent options are `stop_at_ratio` (bool) and `stop_ratio` (float), and `torrentmanager` checks `options['stop_at_ratio'] and get_ratio() >= options['stop_ratio']`. We were putting the indexer's float into `stop_at_ratio`, which only switched stopping on and left the daemon's global ratio (default 2.0) as the one actually enforced. A `ratio_limit` of 0 turned stopping off entirely. `stop_at_ratio_enabled` is not a Deluge option at all. Deluge has no per-torrent seeding time limit, `seed_time_limit` is a global core preference, so the value is logged as unapplied instead of sent as a key the daemon drops. qBittorrent and Transmission already honour both indexer limits, so this removes a silent difference between clients. ## Verification - `tests/prowlarr/test_deluge_client.py`: the ratio arrives as `stop_ratio` with `stop_at_ratio` set, and no key Deluge does not define is sent. Both fail on current main and pass here. - Full suite (3165), ruff, ruff format, basedpyright, vulture green.	2026-09-20 23:06:14 -04:00
splitsec2	7c8e89c567	fix(googlebooks): page by the capped size, not the raw limit (#1370 ) The Google Books search builds `maxResults` as `min(limit, 40)` because the API caps a page at 40 volumes, but advances `startIndex` by the full `limit`. The pages then stop tiling. With `limit=50`, page 1 covers items 0 to 39 and page 2 starts at 50, so items 40 to 49 are never returned and every later page drops another 10. This computes the page size once and uses it for both `maxResults` and `startIndex`. The shipped frontend asks for 40 and is unaffected. `/api/metadata/search` clamps `limit` to 100, so an API caller passing 41 to 100 was hitting it. One thing I left alone. The provider uses the base `search_paginated` heuristic, `has_more = len(books) >= options.limit`, which still reports `has_more: false` for a limit above 40 since Google can never return that many. That was already the behaviour before this change, and fixing it means either touching the shared heuristic or adding a provider override, so I kept this patch to the stride. Happy to follow up if you want it. ## Verification - `tests/metadata/test_googlebooks_parse.py`: pages 1 and 2 at `limit=50` must tile exactly, plus a guard that `limit=25` still strides by 25. The first fails on current main and passes here. - Full suite (3165), ruff, ruff format, basedpyright, vulture green.	2026-09-20 23:05:48 -04:00
splitsec2	bc03ad062e	fix(http): keep the host of a protocol-relative download link (#1368 ) `get_absolute_url()` replaced both `netloc` and `scheme` whenever either one was missing. A protocol-relative href such as `//cdn.example.org/f.epub`, scraped from a page on `https://annas-archive.org/...`, parses with a netloc and an empty scheme, so it came back pointing at the page's own host. The download then 404s and the source is skipped. Each field now falls back to the base URL only when the parsed URL does not supply it. Plain relative paths resolve exactly as before, which the control test covers. This affects the Z-Library, welib and generic download link handling in `release_sources/direct_download/annas_archive.py`. ## Verification - New `tests/download/test_http_absolute_url.py`: a protocol-relative link keeps its own host, and a plain `/path` still resolves against the base. The first fails on current main and passes here. - Full suite (3165), ruff, ruff format, basedpyright, vulture green.	2026-09-20 23:04:22 -04:00
splitsec2	ab3aa9a8b0	fix(requests): reject non-object items in the batch endpoint (#1369 ) `POST /api/requests/batch` checks that `requests` is a non-empty list and then hands each element to the shared preparation helper, which calls `.get()` on it. A bare string, number or null in the list raises `AttributeError` and the caller gets a 500, while `POST /api/requests` answers 400 with a message for the same mistake. This validates the element type beside the existing list check. One bad item rejects the whole batch rather than being reported per item, which matches the endpoint's current contract: every other failure path already aborts the batch with a single error body, as `test_batch_create_requests_is_atomic` asserts. Responses for valid payloads are unchanged. ## Verification - `tests/core/test_request_routes_api.py`: a case per bad shape (int, str, null, list), plus a mixed valid and invalid batch that asserts nothing was created. All fail on current main with a 500 and pass here. - Full suite (3168), ruff, ruff format, basedpyright, vulture green.	2026-09-20 23:03:31 -04:00
Paul Rimmer	d4619be69a	Feature: Show the AA search result stats (#1362 ) When doing a direct search for a book, show the stats of the AA results. For example if we search for "The Great Gatsby", AA reports it has 240 hits and shows the first page of 50. Provide this stats info in the shelfmark webUI via ResultsSection.tsx and ReleaseModal.tsx. This table shows what should be displayed based on the total number of hits found: \|Total \|Display\| \|-------\|-------\| \|1 \|"Result 1 (1 Total)"\| \|6 \|"Results 1-6 (6 Total)"\| \|144 \|"Results 1-50 (144 Total)"\| \|500+ \|"Results 1-50 (500+ Total)"\| Currently, shelfmark also only shows us the first 50 search hits even if there were more available from AA. This could be added later if considered desirable. As usual, a picture is worth a 1000 words: <img width="1012" height="610" alt="direct-results-stat" src="https://github.com/user-attachments/assets/8c0c688f-444e-482a-a9a3-2dee5a5563b8" /> <img width="1013" height="741" alt="universal-results-info" src="https://github.com/user-attachments/assets/399bbb79-87f2-4432-a3d0-64937795f5f1" /> Coded with llama.cpp, opencode and 🤖	2026-09-20 13:03:32 -04:00
splitsec2	c1315a2b23	fix(download): check task ownership before serving queued files (#1357 ) `/api/localdownload` resolves the file through the live queue and returns it before checking who owns the task; the owner check only runs on the download-history fallback, once the task has aged out of the queue. Task ids are source ids, so two users who searched the same book can end up with the same id. This applies the same rule on the queue path, reusing the `_task_owned_by_actor` helper the cancel/retry/priority routes already use, so both paths answer a non-owner with the same 404. Admin behaviour is unchanged. The 404 matches what this endpoint's history path already returns for a non-owner rather than the 403 `download_not_owned` the cancel/retry/priority routes use, happy to switch it if you prefer consistency with the siblings instead. ## Verification - `tests/core/test_activity_routes_api.py`: the owner still receives their queued file; a different user receives 404. The new case fails on current main and passes here; the existing history-fallback test is unchanged. - Full suite (3148), ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:56:23 -04:00
splitsec2	7934924678	fix(queue): don't stamp CANCELLED over a finished download (#1361 ) `cancel_download` reads the task status under the queue lock, releases it, and only then writes CANCELLED through `update_status`. A download that finishes in that window has its COMPLETE overwritten. The queue and the UI show the task as cancelled while the file is already on disk, and the terminal hook fires for both statuses. The check and the write now happen in a single lock hold. Because the lock is non-reentrant and the terminal hook has to run after it is released (the stall canceller depends on that), the lock-held part of `update_status` moved into a small private helper that both paths share; `update_status` is a thin wrapper over it. A cancel arriving once the task is already terminal still returns `False`. ## Verification - `tests/core/test_queue.py::test_cancel_does_not_overwrite_a_download_that_finished_first`: a worker thread completes the download while the cancel is in flight, with the handover driven by events rather than sleeps. The task stays complete. Fails on main, passes here. - Full suite (3147), plus `tests/download/` and `tests/core/test_download_api_guardrails.py`, ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:54:05 -04:00
splitsec2	a6204a318e	fix(oidc): reject backslash paths in the return_to sanitizer (#1359 ) The OIDC `return_to` sanitizer rejects values starting with `//` and then relies on `urlsplit` to catch anything carrying a netloc. A value such as `/\host` has no netloc, so it is stored in the session and used as the post-login redirect target and browsers resolve the backslash as a path separator, which lands the user outside the app after a successful login. `_normalize_return_to` now also rejects values whose path contains a backslash. That matches the frontend sanitizer in `authRedirect.ts`, which parses with `URL` and already discards those forms, so the two ends agree again. The check covers the path only, so query and fragment backslashes still round-trip, and it also catches the script-root case where `/app/\host` strips to `/\host`. ## Verification - New cases in `tests/core/test_oidc_routes.py` cover the rejected forms, including under a script root, and confirm `/`, `/settings` and `/search?q=x#frag` are unaffected. They fail on current main and pass here. - Full suite (3155), ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:51:21 -04:00
splitsec2	545480c557	fix(download): default is_admin to False in the request policy guard (#1358 ) `_resolve_policy_mode_for_current_user` reads `session.get("is_admin", True)`, so a session carrying `user_id` but no `is_admin` key skips the request policy entirely, while every other admin check in the codebase defaults the key to `False`. This uses the same default here. Every authenticated login path (builtin, CWA, proxy, OIDC) writes `is_admin` into the session, and `AUTH_METHOD=none` is already short-circuited one line earlier, so sessions from those flows behave exactly as before. ## Verification - `tests/core/test_request_routes_api.py::TestDownloadPolicyGuards`: a session without `is_admin` now gets `policy_requires_request` and nothing is queued. Fails on current main, passes here. - Full suite (3147), ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:50:53 -04:00
splitsec2	127dd82615	fix(users): apply user updates only after the payload validates (#1360 ) `PUT /api/users/me` and `PUT /api/admin/users/<id>` write the new password hash, and then the profile fields, before the rest of the payload is checked. When the request is rejected further down as an invalid role, an admin-only setting, an invalid settings value, the route answers 400 with those writes already committed, so the caller sees an error while the password has in fact changed. Both routes now validate the whole payload before touching the database, and the password hash is folded into the same `update_user` call as the other fields so the field write is a single transaction. Error messages, status codes and the order they are reported in are unchanged. ## Verification - New tests in `tests/core/test_self_user_routes.py` and `tests/core/test_admin_users_api.py` assert that a rejected update leaves the password, profile fields and role as they were, plus a positive case that a valid payload still applies all three. They fail on current main and pass here. - Full suite (3150), ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:50:14 -04:00
splitsec2	acd59f7cbb	feat(auth): provision proxy users as non-admin once an admin exists (#1356 ) With `AUTH_METHOD=proxy` and no admin group configured, every user the proxy authenticates for the first time is provisioned as an admin (`is_admin = True` unless the user already exists in `users.db`). The intent to never lock an instance out makes sense, but the effect is that anyone the SSO gate lets through becomes an administrator. On an instance shared with family or a small community that is a footgun; I hit it when the first invited reader landed as an admin. This keeps the guarantee and removes the footgun: the first account is still provisioned as an admin while the instance has no admin at all, and later first-time users follow a new `PROXY_AUTH_DEFAULT_ROLE` setting (Security tab / env), default `user`. Known users keep their stored role; the `PROXY_AUTH_ADMIN_GROUP_NAME` path is unchanged and still takes precedence. I couldn't find a way with Cloudflare access to pass this along. Changes: `UserDB.has_admin()`, `_proxy_default_is_admin()` in the proxy middleware, the new `SelectField` beside the other proxy settings, the regenerated `docs/environment-variables.md` entry and a row in `docs/reverse-proxy.md`. Compatibility: the default moves from "everyone admin" to "first admin, then users". Accounts already in `users.db` are unaffected; new SSO users on an existing instance become regular users unless `PROXY_AUTH_DEFAULT_ROLE=admin` is set. If you would rather ship this purely opt-in I can flip the default to `admin`. ## Verification - `tests/core/test_auth_api.py::TestProxyProvisioningRole`: first user admin / second user not; `PROXY_AUTH_DEFAULT_ROLE=admin` restores the old behaviour; an admin from another auth source counts as "an admin exists"; a known user keeps their role whatever the default. - Full suite (3094), ruff, ruff format, basedpyright, vulture green. - Running on my own instance since 2026-09-19.	2026-09-19 23:27:13 -04:00
dependabot[bot]	c42edac363	build(deps): bump the gh-actions group with 6 updates (#1350 ) Bumps the gh-actions group with 6 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) \| `4.3.0` \| `4.4.0` \| \| [docker/build-push-action](https://github.com/docker/build-push-action) \| `7.3.0` \| `7.4.0` \| \| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) \| `10.0.1` \| `10.1.0` \| \| [github/codeql-action/init](https://github.com/github/codeql-action) \| `4.37.9` \| `4.38.0` \| \| [github/codeql-action/autobuild](https://github.com/github/codeql-action) \| `4.37.9` \| `4.38.0` \| \| [github/codeql-action/analyze](https://github.com/github/codeql-action) \| `4.37.9` \| `4.38.0` \| Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's releases</a>.</em></p> <blockquote> <h2>v4.4.0</h2> <ul> <li>Use official Buildx releases for cloud driver by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/606">docker/setup-buildx-action#606</a></li> <li>Pull BuildKit image before builder creation by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/609">docker/setup-buildx-action#609</a></li> <li>Use shared error helpers for Buildx and Docker commands by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/620">docker/setup-buildx-action#620</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.95.0 to 0.100.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/610">docker/setup-buildx-action#610</a> <a href="https://redirect.github.com/docker/setup-buildx-action/pull/618">docker/setup-buildx-action#618</a> <a href="https://redirect.github.com/docker/setup-buildx-action/pull/619">docker/setup-buildx-action#619</a></li> <li>Bump <code>@humanfs/node</code> from 0.16.7 to 0.16.8 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/614">docker/setup-buildx-action#614</a></li> <li>Bump js-yaml from 5.3.0 to 5.4.2 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/608">docker/setup-buildx-action#608</a> <a href="https://redirect.github.com/docker/setup-buildx-action/pull/617">docker/setup-buildx-action#617</a></li> <li>Bump postcss-selector-parser from 7.1.1 to 7.1.5 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/611">docker/setup-buildx-action#611</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/setup-buildx-action/compare/v4.3.0...v4.4.0">https://github.com/docker/setup-buildx-action/compare/v4.3.0...v4.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/setup-buildx-action/commit/594f3bf4285d9ea8dc53c9a0c9c4092420091003"><code>594f3bf</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/609">#609</a> from crazy-max/pull-buildkit-image-before-create</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/bd6e702fc33b636671900d5b5edfab64698c9c25"><code>bd6e702</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/6268c9da9abbd1309c8a16a75f92a878715c3032"><code>6268c9d</code></a> pull BuildKit image before builder creation</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/e8235251b82e23c90e6fad50016f0a78b7f28f11"><code>e823525</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/621">#621</a> from docker/dependabot/github_actions/codeql-actions-...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/533ed8ed095b0b133ef16fb495aad119524e220d"><code>533ed8e</code></a> build(deps): bump the codeql-actions group with 2 updates</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/bedaf135699075c88620cd30772b9b6eadc9ba99"><code>bedaf13</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/620">#620</a> from crazy-max/shared-error-helpers</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/d5079fba84d5edd23d25ba7f3045122175ca6ee2"><code>d5079fb</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/226a61612ab71c26bbd805f955834049a4a9772f"><code>226a616</code></a> use shared error helpers for Buildx and Docker commands</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/77ce7f4bab9bc462d825001cde7f82d409ee474c"><code>77ce7f4</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/619">#619</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/0dc1dc94f0f7c064e93fda72884ca71e054c0354"><code>0dc1dc9</code></a> [dependabot skip] chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...594f3bf4285d9ea8dc53c9a0c9c4092420091003">compare view</a></li> </ul> </details> <br /> Updates `docker/build-push-action` from 7.3.0 to 7.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/build-push-action/releases">docker/build-push-action's releases</a>.</em></p> <blockquote> <h2>v7.4.0</h2> <ul> <li>Use the shared error helper for Buildx commands by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1620">docker/build-push-action#1620</a></li> <li>Prevent workflow command injection in metadata logs by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1617">docker/build-push-action#1617</a></li> <li>Bump <code>@docker/actions-toolkit</code> from 0.92.0 to 0.100.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1614">docker/build-push-action#1614</a> <a href="https://redirect.github.com/docker/build-push-action/pull/1618">docker/build-push-action#1618</a> <a href="https://redirect.github.com/docker/build-push-action/pull/1621">docker/build-push-action#1621</a></li> <li>Bump <code>@humanfs/node</code> from 0.16.7 to 0.16.8 in <a href="https://redirect.github.com/docker/build-push-action/pull/1609">docker/build-push-action#1609</a></li> <li>Bump brace-expansion from 1.1.13 to 1.1.18 in <a href="https://redirect.github.com/docker/build-push-action/pull/1592">docker/build-push-action#1592</a></li> <li>Bump csv-parse from 7.0.0 to 7.0.2 in <a href="https://redirect.github.com/docker/build-push-action/pull/1613">docker/build-push-action#1613</a></li> <li>Bump js-yaml from 4.3.0 to 4.3.2 in <a href="https://redirect.github.com/docker/build-push-action/pull/1605">docker/build-push-action#1605</a> <a href="https://redirect.github.com/docker/build-push-action/pull/1615">docker/build-push-action#1615</a></li> <li>Bump nanoid from 3.3.16 to 3.3.18 in <a href="https://redirect.github.com/docker/build-push-action/pull/1611">docker/build-push-action#1611</a></li> <li>Bump postcss from 8.5.10 to 8.5.25 in <a href="https://redirect.github.com/docker/build-push-action/pull/1590">docker/build-push-action#1590</a></li> <li>Bump postcss-selector-parser from 7.1.1 to 7.1.5 in <a href="https://redirect.github.com/docker/build-push-action/pull/1606">docker/build-push-action#1606</a></li> <li>Bump sigstore from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/build-push-action/pull/1577">docker/build-push-action#1577</a></li> <li>Bump undici from 6.27.0 to 6.28.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1594">docker/build-push-action#1594</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/build-push-action/compare/v7.3.0...v7.4.0">https://github.com/docker/build-push-action/compare/v7.3.0...v7.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/build-push-action/commit/c3c9e263c25d99ce0380d002d59b67737d91b0dc"><code>c3c9e26</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1621">#1621</a> from docker/dependabot/npm_and_yarn/docker/actions-t...</li> <li><a href="https://github.com/docker/build-push-action/commit/459b6741834dcd35f946352017e7675bd2089d42"><code>459b674</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/build-push-action/commit/4dedcb23c91d79c1629bf53ec2c3bcfffef5b34e"><code>4dedcb2</code></a> chore(deps): Bump <code>@docker/actions-toolkit</code> from 0.99.0 to 0.100.0</li> <li><a href="https://github.com/docker/build-push-action/commit/379bf63a979bd70751945601fa04c50674509952"><code>379bf63</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1620">#1620</a> from crazy-max/buildx-error-message</li> <li><a href="https://github.com/docker/build-push-action/commit/9877975c9e0b0b661592ff61049069507f9bc2f6"><code>9877975</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/build-push-action/commit/7ed0556ffafb8eb312463411ef0a84a1dfe24d94"><code>7ed0556</code></a> use the shared Buildx error summary helper</li> <li><a href="https://github.com/docker/build-push-action/commit/91670ba5a4df99a24efff8637a78c83fd1b0f6b1"><code>91670ba</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1618">#1618</a> from docker/dependabot/npm_and_yarn/docker/actions-t...</li> <li><a href="https://github.com/docker/build-push-action/commit/80dbc8614a5c0ce4356740f69179cf829ecdc79a"><code>80dbc86</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/build-push-action/commit/50cac3a3b6f55e6015d6483d1dd72a3ecb90d20d"><code>50cac3a</code></a> chore(deps): Bump <code>@docker/actions-toolkit</code> from 0.98.0 to 0.99.0</li> <li><a href="https://github.com/docker/build-push-action/commit/03b4d6cac0163b44733e1fa60adfd6da560ee4d1"><code>03b4d6c</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1617">#1617</a> from crazy-max/fix-metadata-workflow-commands</li> <li>Additional commits viewable in <a href="https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc">compare view</a></li> </ul> </details> <br /> Updates `astral-sh/setup-uv` from 10.0.1 to 10.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.1.0 🌈 New output <code>python-runtime-id</code>and respect NO_PROXY</h2> <h2>Changes</h2> <p>This release adds more bheind the scene security improvements and also 2 small improvements.</p> <h3>NO_PROXY</h3> <p>This action now respects <code>no_proxy/NO_PROXY</code> environment variables which were previously ignored.</p> <h3>New output <code>python-runtime-id</code></h3> <p>The new output <code>python-runtime-id</code> can be used to know which python version exactly was installed if you use <code>activate-environment</code>. See <a href="https://redirect.github.com/pyca/cryptography/pull/15572#discussion_r3913508686">pyca/cryptography#15572</a> for details on why this can be useful.