shelfmark

mirror of https://github.com/calibrain/shelfmark.git synced 2026-10-04 19:01:07 +01:00

Author	SHA1	Message	Date
dependabot[bot]	33010efa16	build(deps): bump astral-sh/uv from 0.12.19 to 0.12.22 in the docker-base-image-digests group (#1413 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.12.19 to 0.12.22 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.22</h2> <h2>Release Notes</h2> <p>Released on 2026-10-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/22147">#22147</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Accept uppercase release suffixes in wheel platform tags (<a href="https://redirect.github.com/astral-sh/uv/pull/22113">#22113</a>)</li> <li>Record workspace-member default groups in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22010">#22010</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li> <li>Record workspace-member dependency-group Python requirements in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22044">#22044</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li> <li>Record default groups for non-project workspace roots in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li> <li>Record dependency-group Python requirements for non-project workspace roots in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li> <li>Format URLs and paths consistently in CLI messages (<a href="https://redirect.github.com/astral-sh/uv/pull/21937">#21937</a>)</li> <li>Hide the unsupported <code>--offline</code> option from <code>uv publish</code> help (<a href="https://redirect.github.com/astral-sh/uv/pull/22124">#22124</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Honor <code>--no-default-groups</code> in <code>uv audit</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22090">#22090</a>)</li> <li>Report a clear error when <code>uv audit</code> or <code>uv tool audit</code> runs offline and hide the unsupported option from help (<a href="https://redirect.github.com/astral-sh/uv/pull/22114">#22114</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Add <code>UV_PYTHON_ARCH</code> to select an interpreter architecture independently of its Python version (<a href="https://redirect.github.com/astral-sh/uv/pull/22098">#22098</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce uv's binary size by compressing embedded Python download metadata (<a href="https://redirect.github.com/astral-sh/uv/pull/22126">#22126</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Verify unchanged requirements against existing lockfile hashes when relocking (<a href="https://redirect.github.com/astral-sh/uv/pull/22083">#22083</a>)</li> <li>Honor dependency-group Python requirements at non-project workspace roots (<a href="https://redirect.github.com/astral-sh/uv/pull/22101">#22101</a>)</li> <li>Use each selected workspace member's recorded default groups during frozen sync (<a href="https://redirect.github.com/astral-sh/uv/pull/22015">#22015</a>)</li> <li>Avoid false entry-point warnings for required workspace members (<a href="https://redirect.github.com/astral-sh/uv/pull/22112">#22112</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Raise the minimum supported Rust version for building uv to 1.97 and update the toolchain to Rust 1.99 (<a href="https://redirect.github.com/astral-sh/uv/pull/22121">#22121</a>)</li> </ul> <h2>Install uv 0.12.22</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.22/uv-installer.sh \| sh </code></pre> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.22</h2> <p>Released on 2026-10-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/22147">#22147</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Accept uppercase release suffixes in wheel platform tags (<a href="https://redirect.github.com/astral-sh/uv/pull/22113">#22113</a>)</li> <li>Record workspace-member default groups in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22010">#22010</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li> <li>Record workspace-member dependency-group Python requirements in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22044">#22044</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li> <li>Record default groups for non-project workspace roots in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li> <li>Record dependency-group Python requirements for non-project workspace roots in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li> <li>Format URLs and paths consistently in CLI messages (<a href="https://redirect.github.com/astral-sh/uv/pull/21937">#21937</a>)</li> <li>Hide the unsupported <code>--offline</code> option from <code>uv publish</code> help (<a href="https://redirect.github.com/astral-sh/uv/pull/22124">#22124</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Honor <code>--no-default-groups</code> in <code>uv audit</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22090">#22090</a>)</li> <li>Report a clear error when <code>uv audit</code> or <code>uv tool audit</code> runs offline and hide the unsupported option