</p> <h2>🐛 Bug fixes</h2> <ul> <li>fix: respect no proxy directive <a href="https://github.com/mj0nez"><code>@mj0nez</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1037">#1037</a>)</li> <li>Use JSON + a typed wrapper instead of TS codegen <a href="https://github.com/woodruffw"><code>@woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1025">#1025</a>)</li> </ul> <h2>🚀 Enhancements</h2> <ul> <li>Expose a Python "identity" output <a href="https://github.com/woodruffw"><code>@woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1036">#1036</a>)</li> <li>Verify downloads with astral-sh/versions checksums <a href="https://github.com/zaniebot"><code>@zaniebot</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1033">#1033</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.12.12 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1041">#1041</a>)</li> <li>chore: update known checksums for 0.12.10/0.12.11 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1038">#1038</a>)</li> <li>chore: update known checksums for 0.12.9 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1035">#1035</a>)</li> <li>chore: update known checksums for 0.12.7/0.12.8 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1031">#1031</a>)</li> <li>chore: update known checksums for 0.12.6 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1030">#1030</a>)</li> <li>chore: update known checksums for 0.12.5 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1020">#1020</a>)</li> <li>Use self-repo syntax for all in-repo actions/reusable workflows <a href="https://github.com/woodruffw"><code>@woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1024">#1024</a>)</li> <li>Pin one-shot tools <a href="https://github.com/woodruffw"><code>@woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1022">#1022</a>)</li> <li>ci: remove obsolete direct push attempts <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1019">#1019</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.0.1 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1018">#1018</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore(deps-dev): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1043">#1043</a>)</li> <li>Harden npm install defaults <a href="https://github.com/zaniebot"><code>@zaniebot</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1026">#1026</a>)</li> <li>Add dependency cooldowns <a href="https://github.com/woodruffw"><code>@woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1021">#1021</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/bec219d24cd3e171d82865faccec33120bb574f4"><code>bec219d</code></a> chore(deps-dev): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1043">#1043</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/b90ec40d15bfa44c33c6700196eb6efcdddb4373"><code>b90ec40</code></a> fix: respect no proxy directive (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1037">#1037</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/421feb646df5262e7dd93bc54161edfa30372417"><code>421feb6</code></a> chore: update known checksums for 0.12.12 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1041">#1041</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f634bf473ad85bf3e23a613f52c5fa9f363874fc"><code>f634bf4</code></a> Expose a Python "identity" output (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1036">#1036</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/a6772c8f0a09dc9e3582c70a994b0c55af921803"><code>a6772c8</code></a> chore: update known checksums for 0.12.10/0.12.11 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1038">#1038</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/e105c8fb1d7b13074b851babdaef4185243c6a07"><code>e105c8f</code></a> chore: update known checksums for 0.12.9 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1035">#1035</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/cd13f9217092d43a771cf9ba7b09bdd3da8d7c4d"><code>cd13f92</code></a> Verify downloads with astral-sh/versions checksums (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1033">#1033</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/3aef7b92c52cec135792ea1e95f4c77683d39e61"><code>3aef7b9</code></a> chore: update known checksums for 0.12.7/0.12.8 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1031">#1031</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/d08d816a1ea176d61a318eff45abd3dffef415b1"><code>d08d816</code></a> chore: update known checksums for 0.12.6 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1030">#1030</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/19b4d1e990bec64818914c40230bde93a0de300b"><code>19b4d1e</code></a> Harden npm install defaults (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1026">#1026</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/20cfd1bf945f4377ade1205e4dbc17946fc9a30d...bec219d24cd3e171d82865faccec33120bb574f4">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.9 to 4.38.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.38.0</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/b96794f015dfd88f77b49b1c93e0fa7110f94c63"><code>b96794f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4131">#4131</a> from github/update-v4.38.0-7e08580a9</li> <li><a href="https://github.com/github/codeql-action/commit/02d5093871674ea20274117103ce3038c73c77ef"><code>02d5093</code></a> Update changelog for v4.38.0</li> <li><a href="https://github.com/github/codeql-action/commit/7e08580a93dc4e4b9dda167e364577035cf504c6"><code>7e08580</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4130">#4130</a> from github/henrymercer/workflow-runner-sizing</li> <li><a href="https://github.com/github/codeql-action/commit/bfcc52b4f5d98468a5993daa0bf0e4fb3f3ed698"><code>bfcc52b</code></a> Run slow macOS checks on larger runners</li> <li><a href="https://github.com/github/codeql-action/commit/8c251e757c0260283fc50214a06ac768b61d3af4"><code>8c251e7</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4129">#4129</a> from github/update-bundle/codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/0b7ca400df35985869d4b9146a067865d4115da1"><code>0b7ca40</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/40484b339517c6bcf00f81eebc95ca041ddca505"><code>40484b3</code></a> Update default bundle to codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/977e6ceaea7361825998245d787fa3b4d6b9e5df"><code>977e6ce</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4124">#4124</a> from github/henrymercer/toolcache-bundle-cleanup</li> <li><a href="https://github.com/github/codeql-action/commit/40a6b3824794ae1156e1a5320d32e364bf1dcebc"><code>40a6b38</code></a> Address toolcache cleanup review feedback</li> <li><a href="https://github.com/github/codeql-action/commit/deece8f852f048bc3f52fd42c9cc7a99b1ebb252"><code>deece8f</code></a> Apply suggestion from <a href="https://github.com/henrymercer"><code>@henrymercer</code></a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.37.9 to 4.38.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.38.0</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/b96794f015dfd88f77b49b1c93e0fa7110f94c63"><code>b96794f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4131">#4131</a> from github/update-v4.38.0-7e08580a9</li> <li><a href="https://github.com/github/codeql-action/commit/02d5093871674ea20274117103ce3038c73c77ef"><code>02d5093</code></a> Update changelog for v4.38.0</li> <li><a href="https://github.com/github/codeql-action/commit/7e08580a93dc4e4b9dda167e364577035cf504c6"><code>7e08580</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4130">#4130</a> from github/henrymercer/workflow-runner-sizing</li> <li><a href="https://github.com/github/codeql-action/commit/bfcc52b4f5d98468a5993daa0bf0e4fb3f3ed698"><code>bfcc52b</code></a> Run slow macOS checks on larger runners</li> <li><a href="https://github.com/github/codeql-action/commit/8c251e757c0260283fc50214a06ac768b61d3af4"><code>8c251e7</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4129">#4129</a> from github/update-bundle/codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/0b7ca400df35985869d4b9146a067865d4115da1"><code>0b7ca40</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/40484b339517c6bcf00f81eebc95ca041ddca505"><code>40484b3</code></a> Update default bundle to codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/977e6ceaea7361825998245d787fa3b4d6b9e5df"><code>977e6ce</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4124">#4124</a> from github/henrymercer/toolcache-bundle-cleanup</li> <li><a href="https://github.com/github/codeql-action/commit/40a6b3824794ae1156e1a5320d32e364bf1dcebc"><code>40a6b38</code></a> Address toolcache cleanup review feedback</li> <li><a href="https://github.com/github/codeql-action/commit/deece8f852f048bc3f52fd42c9cc7a99b1ebb252"><code>deece8f</code></a> Apply suggestion from <a href="https://github.com/henrymercer"><code>@henrymercer</code></a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.38.0</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/b96794f015dfd88f77b49b1c93e0fa7110f94c63"><code>b96794f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4131">#4131</a> from github/update-v4.38.0-7e08580a9</li> <li><a href="https://github.com/github/codeql-action/commit/02d5093871674ea20274117103ce3038c73c77ef"><code>02d5093</code></a> Update changelog for v4.38.0</li> <li><a href="https://github.com/github/codeql-action/commit/7e08580a93dc4e4b9dda167e364577035cf504c6"><code>7e08580</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4130">#4130</a> from github/henrymercer/workflow-runner-sizing</li> <li><a href="https://github.com/github/codeql-action/commit/bfcc52b4f5d98468a5993daa0bf0e4fb3f3ed698"><code>bfcc52b</code></a> Run slow macOS checks on larger runners</li> <li><a href="https://github.com/github/codeql-action/commit/8c251e757c0260283fc50214a06ac768b61d3af4"><code>8c251e7</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4129">#4129</a> from github/update-bundle/codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/0b7ca400df35985869d4b9146a067865d4115da1"><code>0b7ca40</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/40484b339517c6bcf00f81eebc95ca041ddca505"><code>40484b3</code></a> Update default bundle to codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/977e6ceaea7361825998245d787fa3b4d6b9e5df"><code>977e6ce</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4124">#4124</a> from github/henrymercer/toolcache-bundle-cleanup</li> <li><a href="https://github.com/github/codeql-action/commit/40a6b3824794ae1156e1a5320d32e364bf1dcebc"><code>40a6b38</code></a> Address toolcache cleanup review feedback</li> <li><a href="https://github.com/github/codeql-action/commit/deece8f852f048bc3f52fd42c9cc7a99b1ebb252"><code>deece8f</code></a> Apply suggestion from <a href="https://github.com/henrymercer"><code>@henrymercer</code></a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-19 23:19:16 -04:00
dependabot[bot]	d09ec9de25	build(deps): bump the npm-deps group in /src/frontend with 9 updates (#1349 ) Bumps the npm-deps group in /src/frontend with 9 updates: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [react](https://github.com/react/react/tree/HEAD/packages/react) \| `19.2.8` \| `19.3.0` \| \| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) \| `19.2.18` \| `19.3.0` \| \| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) \| `19.2.8` \| `19.3.0` \| \| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) \| `19.2.7` \| `19.3.0` \| \| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) \| `26.5.0` \| `26.5.1` \| \| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) \| `6.34.0` \| `6.35.1` \| \| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) \| `0.67.0` \| `0.68.0` \| \| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) \| `1.82.0` \| `1.83.0` \| \| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) \| `8.2.2` \| `8.3.0` \| Updates `react` from 19.2.8 to 19.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <p>Below is a list of all new features, APIs, and bug fixes.</p> <p>Read the <a href="https://react.dev/blog/2026/09/09/react-19-3">React 19.3 release post</a> for more information.</p> <h2>New React Features</h2> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/facebook/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/facebook/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/facebook/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/facebook/react/pull/37063">#37063</a>)</li> </ul> <h2>New React DOM Features</h2> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code><Suspense></code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@gnoff</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/facebook/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h2>Notable changes</h2> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> </ul> <h2>All Changes</h2> <h3>React</h3> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@UditDewan</code></a> <a href="https://redirect.github.com/facebook/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code><Activity></code> trees (<a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> <a href="https://redirect.github.com/facebook/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a> <a href="https://redirect.github.com/facebook/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code><Offscreen></code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/react/react/blob/main/CHANGELOG.md">react's changelog</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <h3>New React Features</h3> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/facebook/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/facebook/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/facebook/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/facebook/react/pull/37063">#37063</a>)</li> </ul> <h3>New React DOM Features</h3> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code><Suspense></code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@gnoff</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/facebook/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h3>Notable changes</h3> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> </ul> <h3>All Changes</h3> <h4>React</h4> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@UditDewan</code></a> <a href="https://redirect.github.com/facebook/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code><Activity></code> trees (<a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> <a href="https://redirect.github.com/facebook/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a> <a href="https://redirect.github.com/facebook/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code><Offscreen></code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Fix hang when updating a dehydrated boundary inside a hidden tree (<a href="https://github.com/gaearon"><code>@gaearon</code></a> <a href="https://redirect.github.com/facebook/react/pull/37135">#37135</a>)</li> <li>Don't reacquire Host Singletons during dev effect validation (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37113">#37113</a>)</li> <li>Only remove properties from Host Singletons on release (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37112">#37112</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/2dc7da790d6388b95b83198ca9b588b2ad5f5c0b"><code>2dc7da7</code></a> [test] Bump Jest to 30.4 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/37382">#37382</a>)</li> <li><a href="https://github.com/react/react/commit/4f9389423b7319e1f7acc3d158c84a8365462748"><code>4f93894</code></a> docs: remove stale parentType param from validateChildKeys JSDoc (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36928">#36928</a>)</li> <li><a href="https://github.com/react/react/commit/dbc37501ffeaf8fec45af5898caf1c3d64ad10bf"><code>dbc3750</code></a> Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36752">#36752</a>)</li> <li><a href="https://github.com/react/react/commit/900ae094d85b11c67d53dd14af50a2bda5db4495"><code>900ae09</code></a> [flow] Bump flow to v0.317.0 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36701">#36701</a>)</li> <li><a href="https://github.com/react/react/commit/fbb137059e4aacfaab1d36516e9b55050b4a0454"><code>fbb1370</code></a> [flow] Bump flow to v0.307.1 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36199">#36199</a>)</li> <li><a href="https://github.com/react/react/commit/56922cf751fab6c7ab4c12ddbbd15839959fa255"><code>56922cf</code></a> [react-native-renderer] Delete Paper (legacy) renderer (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36285">#36285</a>)</li> <li><a href="https://github.com/react/react/commit/74568e8627aa43469b74f2972f427a209639d0b6"><code>74568e8</code></a> [Flight] Transport <code>AggregateErrors.errors</code> (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36156">#36156</a>)</li> <li><a href="https://github.com/react/react/commit/e66ef6480ecd19c6885f2c06dec34fec1fdc0a98"><code>e66ef64</code></a> [tests] remove withoutStack from assertConsole helpers (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35498">#35498</a>)</li> <li><a href="https://github.com/react/react/commit/db71391c5c70dc113560d1c23d0b6548604d827f"><code>db71391</code></a> [Fiber] Instrument the lazy initializer thenable in all cases (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35521">#35521</a>)</li> <li><a href="https://github.com/react/react/commit/3e1abcc8d7083a13adf4774feb0d67ecbe4a2bc4"><code>3e1abcc</code></a> [tests] Require exact error messages in assertConsole helpers (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35497">#35497</a>)</li> <li>Additional commits viewable in <a href="https://github.com/react/react/commits/v19.3.0/packages/react">compare view</a></li> </ul> </details> <br /> Updates `@types/react` from 19.2.18 to 19.3.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 19.2.8 to 19.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <p>Below is a list of all new features, APIs, and bug fixes.</p> <p>Read the <a href="https://react.dev/blog/2026/09/09/react-19-3">React 19.3 release post</a> for more information.</p> <h2>New React Features</h2> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/facebook/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/facebook/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/facebook/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/facebook/react/pull/37063">#37063</a>)</li> </ul> <h2>New React DOM Features</h2> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code><Suspense></code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@gnoff</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/facebook/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h2>Notable changes</h2> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> </ul> <h2>All Changes</h2> <h3>React</h3> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@UditDewan</code></a> <a href="https://redirect.github.com/facebook/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code><Activity></code> trees (<a href="https://github.com/ronnakamoto"><code>@ronnakamoto</code></a> <a href="https://redirect.github.com/facebook/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a> <a href="https://redirect.github.com/facebook/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code><Offscreen></code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/react/react/blob/main/CHANGELOG.md">react-dom's changelog</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <h3>New React Features</h3> <ul> <li><code><ViewTransition /></code>: Adds <code><ViewTransition /></code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/gaearon"><code>@gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code><Fragment /></code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-19 23:19:07 -04:00
dependabot[bot]	83f86242b4	build(deps): bump the docker-base-image-digests group with 2 updates (#1348 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `50c8e8c` to `ebfe2f9` Updates `astral-sh/uv` from 0.12.13 to 0.12.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.16</h2> <h2>Release Notes</h2> <p>Released on 2026-09-17.</p> <h3>Python</h3> <ul> <li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify downloaded wheels and source distributions against hashes supplied by package indexes (<a href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li> <li>Allow <code>build-constraint-dependencies</code> entries to include hashes for verifying downloaded build dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li> <li>Honor Darwin <code>platform_release</code> markers in <code>required-environments</code> using macOS wheel deployment targets (<a href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li> <li>Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (<a href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Support <code>lock-without-metadata</code> across all dependency types while retaining <code>package.metadata</code> for remote URL dependencies to enable offline validation (<a href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li> <li>Honor configured and command-line index settings, including credentials, in <code>uv upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li> <li>Allow <code>uv check</code> to run in projects that are not managed by uv and outside workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li> <li>Respect <code>--python</code> and <code>UV_PYTHON</code> when selecting the Python version for <code>uv check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Redact Azure shared access signatures from displayed and logged URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li> <li>Check archive sizes from <code>pylock.toml</code> before reusing cached distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li> <li>Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (<a href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li> <li>Use the bundled <code>uv_build</code> backend only when its version matches active version pins (<a href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li> <li>Handle malformed index URLs without panicking when credentials are configured (<a href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li> <li>Report a configuration error instead of panicking for proxy URLs without a host (<a href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li> <li>Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (<a href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li> </ul> <h2>Install uv 0.12.16</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 \| iex" </code></pre> <h2>Download uv 0.12.16</h2> <p>\| File \| Platform \| Checksum \|</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.16</h2> <p>Released on 2026-09-17.</p> <h3>Python</h3> <ul> <li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify downloaded wheels and source distributions against hashes supplied by package indexes (<a href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li> <li>Allow <code>build-constraint-dependencies</code> entries to include hashes for verifying downloaded build dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li> <li>Honor Darwin <code>platform_release</code> markers in <code>required-environments</code> using macOS wheel deployment targets (<a href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li> <li>Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (<a href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Support <code>lock-without-metadata</code> across all dependency types while retaining <code>package.metadata</code> for remote URL dependencies to enable offline validation (<a href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li> <li>Honor configured and command-line index settings, including credentials, in <code>uv upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li> <li>Allow <code>uv check</code> to run in projects that are not managed by uv and outside workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li> <li>Respect <code>--python</code> and <code>UV_PYTHON</code> when selecting the Python version for <code>uv check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Redact Azure shared access signatures from displayed and logged URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li> <li>Check archive sizes from <code>pylock.toml</code> before reusing cached distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li> <li>Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (<a href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li> <li>Use the bundled <code>uv_build</code> backend only when its version matches active version pins (<a href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li> <li>Handle malformed index URLs without panicking when credentials are configured (<a href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li> <li>Report a configuration error instead of panicking for proxy URLs without a host (<a href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li> <li>Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (<a href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li> </ul> <h2>0.12.15</h2> <p>Released on 2026-09-15.</p> <h3>Performance</h3> <ul> <li>Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (<a href="https://redirect.github.com/astral-sh/uv/pull/21675">#21675</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix regressions in <code>0.12.14</code> when installing to symlinked destinations or using <code>uv pip install --target .</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21699">#21699</a>)</li> </ul> <h2>0.12.14</h2> <p>Released on 2026-09-15.</p> <h3>Enhancements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/761ff1379b3b79f61fc8d421dfe4fe064834e084"><code>761ff13</code></a> Bump version to 0.12.16 (<a href="https://redirect.github.com/astral-sh/uv/issues/21809">#21809</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a2f820ad0cebb7118f7686be3619d48df5121f6e"><code>a2f820a</code></a> Assign release pull requests to the workflow initiator (<a href="https://redirect.github.com/astral-sh/uv/issues/21808">#21808</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6dffe7e03898409c04e2f46436bffa60abbae465"><code>6dffe7e</code></a> Ignore <code>UV_NATIVE_TLS</code> when <code>UV_SYSTEM_CERTS</code> is set (<a href="https://redirect.github.com/astral-sh/uv/issues/21805">#21805</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/7bc36767ae3ea0d45e3cc6f219765fdec2992a33"><code>7bc3676</code></a> Avoid warning when both <code>native-tls</code> and <code>system-certs</code> are configured (<a href="https://redirect.github.com/astral-sh/uv/issues/21806">#21806</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/07b838a33179967b87d513825b02504a75b21b3a"><code>07b838a</code></a> Avoid warning when both <code>UV_NATIVE_TLS</code> and <code>UV_SYSTEM_CERTS</code> are set (<a href="https://redirect.github.com/astral-sh/uv/issues/21788">#21788</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/5d64ede21e9e835e59ecd85329ebefd43faa8211"><code>5d64ede</code></a> Remove Hash API (<a href="https://redirect.github.com/astral-sh/uv/issues/21786">#21786</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9ddc4308551335e9c2ab6571ea0cf529eccf3e76"><code>9ddc430</code></a> Move shared thread initialization into uv-threads (<a href="https://redirect.github.com/astral-sh/uv/issues/21746">#21746</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/ef1e0689b4612796d7781ebeae7866028c6c9e82"><code>ef1e068</code></a> Make Git stamping opt-in for development builds (<a href="https://redirect.github.com/astral-sh/uv/issues/21750">#21750</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6ce09770cec30b30cdc66c3595517dce2b112562"><code>6ce0977</code></a> Avoid panics for non-base index URLs (<a href="https://redirect.github.com/astral-sh/uv/issues/21784">#21784</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/47f19ec154f325ade7d6045c4e785531c24635f7"><code>47f19ec</code></a> Return an error for failed VerbatimUrl path conversions (<a href="https://redirect.github.com/astral-sh/uv/issues/21783">#21783</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.13...0.12.16">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-19 23:18:59 -04:00
splitsec2andInfiniteAvenger	44f4e13cce	refactor: extract the per-source release search out of /api/releases (#1355 ) The `/api/releases` route carries an inner `_search_source_releases` helper that builds the search plan for one source, logs the planned query type, runs the search and turns `SourceUnavailableError`/operational errors into an error message instead of raising. Anything outside the route that wants to search one source with exactly those semantics has to go through Flask today. This moves that helper into `shelfmark/core/release_search.py` as `search_source_releases()` and has the route delegate to it. Behaviour is unchanged: same plan construction (including the caller's `user_id`, so per-user default languages still apply), same logging, same error-to-message handling. It is the refactor half of #1047 by @InfiniteAvenger, split out on its own as you asked for other PRs (#1318). Their authorship is preserved on the commit; I rebased it onto current `main` and added tests. ## Verification - `tests/core/test_release_search.py`: unknown source → `"Unknown source: …"`, `SourceUnavailableError` and operational errors → `"<source>: <error>"`, success path forwards `expand_search` / `content_type` and returns the source instance, the plan receives languages / manual query / indexers / `user_id`. (These tests are type-annotated; happy to strip the annotations if you prefer the suite's bare style.) - Full suite, ruff, ruff format, basedpyright, vulture green; the existing `/api/releases` route tests are unchanged and pass. Co-authored-by: InfiniteAvenger <calebewest02@gmail.com>	2026-09-19 23:16:53 -04:00
Marcelo Rodrigo	b7002a6eca	feat: Add TorBox client support and settings integration (#1342 ) Add TorBox as a torrent download client for Prowlarr releases. Users can select `TorBox` in the download client settings, configure it with the new `TORBOX_API_KEY` environment variable, and verify their credentials with the connection test button. The integration supports both magnet links and `.torrent` files. It tracks the torrent lifecycle through TorBox, downloads supported book and audiobook files from the TorBox CDN, preserves safe nested file paths, and cleans up remote and local download state. Important: Shared HTTP download logs omit full download URLs and URL-bearing exception text to avoid exposing credentials, following best practices. This applies to all clients that use the shared `download_url()` path; URLs remain available to the HTTP operations themselves. --- There is already related work in progress in #1173, which includes both torrent and direct-download support for TorBox. This PR is not intended to replace or compete with that contribution. It offers the tested torrent client functionality as a smaller, focused change that can make TorBox available to the community sooner. The direct-download integration proposed in #1173 remains valuable and could be reviewed or introduced separately. Automated tests cover configuration, connection validation, magnet and torrent-file submission, API errors, status and progress handling, file retrieval, path traversal protection, cancellation, cleanup, and sensitive URL redaction. I also validated the complete flow locally with several magnet links and `.torrent` downloads. TorBox processed the torrents and Shelfmark downloaded the resulting files as expected. AI was used to help with the implementation, with human validation. This PR and long description? Took me some good minutes at night after work, but gives me joy to open this PR to share with the community this improvement.	2026-09-19 23:15:57 -04:00
Paul Rimmer	aafce2be1d	Added the ability to sort direct search results by Most downloads (#1351 ) Now that we know about the AA Downloads stats for search results (#1336), this PR allows sorting them locally by "Most downloads" without doing another AA search. Not needing to do an AA search for this is faster than the other sorts which do new AA searches asking for their results to be sorted a certain way. Also added the "Settings->Search Mode->Default Sort Order->Most downloads" option. Universal downloads do not allow for results sorting so I did not include this feature there. NOTE: While adding this feature I noticed that shelfmark only looks at the first page of AA search results. So switching between different sort orders may result in different sets of results with the same search term. Here's a couple of pics showing the new sort option: <img width="1186" height="759" alt="search-mode-sort-order-most-downloads" src="https://github.com/user-attachments/assets/c43fe2e7-84ba-48cd-a850-383f1af0d28f" /> <img width="1172" height="828" alt="direct-search-results-most-downloads" src="https://github.com/user-attachments/assets/4e240180-6a9d-4ce1-ab86-006b286570dd" /> Coded with llama.cpp, opencode and 🤖	2026-09-19 23:12:36 -04:00
dependabot[bot]	cdd001bdd9	build(deps): bump python-socketio from 5.16.4 to 5.17.0 in the python-deps group (#1347 ) Bumps the python-deps group with 1 update: [python-socketio](https://github.com/sponsors/miguelgrinberg). Updates `python-socketio` from 5.16.4 to 5.17.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sponsors/miguelgrinberg/commits">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-socketio&package-manager=uv&previous-version=5.16.4&new-version=5.17.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-18 00:14:55 -04:00
CaliBrain	e5dd34ae0e	fix: unbreak main and follow up on the Blackhole handoff review (#1346 ) DownloadHistoryService.record_download and updated the single production caller, but not the eleven in the test suite, leaving main red with 32 failures. Pass None, which is what the pre-#1336 behaviour recorded. For the Blackhole handoff (#1345): add_download publishes the torrent before the cancel check runs, and BlackholeClient.remove() is a no-op, so the watcher picks the file up regardless. Reporting a bare "Cancelled" hid that from the user. Name the completed handoff in the cancellation message instead, drop the _handle_cancelled_download call whose usenet branch cannot apply to a handoff-only client, and record why the orchestrator no longer verifies HandoffResult.path. Finally, make tests/direct_download a package: test_libgen_extract.py imports tests.libgen.sample_html across test directories, so without an __init__.py pytest named its modules by bare basename and a same-named module elsewhere would collide.	2026-09-17 16:27:53 -04:00
dependabot[bot]	38a429acc8	build(deps): bump the python-deps group across 1 directory with 5 updates (#1344 ) Bumps the python-deps group with 5 updates in the / directory: \| Package \| From \| To \| \| --- \| --- \| --- \| \| [tqdm](https://github.com/tqdm/tqdm) \| `4.70.0` \| `4.70.1` \| \| [seleniumbase](https://github.com/seleniumbase/SeleniumBase) \| `4.53.7` \| `4.54.5` \| \| [basedpyright](https://github.com/detachhead/basedpyright) \| `1.40.0` \| `1.40.1` \| \| [prek](https://github.com/j178/prek) \| `0.5.2` \| `0.5.3` \| \| [ruff](https://github.com/astral-sh/ruff) \| `0.16.6` \| `0.16.7` \| Updates `tqdm` from 4.70.0 to 4.70.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tqdm/tqdm/releases">tqdm's releases</a>.</em></p> <blockquote> <h2>tqdm v4.70.1 stable</h2> <ul> <li><code>contrib.concurrent</code>: fix no-len iterables (<a href="https://redirect.github.com/tqdm/tqdm/issues/1830">#1830</a> <- <a href="https://redirect.github.com/tqdm/tqdm/issues/1828">#1828</a>)</li> <li>tests: major overhaul (<a href="https://redirect.github.com/tqdm/tqdm/issues/1819">#1819</a>)</li> <li>update AI policy in PR template</li> <li>misc lint & tidy</li> <li>CI: bump workflow actions & pre-commit hooks</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tqdm/tqdm/commit/9cf5a12b1f955468a17f0ba3c59092b23e4258ac"><code>9cf5a12</code></a> Merge pull request <a href="https://redirect.github.com/tqdm/tqdm/issues/1830">#1830</a> from eaubin/master</li> <li><a href="https://github.com/tqdm/tqdm/commit/24b9e1e08a097f1c30f2d235b63f9eb25ba47974"><code>24b9e1e</code></a> misc tidy</li> <li><a href="https://github.com/tqdm/tqdm/commit/2a9e4e82ddba07c5dd6d126e23a4745b76ea49c8"><code>2a9e4e8</code></a> contrib.concurrent: fix no-len iterables</li> <li><a href="https://github.com/tqdm/tqdm/commit/8d6ff8de5a9066de77d0a9df3e80a022a3dcf146"><code>8d6ff8d</code></a> Merge pull request <a href="https://redirect.github.com/tqdm/tqdm/issues/1819">#1819</a> from tqdm/devel</li> <li><a href="https://github.com/tqdm/tqdm/commit/bed379609c2c8300671c784c8f85a185c8cf6fb3"><code>bed3796</code></a> tests: major overhaul</li> <li><a href="https://github.com/tqdm/tqdm/commit/4d3d3194d5467e0701bc0f4b836a735273ef0868"><code>4d3d319</code></a> AI policy</li> <li><a href="https://github.com/tqdm/tqdm/commit/5dcb022b55553b60ed2131b64aa5bf1e65470df1"><code>5dcb022</code></a> minor syntax update</li> <li><a href="https://github.com/tqdm/tqdm/commit/309effe4244bf45427c5add7f1bcf33f98a7b421"><code>309effe</code></a> tests: pre-commit coverage</li> <li><a href="https://github.com/tqdm/tqdm/commit/604193aa03b5f5c0ad5f3d441951f0fbb515f1e4"><code>604193a</code></a> tests: slight tidy</li> <li><a href="https://github.com/tqdm/tqdm/commit/17f1cac07c89943eb0e6082875b3821205308d4f"><code>17f1cac</code></a> CI: bump workflow actions</li> <li>See full diff in <a href="https://github.com/tqdm/tqdm/compare/v4.70.0...v4.70.1">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.53.7 to 4.54.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.54.5 - MCP Server: Patch 14</h2> <h2>MCP Server: Patch 14</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/753846cca13b6ead76603781b09f725b3236ae79">Update the MCP Server</a> --> Going for a top tool score in Glama.</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/fda62a2b83b9de176342f1c21c5f72032ffd4628">Update the MCP Server ReadMe</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b6cd1e7c787cbe2c580e624e3576112d0a0de959">Refresh optional Python dependencies</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 14 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4501">seleniumbase/SeleniumBase#4501</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.4...v4.54.5">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.4...v4.54.5</a></p> <h2>4.54.4 - MCP Server: Patch 13</h2> <h2>MCP Server: Patch 13</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ec41b905a0202e13e9ed0b2f767cd755ea0f891c">Update CDP Mode (add timeout to a few methods)</a> --> (One of the ReadMe files should've been committed in the next commit with a different message)</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/eaef20040fe624f2b51e369e1ea8bf5c34bb4d9c">Update the MCP Server</a> --> (The MCP ReadMe was updated in the previous commit with the wrong commit message)</li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 13 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4500">seleniumbase/SeleniumBase#4500</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.3...v4.54.4">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.3...v4.54.4</a></p> <h2>4.54.3 - MCP Server: Patch 12</h2> <h2>MCP Server: Patch 12</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0d04ec82f7b2fa22bd84a67ad07a119c08a62d06">Update the MCP Server</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f4a86268b1177044e0a4d03348f5fab76838b96b">Update the MCP Server ReadMe</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 12 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4499">seleniumbase/SeleniumBase#4499</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.2...v4.54.3">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.2...v4.54.3</a></p> <h2>4.54.2 - MCP Server: Patch 11</h2> <h2>MCP Server: Patch 11</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7ea1bbfdae22951c3914a902c46a8520253eaf05">Update CDP Mode</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/1aa89a962424c6f3b930449844665a3fa2628d55">Update the MCP Server</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 11 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4498">seleniumbase/SeleniumBase#4498</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.1...v4.54.2">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.1...v4.54.2</a></p> <h2>4.54.1 - MCP Server: Patch 10</h2> <h2>MCP Server: Patch 10</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/3de06e5e22a2f6fe629f47bf5859bc74eebcae48"><code>3de06e5</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4501">#4501</a> from seleniumbase/mcp-server-patch-14</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4c0aaa7ca4fae594cc2826d3bdbb08cb91ea8ab3"><code>4c0aaa7</code></a> Version 4.54.5</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b6cd1e7c787cbe2c580e624e3576112d0a0de959"><code>b6cd1e7</code></a> Refresh optional Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/37cffca4f6333d87a9f86a3c1322922ddec85d0b"><code>37cffca</code></a> Update MCP Server versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/fda62a2b83b9de176342f1c21c5f72032ffd4628"><code>fda62a2</code></a> Update the MCP Server ReadMe</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/753846cca13b6ead76603781b09f725b3236ae79"><code>753846c</code></a> Update the MCP Server</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/82e3b51cc6941649dda4eed08d7b3efc0eac734a"><code>82e3b51</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4500">#4500</a> from seleniumbase/mcp-server-patch-13</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/bc14832f52674fdf9ee574d87bd7b6fed6ae2f8e"><code>bc14832</code></a> Version 4.54.4</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/8945f2d745770ca06f316e990cd971e76476a1d1"><code>8945f2d</code></a> Refresh MCP Server versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/eaef20040fe624f2b51e369e1ea8bf5c34bb4d9c"><code>eaef200</code></a> Update the MCP Server</li> <li>Additional commits viewable in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.53.7...v4.54.5">compare view</a></li> </ul> </details> <br /> Updates `basedpyright` from 1.40.0 to 1.40.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/detachhead/basedpyright/releases">basedpyright's releases</a>.</em></p> <blockquote> <h2>v1.40.1 (pyright 1.1.414)</h2> <h2>What's Changed</h2> <ul> <li>Merge 1.1.414 by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1883">DetachHead/basedpyright#1883</a></li> <li>fix multi-line display of indented lines in builtin docstrings by <a href="https://github.com/tommyming"><code>@tommyming</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1882">DetachHead/basedpyright#1882</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/DetachHead/basedpyright/compare/v1.40.0...v1.40.1">https://github.com/DetachHead/basedpyright/compare/v1.40.0...v1.40.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DetachHead/basedpyright/commit/e7fca69a08abb7cb28fc6bc5e30e24a387066694"><code>e7fca69</code></a> 1.40.1</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/f7b6ad01edff0b53cd523a176c99ba62bf44156e"><code>f7b6ad0</code></a> add checks when there are multiline indents for doc strings, update (<a href="https://redirect.github.com/detachhead/basedpyright/issues/1882">#1882</a>)</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/1bc4879cb2a1cffea9ec6009eaa290b301ba4414"><code>1bc4879</code></a> fix broken docs links</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/845bfe14f2862b3747c8146ebd53bef7644368e8"><code>845bfe1</code></a> move and baseline basedpyright errors in new build scripts from upstream</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/a9189ef5e15182e0627dd5a0f28fd2cede4f2bbc"><code>a9189ef</code></a> prettier fix</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/756bfaa06709cd32c100a3fe3d15156ff3faef6a"><code>756bfaa</code></a> fix <code>build:extension:dev</code> script</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/a7a2efdab70c919436ff593bdbd8c3b4acaa96b0"><code>a7a2efd</code></a> syncpack fix</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/5f6749f16bc38608fbf6f0d48b216320676996b8"><code>5f6749f</code></a> fix tests</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/bb9b24fddf007c547baafbd013270f2a6cb7a2cb"><code>bb9b24f</code></a> fix zizmor errors in new workflows from upstream</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/b8ccd0e8cd6cc79be5158e7c4ec2691d9c332594"><code>b8ccd0e</code></a> fix compile errors from merge</li> <li>Additional commits viewable in <a href="https://github.com/detachhead/basedpyright/compare/v1.40.0...v1.40.1">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.5.2 to 0.5.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.5.3</h2> <h2>Release Notes</h2> <p>Released on 2026-09-13.</p> <h3>Enhancements</h3> <ul> <li>Add PEP 740 attestations for PyPI releases (<a href="https://redirect.github.com/j178/prek/pull/2705">#2705</a>)</li> <li>Add a <code>check-jsonc</code> builtin hook (<a href="https://redirect.github.com/j178/prek/pull/2682">#2682</a>)</li> <li>Allow disabling automatic uv installation (<a href="https://redirect.github.com/j178/prek/pull/2702">#2702</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix Julia additional dependency specifiers (<a href="https://redirect.github.com/j178/prek/pull/2703">#2703</a>)</li> <li>Update <code>granit-parser</code> to fix YAML flow indentation (<a href="https://redirect.github.com/j178/prek/pull/2707">#2707</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/clbarnes"><code>@clbarnes</code></a></li> <li><a href="https://github.com/j178"><code>@j178</code></a></li> <li><a href="https://github.com/tisonkun"><code>@tisonkun</code></a></li> </ul> <h2>Install prek 0.5.3</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.ps1 \| iex" </code></pre> <h3>Install prebuilt binaries via Homebrew</h3> <pre lang="sh"><code>brew install prek </code></pre> <h2>Download prek 0.5.3</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-apple-darwin.tar.gz">prek-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-apple-darwin.tar.gz">prek-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-pc-windows-msvc.zip">prek-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-pc-windows-msvc.zip">prek-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/master/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.5.3</h2> <p>Released on 2026-09-13.</p> <h3>Enhancements</h3> <ul> <li>Add PEP 740 attestations for PyPI releases (<a href="https://redirect.github.com/j178/prek/pull/2705">#2705</a>)</li> <li>Add a <code>check-jsonc</code> builtin hook (<a href="https://redirect.github.com/j178/prek/pull/2682">#2682</a>)</li> <li>Allow disabling automatic uv installation (<a href="https://redirect.github.com/j178/prek/pull/2702">#2702</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix Julia additional dependency specifiers (<a href="https://redirect.github.com/j178/prek/pull/2703">#2703</a>)</li> <li>Update <code>granit-parser</code> to fix YAML flow indentation (<a href="https://redirect.github.com/j178/prek/pull/2707">#2707</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/clbarnes"><code>@clbarnes</code></a></li> <li><a href="https://github.com/j178"><code>@j178</code></a></li> <li><a href="https://github.com/tisonkun"><code>@tisonkun</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/b7eb6027125de7e3b67dd94039a4f69abf3a5fb0"><code>b7eb602</code></a> Bump version to 0.5.3 (<a href="https://redirect.github.com/j178/prek/issues/2708">#2708</a>)</li> <li><a href="https://github.com/j178/prek/commit/4644f81e1c86eeb8e22a1ba4aaa6dec99b4266c5"><code>4644f81</code></a> Update granit-parser to fix YAML flow indentation (<a href="https://redirect.github.com/j178/prek/issues/2707">#2707</a>)</li> <li><a href="https://github.com/j178/prek/commit/87f2ea44c258dc6606ca5556a7b3ff0d9a0a601e"><code>87f2ea4</code></a> Use self-repository syntax in CI workflows</li> <li><a href="https://github.com/j178/prek/commit/f39abae3cafd9ff245843b790fdd9b7c2e933b5c"><code>f39abae</code></a> Add PEP 740 attestations for PyPI releases (<a href="https://redirect.github.com/j178/prek/issues/2705">#2705</a>)</li> <li><a href="https://github.com/j178/prek/commit/f4924dccacd86afab22ae45e634d7f9ca12dd59e"><code>f4924dc</code></a> Allow disabling automatic uv installation (<a href="https://redirect.github.com/j178/prek/issues/2702">#2702</a>)</li> <li><a href="https://github.com/j178/prek/commit/156c0cec12847513ba764d1d87543ab6d0785c64"><code>156c0ce</code></a> Fix Julia additional dependency specifiers (<a href="https://redirect.github.com/j178/prek/issues/2703">#2703</a>)</li> <li><a href="https://github.com/j178/prek/commit/c3ede77b83e7d578e31d076863b755b296256a21"><code>c3ede77</code></a> Add a <code>check-jsonc</code> builtin hook (<a href="https://redirect.github.com/j178/prek/issues/2682">#2682</a>)</li> <li><a href="https://github.com/j178/prek/commit/c0b9749c3ee43f42efd0116624a7922feded3fc2"><code>c0b9749</code></a> Verify checksums for PyPI/mirror wheel installs (<a href="https://redirect.github.com/j178/prek/issues/2688">#2688</a>)</li> <li><a href="https://github.com/j178/prek/commit/fbe5c66737e679f31018dd438d16774c19c6774d"><code>fbe5c66</code></a> Update prek hooks (<a href="https://redirect.github.com/j178/prek/issues/2690">#2690</a>)</li> <li><a href="https://github.com/j178/prek/commit/4687a2c57f8ae58cf0e66b65baf49ea72ccb62ba"><code>4687a2c</code></a> Fix <code>check-hooks-apply</code> for builtin Windows filename checks</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.5.2...v0.5.3">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.6 to 0.16.