from help (<a href="https://redirect.github.com/astral-sh/uv/pull/22114">#22114</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Add <code>UV_PYTHON_ARCH</code> to select an interpreter architecture independently of its Python version (<a href="https://redirect.github.com/astral-sh/uv/pull/22098">#22098</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce uv's binary size by compressing embedded Python download metadata (<a href="https://redirect.github.com/astral-sh/uv/pull/22126">#22126</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Verify unchanged requirements against existing lockfile hashes when relocking (<a href="https://redirect.github.com/astral-sh/uv/pull/22083">#22083</a>)</li> <li>Honor dependency-group Python requirements at non-project workspace roots (<a href="https://redirect.github.com/astral-sh/uv/pull/22101">#22101</a>)</li> <li>Use each selected workspace member's recorded default groups during frozen sync (<a href="https://redirect.github.com/astral-sh/uv/pull/22015">#22015</a>)</li> <li>Avoid false entry-point warnings for required workspace members (<a href="https://redirect.github.com/astral-sh/uv/pull/22112">#22112</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Raise the minimum supported Rust version for building uv to 1.97 and update the toolchain to Rust 1.99 (<a href="https://redirect.github.com/astral-sh/uv/pull/22121">#22121</a>)</li> </ul> <h2>0.12.21</h2> <p>Released on 2026-09-29.</p> <h3>Python</h3> <ul> <li>Update CPython to use OpenSSL 3.5.9 (<a href="https://redirect.github.com/astral-sh/uv/pull/22076">#22076</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/70fe1196a546e49148a73b1c592b2f74c33af80e"><code>70fe119</code></a> Bump version to 0.12.22 (<a href="https://redirect.github.com/astral-sh/uv/issues/22148">#22148</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/7e9d252e37065168cd3ed8419bb31da512133604"><code>7e9d252</code></a> Sync latest Python releases (<a href="https://redirect.github.com/astral-sh/uv/issues/22147">#22147</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d644be28bdb7820055801b9796e56b553cfd513c"><code>d644be2</code></a> Compress embedded Python download metadata (<a href="https://redirect.github.com/astral-sh/uv/issues/22126">#22126</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0a41ee38ec6009877a77702265bcd18ceeece5ef"><code>0a41ee3</code></a> Benchmark Python download catalog loading (<a href="https://redirect.github.com/astral-sh/uv/issues/22125">#22125</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/cbf610678ba180054ce502ba803bc4403fac630e"><code>cbf6106</code></a> Use Cargo warning policy for Clippy (<a href="https://redirect.github.com/astral-sh/uv/issues/22122">#22122</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/60776645b718e5141a6969922c4d027008a9c2b9"><code>6077664</code></a> Update Rust to 1.99 and MSRV to 1.97 (<a href="https://redirect.github.com/astral-sh/uv/issues/22121">#22121</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/69025fdd3b437447909dcf71e8e751652873b1b9"><code>69025fd</code></a> Hide the <code>--offline</code> flag in <code>uv publish</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/22124">#22124</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3f70ccf04396802654de142c40925bdad39311e9"><code>3f70ccf</code></a> Defer cache format changes to 0.13 (<a href="https://redirect.github.com/astral-sh/uv/issues/22128">#22128</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e71ab8f9b46398cc2d73f866dd4d1776e9969953"><code>e71ab8f</code></a> Add <code>UV_PYTHON_ARCH</code> for requesting an interpreter architecture (<a href="https://redirect.github.com/astral-sh/uv/issues/22098">#22098</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d62a205c091f12a90db2c77f596b3a53bca22051"><code>d62a205</code></a> Hide the <code>--offline</code> flag for uv audit (<a href="https://redirect.github.com/astral-sh/uv/issues/22114">#22114</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.19...0.12.22">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/uv&package-manager=docker&previous-version=0.12.19&new-version=0.12.22)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-02 22:38:05 -04:00
splitsec2andMichael Ngo	fcdc2dfb69	perf(docker): stop shipping build-only content in the runtime image (#1404 ) While checking why each build took so much disk on my server, I looked at what's actually in the runtime image. A good share of it is there for the build and never used after. The C toolchain. The base stage installs `gcc`, `g++`, `libffi-dev` and `python3-dev` for building C extensions, and they stay in both the full and lite images, which is 290 MB installed. Nothing gets compiled any more. Every compiled dependency in `uv.lock` (cffi, gevent, greenlet, zope-interface) ships a cp314 manylinux wheel for both amd64 and arm64, and the packages that only have an sdist are pure Python. `python3-dev` was also pulling Debian's `libpython3.13` into a 3.14 image. The build context. `COPY . .