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.7</h2> <h2>Release Notes</h2> <p>Released on 2026-09-10.</p> <h3>Preview features</h3> <ul> <li>[<code>ruff</code>] Add rule for default values on method receivers (<code>RUF077</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/26700">#26700</a>)</li> <li>[<code>ruff</code>] Recognize <code>re.prefixmatch</code> (<code>RUF039</code>, <code>RUF055</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28311">#28311</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Alternate nested quotes inside format spec interpolations (<a href="https://redirect.github.com/astral-sh/ruff/pull/28259">#28259</a>)</li> <li>[<code>flake8-implicit-str-concat</code>] Mark fix unsafe when it creates a docstring (<code>ISC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27981">#27981</a>)</li> <li>[<code>flake8-tidy-imports</code>] Skip fixes for multi-member imports (<code>TID254</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/26584">#26584</a>)</li> <li>[<code>pylint</code>] Gate <code>ImportCycleError</code> on Python 3.15 (<code>PLW0133</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28310">#28310</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Correct <code>D211</code> and <code>D203</code> rule conflict diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28444">#28444</a>)</li> <li>Recognize <code>slice</code> and <code>frozendict</code> generics (<a href="https://redirect.github.com/astral-sh/ruff/pull/28477">#28477</a>)</li> <li>Stop defining <code>__cached__</code> for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28476">#28476</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending removed <code>typing.no_type_check_decorator</code> (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28475">#28475</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reuse parser name lookups when interning (<a href="https://redirect.github.com/astral-sh/ruff/pull/28399">#28399</a>)</li> <li>Speed up inherited configuration resolution (<a href="https://redirect.github.com/astral-sh/ruff/pull/28299">#28299</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix <code>line-length</code> path in <code>--config</code> example (<a href="https://redirect.github.com/astral-sh/ruff/pull/28392">#28392</a>)</li> <li>Remove the "Who’s Using Ruff?" list (<a href="https://redirect.github.com/astral-sh/ruff/pull/28455">#28455</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Embed archive checksums in the shell installer (<a href="https://redirect.github.com/astral-sh/ruff/pull/28281">#28281</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/The-Compiler"><code>@The-Compiler</code></a></li> <li><a href="https://github.com/mdiniz97"><code>@mdiniz97</code></a></li> <li><a href="https://github.com/zsol"><code>@zsol</code></a></li> <li><a href="https://github.com/gorewilliams"><code>@gorewilliams</code></a></li> <li><a href="https://github.com/RafaelJohn9"><code>@RafaelJohn9</code></a></li> <li><a href="https://github.com/qatcod"><code>@qatcod</code></a></li> <li><a href="https://github.com/zanieb"><code>@zanieb</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@MichaReiser</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.7</h2> <p>Released on 2026-09-10.</p> <h3>Preview features</h3> <ul> <li>[<code>ruff</code>] Add rule for default values on method receivers (<code>RUF077</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/26700">#26700</a>)</li> <li>[<code>ruff</code>] Recognize <code>re.prefixmatch</code> (<code>RUF039</code>, <code>RUF055</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28311">#28311</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Alternate nested quotes inside format spec interpolations (<a href="https://redirect.github.com/astral-sh/ruff/pull/28259">#28259</a>)</li> <li>[<code>flake8-implicit-str-concat</code>] Mark fix unsafe when it creates a docstring (<code>ISC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27981">#27981</a>)</li> <li>[<code>flake8-tidy-imports</code>] Skip fixes for multi-member imports (<code>TID254</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/26584">#26584</a>)</li> <li>[<code>pylint</code>] Gate <code>ImportCycleError</code> on Python 3.15 (<code>PLW0133</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28310">#28310</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Correct <code>D211</code> and <code>D203</code> rule conflict diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28444">#28444</a>)</li> <li>Recognize <code>slice</code> and <code>frozendict</code> generics (<a href="https://redirect.github.com/astral-sh/ruff/pull/28477">#28477</a>)</li> <li>Stop defining <code>__cached__</code> for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28476">#28476</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending removed <code>typing.no_type_check_decorator</code> (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28475">#28475</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reuse parser name lookups when interning (<a href="https://redirect.github.com/astral-sh/ruff/pull/28399">#28399</a>)</li> <li>Speed up inherited configuration resolution (<a href="https://redirect.github.com/astral-sh/ruff/pull/28299">#28299</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix <code>line-length</code> path in <code>--config</code> example (<a href="https://redirect.github.com/astral-sh/ruff/pull/28392">#28392</a>)</li> <li>Remove the "Who’s Using Ruff?" list (<a href="https://redirect.github.com/astral-sh/ruff/pull/28455">#28455</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Embed archive checksums in the shell installer (<a href="https://redirect.github.com/astral-sh/ruff/pull/28281">#28281</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/The-Compiler"><code>@The-Compiler</code></a></li> <li><a href="https://github.com/mdiniz97"><code>@mdiniz97</code></a></li> <li><a href="https://github.com/zsol"><code>@zsol</code></a></li> <li><a href="https://github.com/gorewilliams"><code>@gorewilliams</code></a></li> <li><a href="https://github.com/RafaelJohn9"><code>@RafaelJohn9</code></a></li> <li><a href="https://github.com/qatcod"><code>@qatcod</code></a></li> <li><a href="https://github.com/zanieb"><code>@zanieb</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@MichaReiser</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/nightt5879"><code>@nightt5879</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/b5dba861cc38e3f7fb4524c9ceba3e01a474ea13"><code>b5dba86</code></a> Bump version to 0.16.7 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28496">#28496</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/5992d0504697d86565d8fc3a4d8245a5f4047d24"><code>5992d05</code></a> Install rustfmt before linting releases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28495">#28495</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/1713a1f4325494d883a080d590a25a1946f399e8"><code>1713a1f</code></a> ensure prepare release changes pass prek (<a href="https://redirect.github.com/astral-sh/ruff/issues/28488">#28488</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/18cdbb4f3d14058794420e758864795f55336334"><code>18cdbb4</code></a> use scoped token for release workflow (<a href="https://redirect.github.com/astral-sh/ruff/issues/28484">#28484</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/c3813a501faf887fd01948c98bb8d58ad26488bd"><code>c3813a5</code></a> add a workflow for preparing releases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28486">#28486</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/00948c00a671b81f5358af9f038436bcbb993b38"><code>00948c0</code></a> Remove the "Who’s Using Ruff?" list (<a href="https://redirect.github.com/astral-sh/ruff/issues/28455">#28455</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/86a2eba7b48e3c10386f7ab8a5425c7275d2b427"><code>86a2eba</code></a> [<code>pyupgrade</code>] Stop recommending removed <code>typing.no_type_check_decorator</code> (`UP...</li> <li><a href="https://github.com/astral-sh/ruff/commit/609e184aa35f0034b7ef63e3e04327081c484af6"><code>609e184</code></a> Stop defining <code>__cached__</code> for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28476">#28476</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/859ff2f01670c43ffff1ea597c8a2e375ada0fbe"><code>859ff2f</code></a> [ty] Track symlinked directory status in listings (<a href="https://redirect.github.com/astral-sh/ruff/issues/28482">#28482</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/77f653825800ddaf3bc221ae6db49a500e1002d5"><code>77f6538</code></a> Use paid GitHub-hosted runners for Linux (<a href="https://redirect.github.com/astral-sh/ruff/issues/28478">#28478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.6...0.16.7">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-17 15:53:10 -04:00
Vinicius Gabriel	c53545d9fe	Add configurable word separator for naming templates (#1333 ) Closes #1230 ## What Adds a "Word Separator" setting (Space / Dot / Underscore / Hyphen / Custom) that replaces internal whitespace in each naming-template placeholder's rendered value — e.g. `{Author}` renders "Arthur.Conan.Doyle" instead of "Arthur Conan Doyle" when Dot is selected. This follows option 2 from the issue rather than inventing new dotted-keyword template syntax (`{Author.}`), since it's a smaller surface: one setting applies uniformly across all four templates (books/audiobooks × rename/organize) instead of needing a parallel token for every existing one. ## How it works - Literal characters typed into the template itself (e.g. the `.` in `{Author}.-.{Title}`) are never touched — only whitespace inside a placeholder's resolved value is affected. - Default is "Space", which is a no-op: existing templates produce byte-identical output after this change (verified via the existing test suite, unmodified, still passing). ## Where - `shelfmark/core/naming.py` — `word_separator` param on `parse_naming_template` / `build_library_path`. - `shelfmark/download/postprocess/policy.py` — `get_word_separator()`, mirroring the existing `get_file_organization()` accessor. - `shelfmark/download/postprocess/transfer.py` — wires the resolved separator through the four existing template-rendering call sites. - `shelfmark/config/settings.py` — new `Word Separator` / `Custom Word Separator` fields next to the existing naming-template fields. - `src/frontend/.../namingTemplatePreview.ts` + `NamingTemplateField.tsx` — the settings UI has its own TS mirror of the Python renderer for the live preview; updated it in lockstep so the preview doesn't lie about what the separator will actually do. - Tests added on both sides (pytest + vitest). ## Testing - `uv run pytest tests/core/test_naming.py tests/core/test_destination_file_organization.py` — all pass, including new cases. - `uv run pytest` (full suite) — same pre-existing failures as on `main` before this change (browser/network-dependent bypass & e2e tests unrelated to this diff), everything else green. - `uv run ruff check` / `ruff format --check` / `basedpyright` — clean. - `npm run lint` / `format:check` / `typecheck` / `test:unit` (196 tests) — clean.	2026-09-17 15:52:21 -04:00
Atirna	8f608f2e64	fix(download): complete consumed Blackhole handoffs (#1345 ) A Blackhole watcher can consume the torrent before Shelfmark checks it, leaving the task in error even though the handoff succeeded. Complete the handoff when `add_download` successfully publishes the file, and stop requiring a `HandoffResult` path to remain present. Follow-up to #1312. ## Verification - A watcher that immediately reads and removes the torrent receives the exact bytes. The task changes from ERROR before this fix to COMPLETE afterward, without running book postprocessing. - The consumed-file regression fails on current main and passes here. Resident files, write failures, cancellation, magnet rejection and normal downloads remain covered: 81 focused tests pass. - Ruff lint and formatting pass for the changed files.	2026-09-17 15:51:20 -04:00
David Young	2bb84a17a2	Extract archives when zip/rar are enabled as supported formats (#1343 ) The default audiobook formats include `zip` and `rar`. `scan_directory_tree` checks the supported-format list before checking for archives, so a downloaded archive lands in `book_files` and is imported as-is. The extraction branch in `collect_directory_files` is never reached. This keeps archives out of `book_files`, so they always take the archive path: extracted when extraction is allowed, imported as-is when it isn't (unchanged). Tests added in `tests/download/test_postprocess_scan_archives.py`; three of the four fail without the change.	2026-09-17 15:50:52 -04:00
Paul Rimmer	2ed2e9a5d4	Feature: Add Download counts to search result displays and Download sidebar (#1336 ) Having the download counts from AA as an input on choosing which of the many search results to pick for downloading is useful. This PR makes the downloads numbers available on all the search result pages and also on the Download sidebar after the user presses a download button for a Direct Download. I have also included a SKILL.md and associated download_books.py that can be used just as a reference or with an LLM harness for automation. The Downloads info is used by the script to pick which search result to download out of the many available. Since a picture is worth a thousand words: <img width="1225" height="812" alt="search-results-with-downloads" src="https://github.com/user-attachments/assets/e108ebe2-4cad-45e2-bb6a-d4f49b502de9" /> <img width="443" height="267" alt="download-sidebar-with-downloads" src="https://github.com/user-attachments/assets/9ce9e6c4-dcf5-4f7c-ab22-71850398b534" /> Coded with llama.cpp and 🤖	2026-09-17 15:49:57 -04:00
Alex Guerrieri	c6b70a6844	fix(sources): send a Referer when fetching libgen ads.php pages (#1340 ) ## What libgen.li's `ads.php?md5=` now returns an empty `200` to any request without a `Referer` — an anti-hotlinking check the mirrors added recently. Both libgen paths fetch it without one, so the page comes back blank and the download silently fails while search keeps working (which is exactly why it looks like rate-limiting or mirror drift rather than a bug). Same one-line cause, two call sites: the Libgen search source (`libgen/scraper.py:fetch_page`) and the AA-md5 → libgen fallback (`direct_download/annas_archive.py:_extract_libgen_download_url`). Fix: send a same-origin `Referer: <scheme>://<host>/` on the `ads.php` fetch in both. ## Worth a look in review - *The referer goes on the resolution* fetch, not the download.** `download_url(..., referer=...)` was already correct — the blank page happens one step earlier, at the `ads.php` GET. - Reproduced against live mirrors: `ads.php` returns `Content-Length: 0` bare, the full page with a `Referer`, and resolvable files download valid bytes again. Regression tests in `tests/libgen/` and `tests/direct_download/` assert the header on both paths. Lint/format/typecheck clean. Follow-up to #1326.	2026-09-17 15:47:45 -04:00
CaliBrain	35b89b0d78	fix(sources): restore Direct Download search errors and language matches (#1339 ) Fixes two regressions from the provider-driven refactor (#1337). First, the composite search caught RuntimeError, TypeError, ValueError and request errors from each provider and returned an empty list, so a failed search looked like one with no hits. It now raises the first provider failure when no provider returned releases. Second, the shared parser re-matched every row's language locally, dropping rows Anna's Archive had already matched with &lang= (free-text cells like 'English, French' or 'unknown'). parse_search_items gains a filter_languages option, which AA turns off, so AA's own language-from-path filter is again the only local one.	2026-09-14 01:30:05 -04:00
Tom	a5cd9f0bfb	refactor: make direct download provider-driven (#1337 ) This is the refactor for the download handler	2026-09-14 01:16:53 -04:00
Alex Guerrieri	af21d1da1f	feat(sources): add Libgen as a direct catalogue search source (#1326 ) ## What Adds Libgen as a search source. Today Libgen is only a download mirror (reached by an Anna's Archive md5), so anything in Libgen but not in AA's search index is invisible — and that's where most of the CBZ/CBR comics and manga live. A Libgen search for One Piece, for instance, turns up ~99 volumes that AA search never shows. It's a self-contained `release_sources/libgen/` package (source + handler + settings) plus one line to register it. No changes to `direct_download.py` — it reuses the existing `ads.php → get.php` resolution and the mirrors already configured in `LIBGEN_MIRROR_URLS`. Plain HTTP, no bypasser needed (libgen.li isn't behind DDoS-Guard). Opt-in via a settings toggle. ## Worth a look in review - `source_id` is `libgen:<md5>`, not the bare md5. The download queue keys on `task_id` (= `source_id`), and `direct_download` already uses the bare md5. Since AA indexes a lot of Libgen, the same md5 shows up from both sources — a bare id would collide in the queue. The handler strips the prefix before downloading. - Reachable like the other non-default sources (Prowlarr, AudiobookBay, …): it appears in the per-book release search, not the free-text box (that stays wired to `direct_download`). Tests in `tests/libgen/` cover parsing (both row layouts), the source, the handler, and `get_record`. Lint/format/typecheck clean.	2026-09-14 01:08:08 -04:00
CaliBrain	1b17fe179a	fix(irc): rank a surname-only result as partial, not wrong (#1332 ) (#1334 ) "David Petrie" as "D. Petrie", then ranked the answer by the full name to recover the precision the surname gave up. The two halves disagreed. author_affinity needs two agreeing tokens before it calls a name the same person, so "Petrie" - the name on the filenames a surname search exists to reach - matched one and came back AUTHOR_MISMATCH. It therefore sorted below "Unknown" and level with "Gordon Petrie", a different author who merely shares the surname. The widened query pulled those rows in and the ranker buried them. Falling short of agreement is now separated from disagreeing with it. A name whose every token fits the one asked for is an abbreviation of it and ranks AUTHOR_PARTIAL, between agreement and "no author reported"; a name carrying a token that fits nothing still ranks AUTHOR_MISMATCH. Nothing that agreed before changes tier - "Homer"/"Homer Simpson" is still a match, since the extra token must not demote a mononym that already met its one-token requirement - so Prowlarr's #1293 ordering is unchanged except that a tracker listing a bare surname stops being read as the wrong author. Measured on the issue's own case, wanted "David Petrie": before: D Petrie, Unknown, Petrie, Gordon Petrie after: D Petrie, Petrie, Unknown, Gordon Petrie Second fix, same release: a book with no title posted the surname on its own. _build_query fell back to book.search_title or book.title, which is empty on exactly the path where the plan has no title variants, so the line reaching the channel was "@search Petrie" - not a search for anything, and the kind of bare over-broad post is_available refuses unaddressed queries to avoid. It now returns "" and the existing "No search query could be built" guard takes it. Tested with make python-lint, python-format, python-dead-code, python-typecheck and python-test.	2026-09-11 22:26:28 -04:00
Zoltán Szabó	35037b35fd	fix(irc): search by surname, and rank the answer by author (#1331 ) (#1332 ) Fixes #1331. A search bot ANDs every term against a filename, so the given name is the term that empties the result set. Measured against irchighway's #ebooks: "Revelations David Petrie" is answered "no results", "Revelations Petrie" returns 9 matches, 6 of which parse, all filed as "D Petrie". The query now carries the title and the surname, read off the search variant so the ISBN fallback and a manual query - which set author="" on purpose - keep their current shape. Title-only, the shape #1295 settled on for Prowlarr, does not transfer: the bot caps an answer at 1000 matches, and a bare "Revelations" hits that cap with 923 parsed rows across 500 authors, so the cap itself can drop the wanted book. The surname is the token the two spellings share and it keeps the answer small. The full author then orders what comes back, reusing author_affinity from #1295, since a surname also matches a different author who shares it. It sits under server availability the way indexer priority does in #1295: a download addresses one named bot and waits 120s for it, so a match from a bot that has left the channel must not outrank a mismatch that can answer. Ranking runs on the way out rather than before the cache, because one query identity is shared by every book that produced that query. Two things found while testing: - The parser writes the literal "Unknown" when a filename has no " - " separator (parser.py:168). Ranked literally that sorts as a wrong author, so author_affinity's middle tier was unreachable here; it is now read as absent. 5 of those 923 rows are affected. - author_affinity moves to shelfmark/core/author_match.py, unchanged, so IRC does not import from the Prowlarr package. Prowlarr behaviour is untouched and its tests pass as they are. The three IRC assertions in the #1252 regression file move to the surname form. The invariant they pin - one contributor's name reaches the query, never the whole credit list - is unchanged. Tested with make python-lint, python-format, python-dead-code, python-typecheck and python-test, and end to end against irchighway with the patched source: it posts "Revelations Petrie" and returns 6 releases.	2026-09-11 22:14:37 -04:00
dependabot[bot]	8c902d7f7a	build(deps-dev): bump vitest from 4.1.11 to 5.0.0 in /src/frontend (#1330 ) Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.11 to 5.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v5.0.0</h2> <p>Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our <a href="https://vitest.dev/blog/vitest-5.html">blog post</a> for the official announcement.</p> <h3> 🚨 Breaking Changes</h3> <ul> <li>Replace <code>loupe.inspect</code> with pretty-format - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Claude Opus 5 (1M context)</strong> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9609">vitest-dev/vitest#9609</a> <a href="https://github.com/vitest-dev/vitest/commit/3f802da4b"><!-- raw HTML omitted -->(3f802)<!-- raw HTML omitted --></a></li> <li>Remove quotes from string values in <code>test.for/each</code> title <code>$</code> variable (take 2) - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10170">vitest-dev/vitest#10170</a> <a href="https://github.com/vitest-dev/vitest/commit/04d37e9d7"><!-- raw HTML omitted -->(04d37)<!-- raw HTML omitted --></a></li> <li>Default <code>attachmentsDir</code> from <code>.vitest-attachements/</code> to <code>.vitest/attachments/</code> - by <a href="https://github.com/MdSadiqMd"><code>@MdSadiqMd</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10186">vitest-dev/vitest#10186</a> <a href="https://github.com/vitest-dev/vitest/commit/1ba7338c3"><!-- raw HTML omitted -->(1ba73)<!-- raw HTML omitted --></a></li> <li>Remove <code>sequential</code> test/suite options in favor of <code>concurrent</code> - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10198">vitest-dev/vitest#10198</a> <a href="https://github.com/vitest-dev/vitest/commit/9229f2edc"><!-- raw HTML omitted -->(9229f)<!-- raw HTML omitted --></a></li> <li>Represent locator as an object instead of a string - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10212">vitest-dev/vitest#10212</a> <a href="https://github.com/vitest-dev/vitest/commit/80f07edf6"><!-- raw HTML omitted -->(80f07)<!-- raw HTML omitted --></a></li> <li>Inline <code>expect</code> package - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10221">vitest-dev/vitest#10221</a> <a href="https://github.com/vitest-dev/vitest/commit/ad16223e7"><!-- raw HTML omitted -->(ad162)<!-- raw HTML omitted --></a></li> <li>Remove deprecated entry points - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10222">vitest-dev/vitest#10222</a> <a href="https://github.com/vitest-dev/vitest/commit/994c6ddb9"><!-- raw HTML omitted -->(994c6)<!-- raw HTML omitted --></a></li> <li>Require Node.js 22 and Vite 6.4 - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10178">vitest-dev/vitest#10178</a> <a href="https://github.com/vitest-dev/vitest/commit/3876283e8"><!-- raw HTML omitted -->(38762)<!-- raw HTML omitted --></a></li> <li>Fail <code>expect.poll</code> when function didn't resolve in time - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10233">vitest-dev/vitest#10233</a> <a href="https://github.com/vitest-dev/vitest/commit/4df048c11"><!-- raw HTML omitted -->(4df04)<!-- raw HTML omitted --></a></li> <li>Throw an error if hoistable methods are outside the top level scope - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10460">vitest-dev/vitest#10460</a> <a href="https://github.com/vitest-dev/vitest/commit/d0b4fddcb"><!-- raw HTML omitted -->(d0b4f)<!-- raw HTML omitted --></a></li> <li><code>toHaveTextContent</code> is strict, add <code>toMatchTextContent</code> as alternative - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10473">vitest-dev/vitest#10473</a> <a href="https://github.com/vitest-dev/vitest/commit/18f303079"><!-- raw HTML omitted -->(18f30)<!-- raw HTML omitted --></a></li> <li>Don't lookup config file from ancestor directories - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>OpenAI Codex</strong> and <strong>Hiroshi Ogawa</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10428">vitest-dev/vitest#10428</a> <a href="https://github.com/vitest-dev/vitest/commit/945d9090e"><!-- raw HTML omitted -->(945d9)<!-- raw HTML omitted --></a></li> <li>Inline <code>@vitest/runner</code> package, do not publish it anymore - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10511">vitest-dev/vitest#10511</a> <a href="https://github.com/vitest-dev/vitest/commit/6d6e46b1e"><!-- raw HTML omitted -->(6d6e4)<!-- raw HTML omitted --></a></li> <li>Allow mutating happy-dom/jsdom window object - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10373">vitest-dev/vitest#10373</a> <a href="https://github.com/vitest-dev/vitest/commit/206e8cff8"><!-- raw HTML omitted -->(206e8)<!-- raw HTML omitted --></a></li> <li>Expose <code>concurrencyId</code>/<code>workerId</code> on TestModule's diagnostics, make id 1-based - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10516">vitest-dev/vitest#10516</a> <a href="https://github.com/vitest-dev/vitest/commit/bdd985433"><!-- raw HTML omitted -->(bdd98)<!-- raw HTML omitted --></a></li> <li>Add <code>screenshotDirectory</code> config to <code>browser.expect.toMatchScreenshot</code> - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10592">vitest-dev/vitest#10592</a> <a href="https://github.com/vitest-dev/vitest/commit/a60ded0fb"><!-- raw HTML omitted -->(a60de)<!-- raw HTML omitted --></a></li> <li>Update <code>@sinonjs/fake-timers</code> and support mocking <code>Temporal</code> - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (gpt-5.6-sol)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10654">vitest-dev/vitest#10654</a> <a href="https://github.com/vitest-dev/vitest/commit/f8b1532fe"><!-- raw HTML omitted -->(f8b15)<!-- raw HTML omitted --></a></li> <li>Remove webdriverio package - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10675">vitest-dev/vitest#10675</a> <a href="https://github.com/vitest-dev/vitest/commit/5fed68f72"><!-- raw HTML omitted -->(5fed6)<!-- raw HTML omitted --></a></li> <li>Clear mocks by default before each test - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10613">vitest-dev/vitest#10613</a> <a href="https://github.com/vitest-dev/vitest/commit/0f6463bf2"><!-- raw HTML omitted -->(0f646)<!-- raw HTML omitted --></a></li> <li>Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10293">vitest-dev/vitest#10293</a> <a href="https://github.com/vitest-dev/vitest/commit/334edef92"><!-- raw HTML omitted -->(334ed)<!-- raw HTML omitted --></a></li> <li>Separate config resolution from the server creation - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10554">vitest-dev/vitest#10554</a> <a href="https://github.com/vitest-dev/vitest/commit/1c0ec3444"><!-- raw HTML omitted -->(1c0ec)<!-- raw HTML omitted --></a></li> <li>Inline projects extend the root config by default - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10750">vitest-dev/vitest#10750</a> <a href="https://github.com/vitest-dev/vitest/commit/fec001ad3"><!-- raw HTML omitted -->(fec00)<!-- raw HTML omitted --></a></li> <li>Enable mocking Temporal without fake timers - by <a href="https://github.com/fabon-f"><code>@fabon-f</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (gpt-5.6-sol)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10757">vitest-dev/vitest#10757</a> <a href="https://github.com/vitest-dev/vitest/commit/ac2d46b42"><!-- raw HTML omitted -->(ac2d4)<!-- raw HTML omitted --></a></li> <li>Support nested projects - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10846">vitest-dev/vitest#10846</a> <a href="https://github.com/vitest-dev/vitest/commit/ec367cf2a"><!-- raw HTML omitted -->(ec367)<!-- raw HTML omitted --></a></li> <li>Use <code>></code> as separator in <code>-t</code>, calculate <code>only</code> once - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10686">vitest-dev/vitest#10686</a> <a href="https://github.com/vitest-dev/vitest/commit/a0b20bc86"><!-- raw HTML omitted -->(a0b20)<!-- raw HTML omitted --></a></li> <li>Fail the test when an asynchronous assertion is not awaited - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10868">vitest-dev/vitest#10868</a> <a href="https://github.com/vitest-dev/vitest/commit/86d4a9da9"><!-- raw HTML omitted -->(86d4a)<!-- raw HTML omitted --></a></li> <li>Share the Vite server between inline projects - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10848">vitest-dev/vitest#10848</a> <a href="https://github.com/vitest-dev/vitest/commit/d87c96ee4"><!-- raw HTML omitted -->(d87c9)<!-- raw HTML omitted --></a></li> <li>Parse files statically in vitest list by default - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11088">vitest-dev/vitest#11088</a> <a href="https://github.com/vitest-dev/vitest/commit/51e949416"><!-- raw HTML omitted -->(51e94)<!-- raw HTML omitted --></a></li> <li><strong>benchmark</strong>: <ul> <li>Rewrite the public API - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10113">vitest-dev/vitest#10113</a> <a href="https://github.com/vitest-dev/vitest/commit/19f6e8947"><!-- raw HTML omitted -->(19f6e)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>browser</strong>: <ul> <li>Iframe scale - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9745">vitest-dev/vitest#9745</a> <a href="https://github.com/vitest-dev/vitest/commit/b639852cc"><!-- raw HTML omitted -->(b6398)<!-- raw HTML omitted --></a></li> <li>Enable <code>locators.exact</code> by default - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10430">vitest-dev/vitest#10430</a> <a href="https://github.com/vitest-dev/vitest/commit/e203202f9"><!-- raw HTML omitted -->(e2032)<!-- raw HTML omitted --></a></li> <li>Require <code>sessionId</code> for orchestrator html request - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10522">vitest-dev/vitest#10522</a> <a href="https://github.com/vitest-dev/vitest/commit/79b7d8fcc"><!-- raw HTML omitted -->(79b7d)<!-- raw HTML omitted --></a></li> <li>Save failure screenshots in <code>attachmentsDir</code> - by <a href="https://github.com/macarie"><code>@macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10917">vitest-dev/vitest#10917</a> <a href="https://github.com/vitest-dev/vitest/commit/3b5bbd8b4"><!-- raw HTML omitted -->(3b5bb)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>coverage</strong>: <ul> <li><code>include/exclude</code> globs too eager - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9818">vitest-dev/vitest#9818</a> <a href="https://github.com/vitest-dev/vitest/commit/edacb0fd4"><!-- raw HTML omitted -->(edacb)<!-- raw HTML omitted --></a></li> <li>Allow <code>thresholds.perFile</code> to accept an object - by <a href="https://github.com/vladlenskiy"><code>@vladlenskiy</code></a> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10190">vitest-dev/vitest#10190</a> <a href="https://github.com/vitest-dev/vitest/commit/13b78d98b"><!-- raw HTML omitted -->(13b78)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>expect</strong>: <ul> <li>Fix <code>toThrow("")</code> behavior by reverting <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/6710">#6710</a> - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9643">vitest-dev/vitest#9643</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/6710">vitest-dev/vitest#6710</a> <a href="https://github.com/vitest-dev/vitest/commit/6c3e4bdbf"><!-- raw HTML omitted -->(6c3e4)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Deserialize automock as automock - by <a href="https://github.com/nami8824"><code>@nami8824</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10192">vitest-dev/vitest#10192</a> <a href="https://github.com/vitest-dev/vitest/commit/2f892712d"><!-- raw HTML omitted -->(2f892)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>reporters</strong>: <ul> <li><code>blob</code> reporter and <code>--merge-reports</code> default to <code>.vitest/blob/</code> - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10232">vitest-dev/vitest#10232</a> <a href="https://github.com/vitest-dev/vitest/commit/d22b029ae"><!-- raw HTML omitted -->(d22b0)<!-- raw HTML omitted --></a></li> <li>Write json and junit reporter output files to <code>.vitest</code> by default - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong>, <strong>OpenCode (gpt-5.6-sol)</strong> and <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10621">vitest-dev/vitest#10621</a> <a href="https://github.com/vitest-dev/vitest/commit/58577290a"><!-- raw HTML omitted -->(58577)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/f441c6fab25e579c5b7dd3dd50538416f415fbae"><code>f441c6f</code></a> chore: release v5.0.0 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11130">#11130</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/d46a7472266d5bb43595ea51dcdd64ab0f560f12"><code>d46a747</code></a> fix: treat test.describe as a suite during static collection (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11128">#11128</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/584cf308437069385b0fb905fa3ff7d7b7f65a90"><code>584cf30</code></a> fix: add a warning if inline project has duplicate plugins due to unexpected ...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/f08ce4b7144542af128dcb884150c42074223653"><code>f08ce4b</code></a> fix: apply queued mocks from doMock() in queue order (fixes <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10706">#10706</a>) (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11127">#11127</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/897f51fd2493046c52ec9539b7d02fe3763bd63e"><code>897f51f</code></a> chore: release v5.0.0-rc.4 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11107">#11107</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/1339b0655dc4679aeb8f905bacee83b6f76f6b23"><code>1339b06</code></a> chore(deps): update all non-major dependencies (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11104">#11104</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/51e9494166d8d0108a621fce80c41b6dba760bae"><code>51e9494</code></a> feat!: parse files statically in vitest list by default (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11088">#11088</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/2122ffdfb42d86c9a2f1238100d6a031312cae32"><code>2122ffd</code></a> fix: propagate --maxWorkers to projects (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11102">#11102</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/dc10f5f8fb69b026afcf56f8a7a9dd36bd964d73"><code>dc10f5f</code></a> fix(browser): report the action error when a task times out (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11101">#11101</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/d4fe1986fe334d22940039e815ccdbcc907baa6a"><code>d4fe198</code></a> feat: promote clearCache out of experimental (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11086">#11086</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/vitest">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vitest&package-manager=npm_and_yarn&previous-version=4.1.11&new-version=5.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-11 02:07:57 -04:00
dependabot[bot]	68de5de241	build(deps-dev): bump the npm-deps group in /src/frontend with 4 updates (#1329 ) Bumps the npm-deps group in /src/frontend with 4 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom), [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) and [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint). Updates `@types/node` from 26.4.0 to 26.5.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `@types/react-dom` from 19.2.5 to 19.2.7 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom">compare view</a></li> </ul> </details> <br /> Updates `oxfmt` from 0.65.0 to 0.67.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md">oxfmt's changelog</a>.</em></p> <blockquote> <h2>[0.67.0] - 2026-09-07</h2> <h3>🛡️ Security</h3> <ul> <li>9a612d5 deps: Update npm packages (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26178">#26178</a>) (renovate[bot])</li> </ul> <h2>[0.64.0] - 2026-08-18</h2> <h3>🚀 Features</h3> <ul> <li>c07fe7c oxfmt: Support <code>experimentalOperatorPosition</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25643">#25643</a>) (leaysgur)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>fed6681 oxfmt: Skip expanding overrides options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25572">#25572</a>) (leaysgur)</li> </ul> <h2>[0.62.0] - 2026-08-03</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>e6e584b oxfmt: Type jsdoc. enum options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25008">#25008</a>) (leaysgur)</li> </ul> <h2>[0.59.0] - 2026-07-13</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/24286">#24286</a>) (leaysgur)</li> </ul> <h2>[0.55.0] - 2026-06-15</h2> <h3>🚀 Features</h3> <ul> <li>9a2788b linter/unicorn: Implement <code>prefer-export-from</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/22935">#22935</a>) (AliceLanniste)</li> </ul> <h2>[0.54.0] - 2026-06-08</h2> <h3>📚 Documentation</h3> <ul> <li>dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/22965">#22965</a>) (Boshen)</li> <li>f88961a oxfmt: Annotate each config option with supported languages (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/22953">#22953</a>) (leaysgur)</li> </ul> <h2>[0.52.0] - 2026-05-26</h2> <h3>🚀 Features</h3> <ul> <li>16b8058 oxfmt: Support <code>vite-plus/resolveConfig</code> for vite.config.ts (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/22454">#22454</a>) (leaysgur)</li> </ul> <h2>[0.50.0] - 2026-05-15</h2> <h3>🐛 Bug Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/b4da00b621ec2f6f67ed218f5366c45ed325331b"><code>b4da00b</code></a> release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26384">#26384</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/9a612d57e5f1ad9ee6f9f0d8d67692cd430f7ecf"><code>9a612d5</code></a> chore(deps): update npm packages (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26178">#26178</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/0b4e2e67f4193e7ebfcc64982275eb583ae82c83"><code>0b4e2e6</code></a> release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26199">#26199</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/5ff57f83c049e338db8b2435dd92f660bfe19ed4"><code>5ff57f8</code></a> fix(formatter/sort-imports): handle custom side effect groups (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26217">#26217</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/63bc313934bf1fe94f8e0e6e59336f6036b8506e"><code>63bc313</code></a> chore(npm): update funding URL (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26066">#26066</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.67.0/npm/oxfmt">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.80.0 to 1.82.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxlint's releases</a>.</em></p> <blockquote> <h2>oxlint v1.82.0 & oxfmt v0.67.0</h2> <h2>Table of Contents</h2> <ul> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/blob/HEAD/#oxlint-v1.82.0">Oxlint v1.82.0</a></li> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/blob/HEAD/#oxfmt-v0.67.0">Oxfmt v0.67.0</a></li> </ul> <h2>Oxlint v1.82.0</h2> <h3>💥 BREAKING CHANGES</h3> <ul> <li>66744f0 parser: [<strong>BREAKING</strong>] Rename <code>panicked</code> to <code>fatal_error</code> in <code>ParserReturn</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26382">#26382</a>) (overlookmotel)</li> </ul> <h3>🚀 Features</h3> <ul> <li>6a0e19c linter/eslint/no-unmodified-loop-condition: Support <code>checkConditionalExpressions</code> option (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26249">#26249</a>) (camc314)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>aa38ddf linter/unicorn/numeric-separators-style: Correct schema defaults (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26393">#26393</a>) (camc314)</li> <li>562dd14 jsx-a11y/anchor-has-content: Allow anchors passed as custom component props (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26360">#26360</a>) (Mikhail Baev)</li> <li>253cdb2 linter/eslint/id-length: Exempt TS interface/type-literal members with never (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26310">#26310</a>) (Pearce Ropion)</li> <li>8c7ea76 ast_visit: Account for trimmed source offsets (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26223">#26223</a>) (Cameron)</li> <li>5f9cffc linter/typescript/no-explicit-any: Fix rest parameter to <code>unknown[]</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26279">#26279</a>) (camc314)</li> <li>4de9fa3 linter/react/jsx-no-literals: Check nested JSX expression literals (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26253">#26253</a>) (camc314)</li> <li>07851b9 parser: Fix debug assert failure when lexer error with tokens enabled (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26229">#26229</a>) (overlookmotel)</li> <li>9cee146 oxlint/lsp: Don't try to parse fix message, always fallback (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26204">#26204</a>) (Sysix)</li> <li>a662c40 linter/eslint/no-useless-assignment: Handle destructuring assignments (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25925">#25925</a>) (camc314)</li> <li>304bd9a linter/eslint/no-array-constructor: Handle ASI hazards in fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26166">#26166</a>) (Hamody We)</li> <li>b41bb35 linter: Qualify rules in rules output (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26250">#26250</a>) (camc314)</li> <li>895c685 linter/typescript/no-extraneous-class: Avoid deleting class expressions (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26231">#26231</a>) (camc314)</li> <li>4ba33c8 linter/eslint/no-unused-vars: Handle stored arrow references (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26225">#26225</a>) (camc314)</li> </ul> <h3>🛡️ Security</h3> <ul> <li>9a612d5 deps: Update npm packages (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26178">#26178</a>) (renovate[bot])</li> </ul> <h2>Oxfmt v0.67.0</h2> <h3>💥 BREAKING CHANGES</h3> <ul> <li>66744f0 parser: [<strong>BREAKING</strong>] Rename <code>panicked</code> to <code>fatal_error</code> in <code>ParserReturn</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26382">#26382</a>) (overlookmotel)</li> <li>2c9a947 parser: [<strong>BREAKING</strong>] Reduce <code>MAX_LEN</code> to 256 bytes below <code>u32::MAX</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26352">#26352</a>) (overlookmotel)</li> </ul> <h3>🚀 Features</h3> <ul> <li>68e12ab formatter_css: Follow the oxc-css-parser's acceptance line (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26337">#26337</a>) (leaysgur)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>f7acdc0 formatter: Treat a JSDoc cast target as opaque in chain layouts (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26375">#26375</a>) (leaysgur)</li> <li>104061b formatter: Keep JSDoc cast parens with a comment inside them (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26374">#26374</a>) (leaysgur)</li> <li>3d00a76 formatter_css: Keep comment inside important and simple-vars colon (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26370">#26370</a>) (leaysgur)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's changelog</a>.</em></p> <blockquote> <h2>[1.82.0] - 2026-09-07</h2> <h3>🚀 Features</h3> <ul> <li>6a0e19c linter/eslint/no-unmodified-loop-condition: Support <code>checkConditionalExpressions</code> option (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26249">#26249</a>) (camc314)</li> </ul> <h2>[1.81.0] - 2026-08-31</h2> <h3>📚 Documentation</h3> <ul> <li>d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26100">#26100</a>) (camc314)</li> </ul> <h2>[1.79.0] - 2026-08-18</h2> <h3>💥 BREAKING CHANGES</h3> <ul> <li>8c4552d linter: [<strong>BREAKING</strong>] Split react/react-compiler into per-category rules (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25500">#25500</a>) (Boshen)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>228e8e0 linter: Resolve inactive React compiler rules (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25830">#25830</a>) (Boshen)</li> <li>aa49d86 linter: Allow spread rule options in config types (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25675">#25675</a>) (ch3rry)</li> <li>36f8451 linter/eslint/no-eval: Align indirect default with ESLint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25656">#25656</a>) (camc314)</li> <li>beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25663">#25663</a>) (camc314)</li> <li>4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25660">#25660</a>) (camc314)</li> <li>285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25611">#25611</a>) (Mikhail Baev)</li> <li>4df5835 linter: Allow capitalized built-in calls (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25516">#25516</a>) (Boshen)</li> </ul> <h2>[1.78.0] - 2026-08-10</h2> <h3>🚀 Features</h3> <ul> <li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>) (Mikhail Baev)</li> <li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>) (Cole Ellison)</li> <li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>) (Cole Ellison)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>9573937 linter/typescript: Validate <code>ban-ts-comment</code> description_format (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>) (Mikhail Baev)</li> </ul> <h2>[1.77.0] - 2026-08-03</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25151">#25151</a>) (Mikhail Baev)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>) (camc314)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/b4da00b621ec2f6f67ed218f5366c45ed325331b"><code>b4da00b</code></a> release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26384">#26384</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/aa38ddfbea657a9d332f86e42e235ff8cbdcac6d"><code>aa38ddf</code></a> fix(linter/unicorn/numeric-separators-style): correct schema defaults (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26393">#26393</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/6a0e19cfaae35ec882de6bc8dde7668d1b0cc58e"><code>6a0e19c</code></a> feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...</li> <li><a href="https://github.com/oxc-project/oxc/commit/0b4e2e67f4193e7ebfcc64982275eb583ae82c83"><code>0b4e2e6</code></a> release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26199">#26199</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/d5be0375e6303202fcd6d34fa520103eceea0238"><code>d5be037</code></a> docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...</li> <li><a href="https://github.com/oxc-project/oxc/commit/63bc313934bf1fe94f8e0e6e59336f6036b8506e"><code>63bc313</code></a> chore(npm): update funding URL (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26066">#26066</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.82.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-11 02:07:23 -04:00
dependabot[bot]	9eb47989ec	build(deps): bump the docker-base-image-digests group with 2 updates (#1328 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `e67514e` to `50c8e8c` Updates `astral-sh/uv` from 0.12.9 to 0.12.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.13</h2> <h2>Release Notes</h2> <p>Released on 2026-09-10.</p> <h3>Python</h3> <ul> <li>Add GraalPy 3.13.0 (<a href="https://redirect.github.com/astral-sh/uv/pull/21431">#21431</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify hashes when downloading PEP 658 metadata sidecars (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Respect <code>ty</code> exclusions when <code>uv check</code> automatically selects members of a virtual workspace (<a href="https://redirect.github.com/astral-sh/uv/pull/21555">#21555</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (<a href="https://redirect.github.com/astral-sh/uv/pull/21279">#21279</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (<a href="https://redirect.github.com/astral-sh/uv/pull/18713">#18713</a>)</li> <li>Prefer <code>core-metadata</code> over legacy aliases in JSON index responses (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h2>Install uv 0.12.13</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 \| iex" </code></pre> <h2>Download uv 0.12.13</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.13</h2> <p>Released on 2026-09-10.</p> <h3>Python</h3> <ul> <li>Add GraalPy 3.13.0 (<a href="https://redirect.github.com/astral-sh/uv/pull/21431">#21431</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify hashes when downloading PEP 658 metadata sidecars (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Respect <code>ty</code> exclusions when <code>uv check</code> automatically selects members of a virtual workspace (<a href="https://redirect.github.com/astral-sh/uv/pull/21555">#21555</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (<a href="https://redirect.github.com/astral-sh/uv/pull/21279">#21279</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (<a href="https://redirect.github.com/astral-sh/uv/pull/18713">#18713</a>)</li> <li>Prefer <code>core-metadata</code> over legacy aliases in JSON index responses (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h2>0.12.12</h2> <p>Released on 2026-09-09.</p> <p>The executables in our macOS and Windows release archives and <code>uv</code> and <code>uv_build</code> wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.</p> <h3>Bug fixes</h3> <ul> <li>Exclude distributions uploaded after the <code>exclude-newer</code> cutoff from lockfiles and generated requirement hashes (<a href="https://redirect.github.com/astral-sh/uv/pull/21539">#21539</a>)</li> </ul> <h2>0.12.11</h2> <p>Released on 2026-09-08.</p> <h3>Preview features</h3> <ul> <li>Generate missing artifact hashes when exporting <code>pylock.toml</code> files to ensure they conform to PEP 751 (<a href="https://redirect.github.com/astral-sh/uv/pull/20146">#20146</a>)</li> <li>Warn when <code>pylock.toml</code> artifact hash tables are empty, which will be rejected in a future uv release (<a href="https://redirect.github.com/astral-sh/uv/pull/21462">#21462</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (<a href="https://redirect.github.com/astral-sh/uv/pull/21478">#21478</a>)</li> <li>Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (<a href="https://redirect.github.com/astral-sh/uv/pull/21468">#21468</a>)</li> <li>Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (<a href="https://redirect.github.com/astral-sh/uv/pull/21500">#21500</a>)</li> <li>Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (<a href="https://redirect.github.com/astral-sh/uv/pull/21499">#21499</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/0ebbd9274a55a8a53a13970be3b97e4209598e17"><code>0ebbd92</code></a> Bump version to 0.12.13 (<a href="https://redirect.github.com/astral-sh/uv/issues/21594">#21594</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/17ccae34815e249c66e53abe21916c3c0b6413e5"><code>17ccae3</code></a> Use separate Depot projects for Docker development builds (<a href="https://redirect.github.com/astral-sh/uv/issues/21591">#21591</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/8c18e15bd36dff0e17509cc68c3721798ae1ec2b"><code>8c18e15</code></a> Use the workflow revision for PR security review configuration (<a href="https://redirect.github.com/astral-sh/uv/issues/21592">#21592</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9ebb1f6a72db257a689049ee060b7cf93638aada"><code>9ebb1f6</code></a> Clarify release pipeline job names (<a href="https://redirect.github.com/astral-sh/uv/issues/21561">#21561</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d87450d82b3941507e48ac8b57f72a9d00709289"><code>d87450d</code></a> Omit unused <code>exclude-newer-package</code> entries from script locks (<a href="https://redirect.github.com/astral-sh/uv/issues/21589">#21589</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/911f3a208c104b07b2f4da3a2283564d9a95c403"><code>911f3a2</code></a> Refactor release artifact handling (<a href="https://redirect.github.com/astral-sh/uv/issues/21556">#21556</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a712e811024933ec441667659d6df73c04f5b678"><code>a712e81</code></a> Separate Docker release builds from publishing (<a href="https://redirect.github.com/astral-sh/uv/issues/21586">#21586</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/4196dae60a0cc542bd43c0188f8b4c6dbfa0df98"><code>4196dae</code></a> Use xhigh effort for PR security review (<a href="https://redirect.github.com/astral-sh/uv/issues/21530">#21530</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a51624b4791456260f72068ae878796233f72809"><code>a51624b</code></a> Reduce PR security review reporting work (<a href="https://redirect.github.com/astral-sh/uv/issues/21528">#21528</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/63e28b69821b4b55b90287d799cbf97ff6ba0f74"><code>63e28b6</code></a> Use <code>editpe</code> for trampoline resource edits (<a href="https://redirect.github.com/astral-sh/uv/issues/18713">#18713</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.9...0.12.13">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-11 02:07:12 -04:00
Austin Brogle	99e0cfde3d	fix: prevent Anna's Archive download countdown resets by preserving browser sessions (#1325 ) ## Observed bug Anna's Archive slow-download pages can return a JavaScript countdown before a download link is available. The internal browser returns that waiting-room HTML and closes its incognito session. The downloader then sleeps and fetches the URL again, which can create a new queue session and restart the countdown instead of reaching the download link. ## Fix - Preserve the queue session: keep the original browser tab open while the site's own countdown and automatic navigation finish. HTTP 200 and cached-cookie waiting-room responses enter the same flow. - Return a consistent page: capture HTML and readiness together in one browser evaluation so navigation cannot pair a new page's status with stale protection-page HTML. Share cache validation and page-readiness rules across their callers. - Keep waiting cancellable and bounded: poll cancellation while a slow browser read remains pending, rather than repeatedly cancelling and reissuing it. Apply a 300-second waiting-room limit within the existing browser watchdog. - Report queue timeouts accurately: preserve the timeout across the helper-process boundary and stop the solve without restarting the browser or rotating mirrors. Waiting-room detection is limited to Anna's Archive `/slow_download/` pages containing an actual `.js-partner-countdown` element. The site controls the countdown and refresh. External-bypasser behavior and file-transfer timeouts are unchanged; the PR adds no deployment configuration or dependencies. ## Validation Validated at `c81e0a2`: \| Check \| Result \| \| --- \| --- \| \| Full Linux unit suite \| 2,978 passed on Python 3.14 in a non-root environment with entrypoint test stubs enabled \| \| Focused regression coverage \| 30 passed, covering countdown completion, zero timers, navigation, both cookie-cache paths, cancellation, stuck queues, slow reads, and timeout propagation \| \| Navigation-race regression \| Fails against the previous PR implementation and passes with the fix \| \| Python static checks \| Ruff lint/format, BasedPyright for backend and tests, and Vulture passed \| \| Real Chromium fixture \| Queue cookie persisted through 1.5-second DOM reads and one automatic refresh; the CDP connection survived multiple polling intervals \| \| Live source check \| Observed 19 → 14 → 9 → 4 → download link while retaining the browser session; the patched browser path also completed the waiting room \| Full unit-suite command: ```sh pytest tests/ -n 2 --tb=short -m "not integration and not e2e" ``` The live check validates waiting-room completion and link resolution. Remote file-host availability remains a separate concern. The unit suite emitted two existing Authlib deprecation warnings.	2026-09-11 00:51:48 -04:00
Jorge Lima	c45d342931	fix(prowlarr): skip indexers in Prowlarr failure back-off (#1324 ) ## What Read `/api/v1/indexerstatus` once per search and skip indexers whose `disabledTill` is still ahead. Skipped is neither attempted nor failed. One client method, one counter on `_IndexerSearchOutcome`, ten tests. ## Why Prowlarr's own search leaves out an indexer it has disabled after repeated failures. Shelfmark queries each indexer through its Torznab endpoint, which answers 429 instead: ``` Prowlarr Torznab error response: <error code="429" description="Indexer is disabled till 09/09/2026 15:00:34 due to recent failures." /> Prowlarr: 1 of 5 indexer searches failed (indexer 2 search failed: 429 Client Error: Too Many Requests ...) Release search failed for source prowlarr: 1 of 5 indexer searches failed (...) ``` That counted as a failed search, so with one indexer in back-off and the other four answering empty, `/api/releases?source=prowlarr` returned 503 for every book for the length of the back-off (one hour here). `/api/v1/indexerstatus` on Prowlarr 2.5.2: ```json [{"indexerId": 2, "disabledTill": "2026-09-09T15:00:34Z", "mostRecentFailure": "2026-09-09T14:00:34Z", "initialFailure": "2026-09-09T14:00:34Z"}] ``` ## Behaviour \| indexers \| before \| after \| \|---\|---\|---\| \| 1 in back-off, 4 answer empty \| 503 "1 of 5 indexer searches failed" \| "No releases found" \| \| 1 in back-off, 1 answers with releases \| releases \| releases, one Torznab call fewer \| \| 1 in back-off, 1 times out, 3 answer empty \| "1 of 5 failed" \| "1 of 4 failed" \| \| every indexer in back-off \| 503 "5 of 5 failed" \| "every indexer is disabled by Prowlarr after recent failures (until ...)" \| \| status endpoint unreachable \| n/a \| as before, nothing skipped \| Auto-expand no longer retries a pass in which nothing was asked. ## Tests `uv run pytest tests/prowlarr`: 563 passed, 42 skipped. `ruff check` and `ruff format` clean.	2026-09-11 00:49:33 -04:00
oliver	1e3fd48b8b	fix: share rotating log file handlers (#1316 ) This patch shares (for each log file) the `RotatingFileHandler` for logging across all modules, reducing the number of open file descriptors from ~78 to 1. I had originally assumed this issue was a resource leak, but it seems to just be a large fixed number of file descriptors. So this change mostly just (1) shrinks the number of open file descriptors to a reasonable level and (2) prevents two modules in the same process competing to write to a log file.	2026-09-11 00:48:22 -04:00
Vinicius GabrielandClaude Sonnet 5	c576003319	feat(naming): add {FirstAuthor} template token (#1322 ) Closes #930. ## What New `{FirstAuthor}` naming-template token. It renders only the first author when metadata lists several ("Author1, Author2, Author3"), so multi-author books can be filed alongside the rest of that author's work instead of getting their own "Author1, Author2, ..." folder. ``` {Author} -> Terry Pratchett, Neil Gaiman {FirstAuthor} -> Terry Pratchett ``` ## How - Added to `KNOWN_TOKENS` in `shelfmark/core/naming.py`, positioned before `author` so `{FirstAuthor}` isn't parsed as literal `First` + `{Author}`. - Derived inside `parse_naming_template` from the existing `Author` value (split on `,` / `;`), so every caller — folder transfer, rename, the settings preview — picks it up with no extra wiring. An explicit `FirstAuthor` key in the metadata still wins if one is ever passed. - `{Author}` behaviour is unchanged. - Frontend `namingTemplatePreview.ts` token list + `KNOWN_TOKENS` kept in lockstep (there's a test enforcing that), with a matching `firstAuthor` helper. - Settings field descriptions + `docs/environment-variables.md` list the new token. ## Known limitation A lone author written `Last, First` is split on the comma too and renders as `Last` — the source metadata doesn't mark which form it is. Called out in the token help text and covered by a test. `{Author}` remains available for anyone who wants the raw string. ## Checks - `make python-test` — 2963 passed - `make python-lint` / `make python-format` / `make python-typecheck` / vulture — clean - `make frontend-test` — 187 passed · `frontend-lint` / `frontend-format` / `frontend-typecheck` — clean 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-11 00:47:37 -04:00
Atirna	265da07d7f	feat(download): add Blackhole torrent handoff (#1312 ) ## Why Blackhole users need Shelfmark to hand a torrent file to their existing downloader instead of importing the downloaded book itself. ## Change - add Blackhole as a torrent client with a configurable watched directory - prefer a fetched `.torrent` file for Blackhole while preserving magnet preference for other clients - complete the queue task after the handoff without invoking book post-processing ## Verification - `uv run pytest -q tests/prowlarr/test_blackhole_client.py tests/prowlarr/test_handler.py tests/newznab/test_handler.py tests/download/test_orchestrator_lifecycle.py` - `uv run basedpyright shelfmark/download/clients/blackhole.py shelfmark/download/clients/__init__.py shelfmark/download/clients/base_handler.py shelfmark/download/clients/settings.py shelfmark/download/orchestrator.py shelfmark/release_sources/__init__.py shelfmark/release_sources/prowlarr/utils.py shelfmark/release_sources/prowlarr/handler.py shelfmark/release_sources/newznab/handler.py tests/prowlarr/test_blackhole_client.py tests/prowlarr/test_handler.py tests/newznab/test_handler.py tests/download/test_orchestrator_lifecycle.py` Fixes #1229	2026-09-11 00:46:47 -04:00
Nicholas Velten	96d1b7c33a	Keep default filters out of the URL hash (#1314 ) Follow up to #1311, per your "no use keeping empty / default values in the url". A plain author search was coming out as ``` #q=herbert&search_by=author&sort=relevance&lang=default&format=epub&format=mobi&format=azw3&format=fb2&format=djvu&format=cbz&format=cbr ``` The builder serialized every advanced filter regardless of whether the user had touched it. Now `sort` drops when it equals the sort the app would apply anyway (the provider default in Universal, the configured one in Direct), `lang` drops while it is still the `default` sentinel, and `format` drops when the selection matches `supported_formats` from the config. Formats are compared as a set, so reselecting everything in a different order still counts as default. Anything the user actually changed stays. That also makes the comment I left in the builder true: a default-state URL now carries no hash at all. The second commit is an ordering bug that omitting defaults made visible. `loadConfig`'s `initial` branch seeds `formats` from `supported_formats` and `sort` from the mode default. The URL bootstrap is gated on config being loaded, so it normally runs after that and wins on its own, but nothing guarantees only one `initial` load happens, and a second one landing after the bootstrap resets `formats` to the full supported list and drops the sort the link asked for. StrictMode double-invokes the mount effect that triggers it, so it reproduces in development: `#q=dune&format=epub&lang=en` intermittently loses its `format=epub`. The seeding is now skipped once the bootstrap has applied, so a link's filters win over the defaults they were meant to override. Five new unit tests on the builder. I also drove both the dev server and a production build in Chromium with `/api` mocked: `#search_by=author&q=herbert` settles at `#q=herbert&search_by=author`, typing a plain query gives `#q=dune`, direct mode at rest carries no hash, and `#q=dune&format=epub&lang=en` keeps both filters in the hash and in the request. That last one was 3 for 5 on the dev server before the second commit and 5 for 5 after.	2026-09-11 00:36:55 -04:00
dependabot[bot]	6addae9d7c	build(deps): bump the python-deps group across 1 directory with 4 updates (#1327 ) Bumps the python-deps group with 4 updates in the / directory: [seleniumbase](https://github.com/seleniumbase/SeleniumBase), [basedpyright](https://github.com/detachhead/basedpyright), [prek](https://github.com/j178/prek) and [ruff](https://github.com/astral-sh/ruff). Updates `seleniumbase` from 4.53.5 to 4.53.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.53.7 - MCP Server: Patch 7</h2> <h2>MCP Server: Patch 7</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/698672b1d14d397c8fabef17c14c36efb01047fa">Update the MCP Server</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f5c40a2de161745c0de5130ad7479dc823aaf08e">Refresh Python dependencies</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 7 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4493">seleniumbase/SeleniumBase#4493</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.53.6...v4.53.7">https://github.com/seleniumbase/SeleniumBase/compare/v4.53.6...v4.53.7</a></p> <h2>4.53.6 - MCP Server: Patch 6</h2> <h2>MCP Server: Patch 6</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b477cb359f466e5d6f712c6c30a03150076e1420">Update the MCP server</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 6 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4491">seleniumbase/SeleniumBase#4491</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.53.5...v4.53.6">https://github.com/seleniumbase/SeleniumBase/compare/v4.53.5...v4.53.6</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4ee7dfc4ae83c19385f5ac129f2cda0cfa863d80"><code>4ee7dfc</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4493">#4493</a> from seleniumbase/mcp-server-patch-7</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a9c9253eec504274d3dbe19202ec858201fe4fd8"><code>a9c9253</code></a> Version 4.53.7</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f5c40a2de161745c0de5130ad7479dc823aaf08e"><code>f5c40a2</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/698672b1d14d397c8fabef17c14c36efb01047fa"><code>698672b</code></a> Update the MCP Server</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/db0d4041dde54142a2dd9810b23b30b6aa40fd97"><code>db0d404</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4491">#4491</a> from seleniumbase/mcp-server-patch-6</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7b835cfbad6becff033a9ae059b84775f42a4e2e"><code>7b835cf</code></a> Version 4.53.6</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b477cb359f466e5d6f712c6c30a03150076e1420"><code>b477cb3</code></a> Update the MCP server</li> <li>See full diff in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.53.5...v4.53.7">compare view</a></li> </ul> </details> <br /> Updates `basedpyright` from 1.39.10 to 1.40.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/detachhead/basedpyright/releases">basedpyright's releases</a>.</em></p> <blockquote> <h2>v1.40.0 (pyright 1.1.412)</h2> <h2>What's Changed</h2> <ul> <li>drop support for python 3.8 and 3.9 in the pypi package, which are EOL by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1876">DetachHead/basedpyright#1876</a> <ul> <li>users who still need to use unsupported Python versions can still install <a href="https://npmjs.com/basedpyright">the basedpyright npm package</a></li> </ul> </li> <li>fix rendering of newlines for builtin docstrings by <a href="https://github.com/tommyming"><code>@tommyming</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1871">DetachHead/basedpyright#1871</a></li> <li>migrate the docs site to zensical by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1795">DetachHead/basedpyright#1795</a></li> <li>move locale env variable docs to the more appropriate "Environment Variables" page by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1878">DetachHead/basedpyright#1878</a></li> <li>Support new Python Environments API when enabled by <a href="https://github.com/Weidav"><code>@Weidav</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1860">DetachHead/basedpyright#1860</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/tommyming"><code>@tommyming</code></a> made their first contribution in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1871">DetachHead/basedpyright#1871</a></li> <li><a href="https://github.com/Weidav"><code>@Weidav</code></a> made their first contribution in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1860">DetachHead/basedpyright#1860</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/DetachHead/basedpyright/compare/v1.39.10...v1.40.0">https://github.com/DetachHead/basedpyright/compare/v1.39.10...v1.40.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DetachHead/basedpyright/commit/d64b2274480bc64c146f5b387127d4bb35eb403e"><code>d64b227</code></a> 1.40.0</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/1a9ec37d0cffde93059b5993fb094f7dc9e91242"><code>1a9ec37</code></a> Support new Python Environments API when enabled (<a href="https://redirect.github.com/detachhead/basedpyright/issues/1860">#1860</a>)</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/37ab66d1bcc6c3e00b391f50b1da9a313e785a96"><code>37ab66d</code></a> move locale env variable docs to the more appropriate "Environment Variables"...</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/db9be3ceda3b101695574b24761e1bf42b0c5701"><code>db9be3c</code></a> zensical (<a href="https://redirect.github.com/detachhead/basedpyright/issues/1795">#1795</a>)</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/f408bd7ab1adb419fd1986ccc3a79723e29f4c8e"><code>f408bd7</code></a> fix rendering of newlines for builtin docstrings (<a href="https://redirect.github.com/detachhead/basedpyright/issues/1871">#1871</a>)</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/0310a8d3cf6346978ea511e4fb9b1d857fc837d8"><code>0310a8d</code></a> drop support for python 3.8 and 3.9 in the pypi package, which are EOL.</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/8a06544547fd26b32fe0f3ff334ce125ba8ca5e7"><code>8a06544</code></a> bump gg deps and python deps</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/01ffa7fa80ece700dc0e824de7da761f6554e5fa"><code>01ffa7f</code></a> bump gg to fix download indicator interfering with primer output</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/d5db35dd53d3af48809e5d04e1d0714113363092"><code>d5db35d</code></a> workaround gg download progress indicator interfering with primer output</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/dc53c61a95a5d60a348033ed4fba09e3f73d7cba"><code>dc53c61</code></a> fix primer</li> <li>Additional commits viewable in <a href="https://github.com/detachhead/basedpyright/compare/v1.39.10...v1.40.0">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.5.0 to 0.5.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.5.2</h2> <h2>Release Notes</h2> <p>Released on 2026-09-03.</p> <h3>Enhancements</h3> <ul> <li>Allow unknown tags by default in <code>check-yaml</code> (<a href="https://redirect.github.com/j178/prek/pull/2678">#2678</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178"><code>@j178</code></a></li> </ul> <h2>Install prek 0.5.2</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.2/prek-installer.ps1 \| iex" </code></pre> <h3>Install prebuilt binaries via Homebrew</h3> <pre lang="sh"><code>brew install prek </code></pre> <h2>Download prek 0.5.2</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-aarch64-apple-darwin.tar.gz">prek-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-x86_64-apple-darwin.tar.gz">prek-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-aarch64-pc-windows-msvc.zip">prek-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-x86_64-pc-windows-msvc.zip">prek-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-aarch64-unknown-linux-gnu.tar.gz">prek-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-x86_64-unknown-linux-gnu.tar.gz">prek-x86_64-unknown-linux-gnu.tar.gz</a></td> <td>x64 Linux</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-x86_64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-aarch64-unknown-linux-musl.tar.gz">prek-aarch64-unknown-linux-musl.tar.gz</a></td> <td>ARM64 MUSL Linux</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-aarch64-unknown-linux-musl.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-x86_64-unknown-linux-musl.tar.gz">prek-x86_64-unknown-linux-musl.tar.gz</a></td> <td>x64 MUSL Linux</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.2/prek-x86_64-unknown-linux-musl.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <h2>Verifying GitHub Artifact Attestations</h2> <p>The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the <a href="https://cli.github.com/manual/gh_attestation_verify">GitHub CLI</a>:</p> <pre lang="sh"><code></tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/master/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.5.2</h2> <p>Released on 2026-09-03.</p> <h3>Enhancements</h3> <ul> <li>Allow unknown tags by default in <code>check-yaml</code> (<a href="https://redirect.github.com/j178/prek/pull/2678">#2678</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178"><code>@j178</code></a></li> </ul> <h2>0.5.1</h2> <p>Released on 2026-09-01.</p> <h3>Enhancements</h3> <ul> <li>Add <code>--hide-status <passed\|failed\|skipped></code> for hook reports (<a href="https://redirect.github.com/j178/prek/pull/2644">#2644</a>)</li> <li>Add <code>prek init</code> for repository setup (<a href="https://redirect.github.com/j178/prek/pull/2636">#2636</a>)</li> <li>Apply hook <code>env</code> during environment creation (<a href="https://redirect.github.com/j178/prek/pull/2650">#2650</a>)</li> <li>Disable error snippets in <code>check-yaml</code> diagnostics (<a href="https://redirect.github.com/j178/prek/pull/2664">#2664</a>)</li> <li>Show hooks excluded by skip selectors (<a href="https://redirect.github.com/j178/prek/pull/2645">#2645</a>)</li> <li>Support Pixi for Conda environments (<a href="https://redirect.github.com/j178/prek/pull/2667">#2667</a>)</li> <li>Support <code>cargo-binstall</code> for Rust CLI dependencies (<a href="https://redirect.github.com/j178/prek/pull/2658">#2658</a>)</li> <li>Warn about unused keys in user settings (<a href="https://redirect.github.com/j178/prek/pull/2665">#2665</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Reject unsupported YAML tags in check-yaml (<a href="https://redirect.github.com/j178/prek/pull/2656">#2656</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Clarify local hook documentation (<a href="https://redirect.github.com/j178/prek/pull/2640">#2640</a>)</li> <li>Clarify pre-commit command compatibility (<a href="https://redirect.github.com/j178/prek/pull/2635">#2635</a>)</li> <li>Document automatic PR fixes with autofix.ci (<a href="https://redirect.github.com/j178/prek/pull/2643">#2643</a>)</li> <li>Document check-yaml unsafe support (<a href="https://redirect.github.com/j178/prek/pull/2632">#2632</a>)</li> <li>Improve setup and workflow documentation (<a href="https://redirect.github.com/j178/prek/pull/2637">#2637</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Drop low-usage release targets (<a href="https://redirect.github.com/j178/prek/pull/2651">#2651</a>)</li> <li>Generate a prek manifest JSON schema (<a href="https://redirect.github.com/j178/prek/pull/2648">#2648</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178"><code>@j178</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/bfaa03cc998a43b1092e7ea918d0c9437a3ade64"><code>bfaa03c</code></a> Bump version to 0.5.2 (<a href="https://redirect.github.com/j178/prek/issues/2679">#2679</a>)</li> <li><a href="https://github.com/j178/prek/commit/f0ce4c249ef17f9be0162e3c42ed765d073619ff"><code>f0ce4c2</code></a> Allow unknown tags by default in <code>check-yaml</code> (<a href="https://redirect.github.com/j178/prek/issues/2678">#2678</a>)</li> <li><a href="https://github.com/j178/prek/commit/78bb3fe7d901289b3f45c5a5280147860d87cf30"><code>78bb3fe</code></a> Show verbose builtin details by default (<a href="https://redirect.github.com/j178/prek/issues/2676">#2676</a>)</li> <li><a href="https://github.com/j178/prek/commit/57ea73d2ac28ae8d13fdf25c98c9b4b092a64945"><code>57ea73d</code></a> Add <code>--allow-unknown-tags</code> to <code>check-yaml</code> to disable tag checks (<a href="https://redirect.github.com/j178/prek/issues/2675">#2675</a>)</li> <li><a href="https://github.com/j178/prek/commit/695f3d0d7f113ccbbcad6555103107d6866e6b28"><code>695f3d0</code></a> Show hook selectors first in prek run help (<a href="https://redirect.github.com/j178/prek/issues/2673">#2673</a>)</li> <li><a href="https://github.com/j178/prek/commit/edf43d5014da3566f5ea2f4bdee4f578f9381386"><code>edf43d5</code></a> Reapply "Reject unsupported YAML tags in check-yaml (<a href="https://redirect.github.com/j178/prek/issues/2656">#2656</a>)" (<a href="https://redirect.github.com/j178/prek/issues/2672">#2672</a>)</li> <li><a href="https://github.com/j178/prek/commit/ed225b182dba642745ee1f79e185b6afa1928420"><code>ed225b1</code></a> Bump version to 0.5.2 (<a href="https://redirect.github.com/j178/prek/issues/2671">#2671</a>)</li> <li><a href="https://github.com/j178/prek/commit/de6e61481c610de0836b2628407bfaa353aa3fcd"><code>de6e614</code></a> Revert unsupported YAML tag rejection in check-yaml (<a href="https://redirect.github.com/j178/prek/issues/2670">#2670</a>)</li> <li><a href="https://github.com/j178/prek/commit/10a896eb63d60dd1175cc7b10ff0798e7070e56f"><code>10a896e</code></a> Bump version to 0.5.1 (<a href="https://redirect.github.com/j178/prek/issues/2669">#2669</a>)</li> <li><a href="https://github.com/j178/prek/commit/864870940e0d246aa2ce9c3a9a693092e3f8002f"><code>8648709</code></a> Support Pixi for Conda environments (<a href="https://redirect.github.com/j178/prek/issues/2667">#2667</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.5.0...v0.5.2">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.5 to 0.16.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.6</h2> <h2>Release Notes</h2> <p>Released on 2026-09-03.</p> <h3>Preview features</h3> <ul> <li>Move <code>pytest-fixture-autouse</code> to the <code>restriction</code> category (<a href="https://redirect.github.com/astral-sh/ruff/pull/28219">#28219</a>)</li> <li>[<code>flake8-pytest-style</code>] Add an autofix for <code>PT020</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27993">#27993</a>)</li> <li>[<code>flake8-tidy-imports</code>] Prevent fix loop between <code>TID254</code> and <code>TID255</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28262">#28262</a>)</li> <li>[<code>isort</code>] Exclude pragma comments from line length calculation (<code>I001</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27313">#27313</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Validate unary expressions when parsing (<a href="https://redirect.github.com/astral-sh/ruff/pull/28233">#28233</a>)</li> <li>[<code>flake8-async</code>, <code>pylint</code>] Recognize <code>builtins.open</code> (<code>ASYNC230</code>, <code>PLW1514</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28021">#28021</a>)</li> <li>[<code>flake8-bugbear</code>] Fix panic on <code>match</code> subjects (<code>B031</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27781">#27781</a>)</li> <li>[<code>flake8-datetimez</code>] Reject <code>tzinfo=None</code> for <code>datetime</code> bounds (<code>DTZ901</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28022">#28022</a>)</li> <li>[<code>flake8-pytest-style</code>] Avoid duplicate <code>PT017</code> diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/pull/27918">#27918</a>)</li> <li>[<code>ruff</code>] Remove <code>lint.external</code> hint for Ruff-specific suppressions (<code>RUF102</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27923">#27923</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>flake8-use-pathlib</code>] Add display-only fix for <code>os.listdir</code> (<code>PTH208</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28027">#28027</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add another example and glob reference for <code>lint.per-file-ignores</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28106">#28106</a>)</li> <li>Add duplicate work guidance (<a href="https://redirect.github.com/astral-sh/ruff/pull/28229">#28229</a>)</li> <li>[<code>flake8-async</code>] Document thread offloading (<code>ASYNC240</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28008">#28008</a>)</li> <li>[<code>pyupgrade</code>] Clarify default <code>encoding</code> argument handling (<code>UP012</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27315">#27315</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Allow unary plus in match patterns on Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28231">#28231</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/flying-sheep"><code>@flying-sheep</code></a></li> <li><a href="https://github.com/pikammmmm"><code>@pikammmmm</code></a></li> <li><a href="https://github.com/fly1d"><code>@fly1d</code></a></li> <li><a href="https://github.com/waterWang"><code>@waterWang</code></a></li> <li><a href="https://github.com/Pierre-Sassoulas"><code>@Pierre-Sassoulas</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/ericbuehl"><code>@ericbuehl</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/AbhinavMir"><code>@AbhinavMir</code></a></li> <li><a href="https://github.com/Whning0513"><code>@Whning0513</code></a></li> <li><a href="https://github.com/chirizxc"><code>@chirizxc</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.6</h2> <p>Released on 2026-09-03.</p> <h3>Preview features</h3> <ul> <li>Move <code>pytest-fixture-autouse</code> to the <code>restriction</code> category (<a href="https://redirect.github.com/astral-sh/ruff/pull/28219">#28219</a>)</li> <li>[<code>flake8-pytest-style</code>] Add an autofix for <code>PT020</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27993">#27993</a>)</li> <li>[<code>flake8-tidy-imports</code>] Prevent fix loop between <code>TID254</code> and <code>TID255</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28262">#28262</a>)</li> <li>[<code>isort</code>] Exclude pragma comments from line length calculation (<code>I001</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27313">#27313</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Validate unary expressions when parsing (<a href="https://redirect.github.com/astral-sh/ruff/pull/28233">#28233</a>)</li> <li>[<code>flake8-async</code>, <code>pylint</code>] Recognize <code>builtins.open</code> (<code>ASYNC230</code>, <code>PLW1514</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28021">#28021</a>)</li> <li>[<code>flake8-bugbear</code>] Fix panic on <code>match</code> subjects (<code>B031</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27781">#27781</a>)</li> <li>[<code>flake8-datetimez</code>] Reject <code>tzinfo=None</code> for <code>datetime</code> bounds (<code>DTZ901</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28022">#28022</a>)</li> <li>[<code>flake8-pytest-style</code>] Avoid duplicate <code>PT017</code> diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/pull/27918">#27918</a>)</li> <li>[<code>ruff</code>] Remove <code>lint.external</code> hint for Ruff-specific suppressions (<code>RUF102</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27923">#27923</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>flake8-use-pathlib</code>] Add display-only fix for <code>os.listdir</code> (<code>PTH208</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28027">#28027</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add another example and glob reference for <code>lint.per-file-ignores</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28106">#28106</a>)</li> <li>Add duplicate work guidance (<a href="https://redirect.github.com/astral-sh/ruff/pull/28229">#28229</a>)</li> <li>[<code>flake8-async</code>] Document thread offloading (<code>ASYNC240</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28008">#28008</a>)</li> <li>[<code>pyupgrade</code>] Clarify default <code>encoding</code> argument handling (<code>UP012</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27315">#27315</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Allow unary plus in match patterns on Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28231">#28231</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/flying-sheep"><code>@flying-sheep</code></a></li> <li><a href="https://github.com/pikammmmm"><code>@pikammmmm</code></a></li> <li><a href="https://github.com/fly1d"><code>@fly1d</code></a></li> <li><a href="https://github.com/waterWang"><code>@waterWang</code></a></li> <li><a href="https://github.com/Pierre-Sassoulas"><code>@Pierre-Sassoulas</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/ericbuehl"><code>@ericbuehl</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/AbhinavMir"><code>@AbhinavMir</code></a></li> <li><a href="https://github.com/Whning0513"><code>@Whning0513</code></a></li> <li><a href="https://github.com/chirizxc"><code>@chirizxc</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/22f65a2ab5052990503985c7c794de37598d531e"><code>22f65a2</code></a> Bump 0.16.6 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28280">#28280</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/7cc9f1ed53e5ce175f17fde3a75fe792ac41e8cd"><code>7cc9f1e</code></a> [ty] Document <code>CallableTypeKind</code> variants (<a href="https://redirect.github.com/astral-sh/ruff/issues/28277">#28277</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/056ce07a895c217dab7929a616540c246cf8a078"><code>056ce07</code></a> Add UV_LOCKED to all workflows (<a href="https://redirect.github.com/astral-sh/ruff/issues/28261">#28261</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/6d6e35d03a72d23d3b0f23fb348692b03c9b81b6"><code>6d6e35d</code></a> [<code>flake8-pytest-style</code>] Avoid duplicate <code>PT017</code> diagnostics (<a href="https://redirect.github.com/astral-sh/ruff/issues/27918">#27918</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/80b4891b64cb916dce080e8fa15af5c2179d776a"><code>80b4891</code></a> [ty] Temporarily disable tuple types in property tests (<a href="https://redirect.github.com/astral-sh/ruff/issues/28275">#28275</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/3f7a54d1d7b9480a18d86a8211bf676354a2f8a0"><code>3f7a54d</code></a> [<code>flake8-tidy-imports</code>] Prevent fix loop between <code>TID254</code> and <code>TID255</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28262">#28262</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/35656cf37d34f30116d4f4a9cb13853a6ad9fd0d"><code>35656cf</code></a> [ty] Preserve deprecations on decorated callables (<a href="https://redirect.github.com/astral-sh/ruff/issues/28256">#28256</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d2626c866ee08495cfa0da5236e130030d37e0cf"><code>d2626c8</code></a> [ty] Reject missing attributes on <code>type[]</code> aliases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28267">#28267</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ee6a6d19aa0707df942febe9768488d39f383c8c"><code>ee6a6d1</code></a> [ty] Support ParamSpecs in <code>ConstraintSet</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28028">#28028</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/7f6a170080dab08f754ef086369a2623c70f753d"><code>7f6a170</code></a> [ty] Move bound APIs to constraint owners (<a href="https://redirect.github.com/astral-sh/ruff/issues/28094">#28094</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.5...0.16.6">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-11 00:20:11 -04:00
Nicholas Velten	46d21cafbc	Deep-link Search By mode via URL hash (#1311 ) Closes #1228. Search By mode (General/Author/Title/Series/Manual), content type and the search query now live in the URL as a hash fragment, updated live as you search, not just parsed once on load. A shared/bookmarked link like `#search_by=manual&q=foundation` reopens in that exact mode with the query filled in. Following the direction from the issue thread: - Hash fragment instead of query string, so it stays browser side only. - Live updates via `history.replaceState`, no history spam per keystroke. - Default Search By persisted in a client side cookie as fallback when there's no hash, no user accounts needed. Tested manually against a local build (search-by switching, hash live update, deep link reload, cookie fallback when there's no hash, and hash overriding a stale cookie).	2026-09-05 01:13:59 -04:00
dependabot[bot]	22aa59e567	build(deps): bump the docker-base-image-digests group with 2 updates (#1306 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `d32cdf6` to `e67514e` Updates `astral-sh/uv` from 0.12.5 to 0.12.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.9</h2> <h2>Release Notes</h2> <p>Released on 2026-09-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.15.0rc2 (<a href="https://redirect.github.com/astral-sh/uv/pull/21413">#21413</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21415">#21415</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Add <code>--no-locked</code> and <code>--no-frozen</code> to disable lock modes enabled by <code>UV_LOCKED</code> and <code>UV_FROZEN</code> for a single invocation (<a href="https://redirect.github.com/astral-sh/uv/pull/21408">#21408</a>)</li> <li>Report the exact command-line lock-mode flag in warnings and errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21402">#21402</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (<a href="https://redirect.github.com/astral-sh/uv/pull/21372">#21372</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Update <code>async_http_range_reader</code> to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (<a href="https://redirect.github.com/astral-sh/uv/pull/21401">#21401</a>)</li> <li>Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (<a href="https://redirect.github.com/astral-sh/uv/pull/21382">#21382</a>)</li> <li>Redact secrets in signed URLs from retry diagnostics, including nested request errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21381">#21381</a>)</li> <li>Give <code>--locked</code>, <code>--frozen</code>, <code>--check</code>, and <code>--check-exists</code> precedence over conflicting <code>UV_LOCKED</code> and <code>UV_FROZEN</code> values (<a href="https://redirect.github.com/astral-sh/uv/pull/21396">#21396</a>)</li> <li>Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (<a href="https://redirect.github.com/astral-sh/uv/pull/21400">#21400</a>)</li> </ul> <h2>Install uv 0.12.9</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 \| iex" </code></pre> <h2>Download uv 0.12.9</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.9</h2> <p>Released on 2026-09-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.15.0rc2 (<a href="https://redirect.github.com/astral-sh/uv/pull/21413">#21413</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21415">#21415</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Add <code>--no-locked</code> and <code>--no-frozen</code> to disable lock modes enabled by <code>UV_LOCKED</code> and <code>UV_FROZEN</code> for a single invocation (<a href="https://redirect.github.com/astral-sh/uv/pull/21408">#21408</a>)</li> <li>Report the exact command-line lock-mode flag in warnings and errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21402">#21402</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (<a href="https://redirect.github.com/astral-sh/uv/pull/21372">#21372</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Update <code>async_http_range_reader</code> to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (<a href="https://redirect.github.com/astral-sh/uv/pull/21401">#21401</a>)</li> <li>Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (<a href="https://redirect.github.com/astral-sh/uv/pull/21382">#21382</a>)</li> <li>Redact secrets in signed URLs from retry diagnostics, including nested request errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21381">#21381</a>)</li> <li>Give <code>--locked</code>, <code>--frozen</code>, <code>--check</code>, and <code>--check-exists</code> precedence over conflicting <code>UV_LOCKED</code> and <code>UV_FROZEN</code> values (<a href="https://redirect.github.com/astral-sh/uv/pull/21396">#21396</a>)</li> <li>Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (<a href="https://redirect.github.com/astral-sh/uv/pull/21400">#21400</a>)</li> </ul> <h2>0.12.8</h2> <p>Released on 2026-08-31.</p> <h3>Enhancements</h3> <ul> <li>Warn about invalid tool directories and continue upgrading valid tools with <code>uv tool upgrade --all</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21368">#21368</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Deduplicate identical files within and across cached wheels with the <code>content-addressed-cache</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21327">#21327</a>)</li> <li>Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (<a href="https://redirect.github.com/astral-sh/uv/pull/21340">#21340</a>)</li> <li>Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (<a href="https://redirect.github.com/astral-sh/uv/pull/21344">#21344</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (<a href="https://redirect.github.com/astral-sh/uv/pull/21379">#21379</a>)</li> <li>Speed up dependency graph construction from large lockfiles by indexing packages during traversal (<a href="https://redirect.github.com/astral-sh/uv/pull/21373">#21373</a>)</li> <li>Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (<a href="https://redirect.github.com/astral-sh/uv/pull/21377">#21377</a>)</li> <li>Speed up warm resolutions by reducing repeated marker interner work (<a href="https://redirect.github.com/astral-sh/uv/pull/21300">#21300</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Do not trust hashes from direct URLs discovered only in wheel metadata when installing with <code>--require-hashes</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21348">#21348</a>)</li> <li>Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (<a href="https://redirect.github.com/astral-sh/uv/pull/21366">#21366</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/9f928602938ac5cf1cd6b294a725833c16f5720e"><code>9f92860</code></a> Bump version to 0.12.9 (<a href="https://redirect.github.com/astral-sh/uv/issues/21422">#21422</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/29c546228ed6ba8970bb063960c9a767fae19236"><code>29c5462</code></a> Skip invalid scripts in <code>uv workspace list --scripts</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/21416">#21416</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/bf1d7e8049017a363565185a7df7e86f33041452"><code>bf1d7e8</code></a> Encapsulate wheel extraction directory ownership (<a href="https://redirect.github.com/astral-sh/uv/issues/21419">#21419</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6dacee042f58cea9184267ffb70c6960582bb210"><code>6dacee0</code></a> Run streaming ZIP extraction in a blocking task (<a href="https://redirect.github.com/astral-sh/uv/issues/21372">#21372</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/91d1ebf1b4ea1fc00928b412a9da23639aacb086"><code>91d1ebf</code></a> Sync latest Python releases (<a href="https://redirect.github.com/astral-sh/uv/issues/21415">#21415</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6a61ddb2c094ab44e55a2cc5bb4a88b7c08d733a"><code>6a61ddb</code></a> Revert "Limit CI planner checkout depth" (<a href="https://redirect.github.com/astral-sh/uv/issues/21414">#21414</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e9d1816b538468e7deb8f267f28775007706b866"><code>e9d1816</code></a> Add CPython 3.15.0rc2 (<a href="https://redirect.github.com/astral-sh/uv/issues/21413">#21413</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e888329afc22fa3e34f93d5ae5e23fbc87328952"><code>e888329</code></a> Remove unreachable lock configuration sources (<a href="https://redirect.github.com/astral-sh/uv/issues/21409">#21409</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/bf041f9245952ba7c9e3c29aebe0a8acc2bc983d"><code>bf041f9</code></a> Allow negating locked and frozen modes (<a href="https://redirect.github.com/astral-sh/uv/issues/21408">#21408</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/feffc0b5bbf8aeca1dff4a6f042a58e44a5daf09"><code>feffc0b</code></a> Bump async_http_range_reader to 0.11.1 (<a href="https://redirect.github.com/astral-sh/uv/issues/21401">#21401</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.5...0.12.9">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-04 11:03:26 -04:00
dependabot[bot]	b317dd1110	build(deps): bump python from `cae66f2` to `cad9a2c` (#1307 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps python from `cae66f2` to `cad9a2c`. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.7-slim&new-version=3.14.7-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-04 11:03:15 -04:00
dependabot[bot]	223d8a2256	build(deps): bump the npm-deps group in /src/frontend with 4 updates (#1308 ) Bumps the npm-deps group in /src/frontend with 4 updates: [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom), [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip). Updates `react-router-dom` from 7.18.2 to 7.18.3 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/remix-run/react-router/blob/react-router-dom@7.18.3/packages/react-router-dom/CHANGELOG.md">react-router-dom's changelog</a>.</em></p> <blockquote> <h2>v7.18.3</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies: <ul> <li><a href="https://github.com/remix-run/react-router/releases/tag/react-router@7.18.3"><code>react-router@7.18.3</code></a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/remix-run/react-router/commit/23166dfe7f61323f0d2775af67d2691f9ed0843d"><code>23166df</code></a> Release v7.18.3 (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/15424">#15424</a>)</li> <li>See full diff in <a href="https://github.com/remix-run/react-router/commits/react-router-dom@7.18.3/packages/react-router-dom">compare view</a></li> </ul> </details> <br /> Updates `@types/node` from 26.3.0 to 26.4.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/releases">@vitejs/plugin-react's releases</a>.</em></p> <blockquote> <h2>plugin-react@6.1.1</h2> <h3>Add <code>compiler.logDiagnostics</code> option</h3> <p>Recoverable React Compiler diagnostics are no longer logged by default. Set <code>compiler.logDiagnostics</code> to <code>true</code> to log them through Vite. Fatal diagnostics are always logged and fail the transform.</p> <h3>Respect environment sourcemap option for React Compiler transform when <code>builder.sharedPlugins</code> is enabled (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1439">#1439</a>)</h3> <p>The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental <code>builder.sharedPlugins</code> was enabled.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md">@vitejs/plugin-react's changelog</a>.</em></p> <blockquote> <h2>6.1.1 (2026-08-28)</h2> <h3>Add <code>compiler.logDiagnostics</code> option</h3> <p>Recoverable React Compiler diagnostics are no longer logged by default. Set <code>compiler.logDiagnostics</code> to <code>true</code> to log them through Vite. Fatal diagnostics are always logged and fail the transform.</p> <h3>Respect environment sourcemap option for React Compiler transform when <code>builder.sharedPlugins</code> is enabled (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1439">#1439</a>)</h3> <p>The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental <code>builder.sharedPlugins</code> was enabled.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/04cac5020e349f452d76c5a4f6d788ad4b38930a"><code>04cac50</code></a> release: plugin-react@6.1.1 (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1440">#1440</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/82d35abe4946eddd4e6456802bf2b53444e264f2"><code>82d35ab</code></a> fix(react): respect environment sourcemap option when <code>builder.sharedPlugins</code>...</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/397e8471a559f18a16dd21bd797ac01a369dabdc"><code>397e847</code></a> fix(react): make logging diagnostics an opt-in for React Compiler (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1431">#1431</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/61006e6f52124821c24121a78712f7162ae36f5b"><code>61006e6</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1433">#1433</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/e2a649cbaa7334d6991f843563683975667e1be1"><code>e2a649c</code></a> chore: use <code>deps.neverBundle</code> instead of <code>external</code> in tsdown config (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1430">#1430</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/fb2d6f3635acbb0f3acbd0e9a914f6c620460957"><code>fb2d6f3</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1427">#1427</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react">compare view</a></li> </ul> </details> <br /> Updates `knip` from 6.32.2 to 6.34.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpro-nl/knip/releases">knip's releases</a>.</em></p> <blockquote> <h2>Release 6.34.0</h2> <ul> <li>fix: report types used only in private parameters (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1950">#1950</a>) (3c785f55ce608d7921e37e41dd5fc61b623e5da2)</li> <li>💡 Add support for <code>node:fs/promises</code> <code>glob</code> (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1977">#1977</a>) (44faf08e7f56ce695d1541a6c337b76bea0328d1) - thanks <a href="https://github.com/DreamLongYT"><code>@DreamLongYT</code></a>!</li> <li>Respect JSDoc tags on URL dependencies (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1943">#1943</a>) (f93ad0997e1b8fc644f6487df52803cba6f7a9ad)</li> <li>Make prop access consistent while at it (1c90b49b1b196795df6dcf9d7e85bc1b1399667a)</li> <li>Set an explicit Bun test timeout (964085dfab0165db2658e51cb787e2301886f9ce)</li> <li>Add note re. one scoped PRs (8f9490a581874e0fd7246e60223b20938bf4ebb1)</li> <li>fix(cli): validate numeric options instead of passing NaN through (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1975">#1975</a>) (ab90e2428a16ff50fe5323ce73172f6f1efb9730) - thanks <a href="https://github.com/devYRPauli"><code>@devYRPauli</code></a>!</li> <li>fix: compile files with workspace-scoped compilers (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1997">#1997</a>) (462ae45df33a5ee2e2185f3b2db756b13dfbadd3) - thanks <a href="https://github.com/gioboa"><code>@gioboa</code></a>!</li> <li>Resolve Nuxt <code>#shared</code> imports from the shared directory (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1991">#1991</a>) (cc470611042b01761491c21f6987549db4c11df8) - thanks <a href="https://github.com/DreamLongYT"><code>@DreamLongYT</code></a>!</li> <li>Update dependencies (c4e0f082fbd7fb508a411c7dd0a782ea4556527c)</li> <li>Declare webpack directly instead of through <code>@types/webpack</code> (96ff2df58dd1d229d077212e1cd80f10889650ca)</li> <li>Assert counters in targeted regression tests (f0cf11dfcfbdeac053bba0dd12212356a67f6464)</li> </ul> <h2>Release 6.33.0</h2> <ul> <li>Support package manifest resolution under Yarn PnP (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1946">#1946</a>) (a82efb62b290e004bdabee40bcb337baf3701a1b) - thanks <a href="https://github.com/WooWan"><code>@WooWan</code></a>!</li> <li>Resolve oxlint jsPlugins from .oxlintrc.jsonc (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1973">#1973</a>) (d055023182789555a574eaefde80dac997190437) - thanks <a href="https://github.com/DreierF"><code>@DreierF</code></a>!</li> <li>Update dependency bun to v1.4.0 (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1964">#1964</a>) (937ab38ad514a00edafecff4ca04603b015bf921) - thanks <a href="https://github.com/renovate"><code>@renovate</code></a>[bot]!</li> <li>Expose <code>defineConfig</code> on a <code>./config</code> entrypoint (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1960">#1960</a>) (17f7a6051d9781860f248cc2a745dbe837713cd9) - thanks <a href="https://github.com/theRizwan"><code>@theRizwan</code></a>!</li> <li>Preserve all environment variables in exec.ts (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1979">#1979</a>) (c0a9ecf8d1c0cdd7789c1e1bea893706c060239d) - thanks <a href="https://github.com/DreamLongYT"><code>@DreamLongYT</code></a>!</li> <li>Add support for TypeScript content mappers (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1978">#1978</a>) (db67f9bd8cebf0ea3c298690d462c154827aa462) - thanks <a href="https://github.com/remcohaszing"><code>@remcohaszing</code></a>!</li> <li>fix(vitest): resolve array entries and root-relative setup dependencies (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1982">#1982</a>) (0ecf48538c339437e6f9dfe9a6013d307783cbd3) - thanks <a href="https://github.com/DreamLongYT"><code>@DreamLongYT</code></a>!</li> <li>Fix type annotation in dynamic configuration function example (ada88c7f01563b73643af34a147a71fd9ab9d2dc)</li> <li>Format docs with remark (7764c2a4ebecdbf226c19494d255d9cb14550822)</li> <li>Throw on configuration that is not an object (d7ac0cf1de8f79be6ec53412cac9f7edf8f35ba7)</li> <li>Clarify dependency inputs, isTypeOnly and toConfig in plugin docs (2bd367961554ad1addb520bdfad5e31125885969)</li> <li>Resolve content mapper process from package.json#typescript.contentMapper.exec (74640c03e450624409692f4cc17699775108fd7e)</li> <li>Encode argv arrays before parsing them as shell commands (b79234c15153fbf592e82c94e4e4e9f41b4479e0)</li> <li>Update dependencies (28510146c2b97d88f7188f1239b9307aac7dbf0c)</li> <li>Replace non-breaking space in module graph comment (4e22bfcd09deccc92ed158f5554fe3e03f3a2c51)</li> <li>Update fix format test for oxfmt package.json key sorting (65011bf6054d03fb5580f3381867b07d1b8a9a0c)</li> <li>fix(webpack): resolve entry descriptors using import field (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1981">#1981</a>) (cad8910e7fb89c2510fc9f5885289335dd4e60da) - thanks <a href="https://github.com/DreamLongYT"><code>@DreamLongYT</code></a>!</li> <li>fix: count enum element access as a whole-object read (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1958">#1958</a>) (5a47d603aa23b388ae7ce4fe301656f1abc43b14) - thanks <a href="https://github.com/addielaruee"><code>@addielaruee</code></a>!</li> <li>Resolve oxlint/vite-plus import resolvers from <code>settings</code> (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1983">#1983</a>) (c1165b70efe27398b86fa50bcea7d85c253d3ee7) - thanks <a href="https://github.com/DreierF"><code>@DreierF</code></a>!</li> <li>fix(nuxt): resolve string extends configs (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1984">#1984</a>) (4a5d7068d6264ea45c78c832abe7ba052763517e) - thanks <a href="https://github.com/DreamLongYT"><code>@DreamLongYT</code></a>!</li> <li>Wrap up webpack entry resolution (505decdb821f9b76d194742cee7e98c75ef7d8e9)</li> <li>Keep element access precise for number-like enum member names (bcbac3a8b8283da3b32256584b3cc6569ae5c02f)</li> <li>Resolve <code>Object.*</code> enum enumeration through import aliases (347967daaed817ca20e1ad6148388a66ec8b421b)</li> <li>Resolve named string-key access on namespace-qualified enums (2ac1fbc1e92f3dae662ca4d4701cf010346be49a)</li> <li>Normalize line endings in nuxt-config-string fixture (9fe2b2b2db8690685ec7c6cf8b3d39b9ed7b3fdc)</li> <li>Resolve nuxt layer sources from all <code>extends</code> entry shapes (db136151d9f98801837b33646ef7b02ae7b5a86d)</li> <li>Report unused exports behind Vitest module promise mocks (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1966">#1966</a>) (74954c219367ca1577184cca08c30dbb3fb6222e)</li> <li>Check line endings against <code>.gitattributes</code> in <code>pnpm run ci</code> (ddc9fd0cc3328260665203c8573702bb6c9d0dd6)</li> </ul> <h2>Release 6.32.3</h2> <ul> <li>Update sentry production snapshot (9f18cba93c91de8554636b13692d6e7a937b7697)</li> <li>Pin TypeScript ecosystem test (de5162952d223050f3135afb02d4e8de6d46f381)</li> <li>Update query snapshot (f6964dd577d8f7967f9be6778f5c3953632e3c96)</li> <li>fix(tsup): match config files with .cts and .mts extensions (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1938">#1938</a>) (68d6f52f7913cfa1e36618e6b03f90734da34149) - thanks <a href="https://github.com/codeAnqiang-ma"><code>@codeAnqiang-ma</code></a>!</li> <li>fix(lefthook): match all config file names and extensions (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1940">#1940</a>) (4015ae0330c78e97360a2c8f697d17f82c5c24ae) - thanks <a href="https://github.com/codeAnqiang-ma"><code>@codeAnqiang-ma</code></a>!</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpro-nl/knip/commit/4ffebb746c630147c5d94c14da0bafb60af3c027"><code>4ffebb7</code></a> Release knip@6.34.0</li> <li><a href="https://github.com/webpro-nl/knip/commit/f0cf11dfcfbdeac053bba0dd12212356a67f6464"><code>f0cf11d</code></a> Assert counters in targeted regression tests</li> <li><a href="https://github.com/webpro-nl/knip/commit/96ff2df58dd1d229d077212e1cd80f10889650ca"><code>96ff2df</code></a> Declare webpack directly instead of through <code>@types/webpack</code></li> <li><a href="https://github.com/webpro-nl/knip/commit/c4e0f082fbd7fb508a411c7dd0a782ea4556527c"><code>c4e0f08</code></a> Update dependencies</li> <li><a href="https://github.com/webpro-nl/knip/commit/cc470611042b01761491c21f6987549db4c11df8"><code>cc47061</code></a> Resolve Nuxt <code>#shared</code> imports from the shared directory (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1991">#1991</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/462ae45df33a5ee2e2185f3b2db756b13dfbadd3"><code>462ae45</code></a> fix: compile files with workspace-scoped compilers (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1997">#1997</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/ab90e2428a16ff50fe5323ce73172f6f1efb9730"><code>ab90e24</code></a> fix(cli): validate numeric options instead of passing NaN through (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1975">#1975</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/964085dfab0165db2658e51cb787e2301886f9ce"><code>964085d</code></a> Set an explicit Bun test timeout</li> <li><a href="https://github.com/webpro-nl/knip/commit/1c90b49b1b196795df6dcf9d7e85bc1b1399667a"><code>1c90b49</code></a> Make prop access consistent while at it</li> <li><a href="https://github.com/webpro-nl/knip/commit/f93ad0997e1b8fc644f6487df52803cba6f7a9ad"><code>f93ad09</code></a> Respect JSDoc tags on URL dependencies (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1943">#1943</a>)</li> <li>Additional commits viewable in <a href="https://github.com/webpro-nl/knip/commits/knip@6.34.0/packages/knip">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-04 11:02:22 -04:00
dependabot[bot]	7b5853f35d	build(deps): bump the gh-actions group with 3 updates (#1310 ) Bumps the gh-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.8 to 4.37.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.9</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938"><code>cdf488f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4107">#4107</a> from github/update-v4.37.9-920ba7cd1</li> <li><a href="https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306"><code>7243f38</code></a> Update changelog for v4.37.9</li> <li><a href="https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e"><code>920ba7c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4106">#4106</a> from github/update-bundle/codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2"><code>ecfa6e1</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1"><code>adcdf4a</code></a> Update default bundle to codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e"><code>486fec2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4099">#4099</a> from github/update-supported-enterprise-server-versions</li> <li><a href="https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76"><code>134624c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4101">#4101</a> from github/dependabot/npm_and_yarn/npm-minor-457d82...</li> <li><a href="https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c"><code>ff43db8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4103">#4103</a> from github/mergeback/v4.37.8-to-main-db488dde</li> <li><a href="https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816"><code>4605e03</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d"><code>099c869</code></a> Update changelog and version after v4.37.8</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.37.8 to 4.37.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.37.9</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938"><code>cdf488f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4107">#4107</a> from github/update-v4.37.9-920ba7cd1</li> <li><a href="https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306"><code>7243f38</code></a> Update changelog for v4.37.9</li> <li><a href="https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e"><code>920ba7c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4106">#4106</a> from github/update-bundle/codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2"><code>ecfa6e1</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1"><code>adcdf4a</code></a> Update default bundle to codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e"><code>486fec2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4099">#4099</a> from github/update-supported-enterprise-server-versions</li> <li><a href="https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76"><code>134624c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4101">#4101</a> from github/dependabot/npm_and_yarn/npm-minor-457d82...</li> <li><a href="https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c"><code>ff43db8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4103">#4103</a> from github/mergeback/v4.37.8-to-main-db488dde</li> <li><a href="https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816"><code>4605e03</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d"><code>099c869</code></a> Update changelog and version after v4.37.8</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.8 to 4.37.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.9</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <ul> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and download the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/cdf488f595d80d6e07e03d4674febd5ab45fa938"><code>cdf488f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4107">#4107</a> from github/update-v4.37.9-920ba7cd1</li> <li><a href="https://github.com/github/codeql-action/commit/7243f38558d187dde99730d224bb47aa26a95306"><code>7243f38</code></a> Update changelog for v4.37.9</li> <li><a href="https://github.com/github/codeql-action/commit/920ba7cd1596037e042122c00381eb16b397d68e"><code>920ba7c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4106">#4106</a> from github/update-bundle/codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/ecfa6e16817b8f490bc9a59baa391baf4fa3e3c2"><code>ecfa6e1</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/adcdf4a70d247343cf9c29e0f7a6658b51c3a2b1"><code>adcdf4a</code></a> Update default bundle to codeql-bundle-v2.26.4</li> <li><a href="https://github.com/github/codeql-action/commit/486fec2a3ea2626afcd8c7e9208b4f515078dd7e"><code>486fec2</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4099">#4099</a> from github/update-supported-enterprise-server-versions</li> <li><a href="https://github.com/github/codeql-action/commit/134624c67b20869c2aaa36dafa726375b78a5d76"><code>134624c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4101">#4101</a> from github/dependabot/npm_and_yarn/npm-minor-457d82...</li> <li><a href="https://github.com/github/codeql-action/commit/ff43db8f982a368288f117354fb8d046e937124c"><code>ff43db8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4103">#4103</a> from github/mergeback/v4.37.8-to-main-db488dde</li> <li><a href="https://github.com/github/codeql-action/commit/4605e03a74cf891614c4d76f82384a16c1c11816"><code>4605e03</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/099c869cad6bf3b88657154d4ae47ffed27e632d"><code>099c869</code></a> Update changelog and version after v4.37.8</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28...cdf488f595d80d6e07e03d4674febd5ab45fa938">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-04 11:02:15 -04:00

1 2 3 4 5 ...