` puts the whole context into `/app`, so `tests/`, `docs/` and the frontend source ship too. `.dockerignore` now leaves out the trees nothing reads at runtime. `src/` can't go in `.dockerignore` because the frontend-builder stage needs it, so both final stages remove it after the built dist is copied. The venv's own `pip` goes as well, since uv seeds one and nothing installs at runtime. This part is @DrNgo's work from his fork, and the commit carries his name. Measured by building both targets on native amd64 and arm64 runners: \| \| amd64 full \| amd64 lite \| arm64 full \| arm64 lite \| \|---\|---\|---\|---\|---\| \| before \| 1,532 MB \| 589 MB \| 1,528 MB \| 619 MB \| \| after \| 1,238 MB \| 295 MB \| 1,251 MB \| 342 MB \| Compressed, the full image goes from 617 MB to 504 MB on amd64. On both architectures the image builds, reaches healthy, and Chromium starts the same way the bypasser starts it (xvfb, `_get_browser_args()`). The Python suite passes too. It's also running on my own install now. If a dependency ever needs compiling again, the clean fix is a builder stage that builds the wheel and copies it in, rather than putting the toolchain back in the runtime image. Happy to add that now if you'd rather have it in place. --------- Co-authored-by: Michael Ngo <michaeln56@gmail.com>	2026-10-02 16:30:10 -04:00
dependabot[bot]andCaliBrain	efb1f66bc3	build(deps): bump astral-sh/uv from 0.12.16 to 0.12.19 in the docker-base-image-digests group across 1 directory (#1392 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update in the / directory: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.12.16 to 0.12.19 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.19</h2> <h2>Release Notes</h2> <p>Released on 2026-09-24.</p> <h3>Python</h3> <ul> <li>Add PyPy 3.11.16 and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> <li>Update GraalPy 3.13.0 to build 25.4.4 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Format upload URLs with backticks in <code>uv publish</code> errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21934">#21934</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Run build-backend hooks with lazy imports on CPython 3.15 and later using the <code>build-lazy-imports</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21967">#21967</a>)</li> <li>Omit unused resolution settings from <code>uv.lock</code> and ignore changes to them when checking lockfile freshness with the <code>resolution-inputs</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21913">#21913</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (<a href="https://redirect.github.com/astral-sh/uv/pull/21971">#21971</a>)</li> <li>Recognize <code>1.0.0</code> as satisfying <code>===1</code> during installed-package checks, matching resolution (<a href="https://redirect.github.com/astral-sh/uv/pull/21931">#21931</a>)</li> <li>Avoid collisions between Git checkout readiness markers and <code>.ok</code> files in dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21891">#21891</a>)</li> <li>Preserve always-false <code>python_version</code> markers when parsing their serialized form (<a href="https://redirect.github.com/astral-sh/uv/pull/21939">#21939</a>)</li> </ul> <h3>Rust API</h3> <ul> <li>Restore the public <code>FlatDistributions</code> export and its <code>BTreeMap</code> conversion for downstream resolvers (<a href="https://redirect.github.com/astral-sh/uv/pull/21965">#21965</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Make individual preview-feature reference entries linkable by name (<a href="https://redirect.github.com/astral-sh/uv/pull/21950">#21950</a>)</li> </ul> <h2>Install uv 0.12.19</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 \| iex" </code></pre> <h2>Download uv 0.12.19</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.19</h2> <p>Released on 2026-09-24.</p> <h3>Python</h3> <ul> <li>Add PyPy 3.11.16 and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> <li>Update GraalPy 3.13.0 to build 25.4.4 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Format upload URLs with backticks in <code>uv publish</code> errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21934">#21934</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Run build-backend hooks with lazy imports on CPython 3.15 and later using the <code>build-lazy-imports</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21967">#21967</a>)</li> <li>Omit unused resolution settings from <code>uv.lock</code> and ignore changes to them when checking lockfile freshness with the <code>resolution-inputs</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21913">#21913</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (<a href="https://redirect.github.com/astral-sh/uv/pull/21971">#21971</a>)</li> <li>Recognize <code>1.0.0</code> as satisfying <code>===1</code> during installed-package checks, matching resolution (<a href="https://redirect.github.com/astral-sh/uv/pull/21931">#21931</a>)</li> <li>Avoid collisions between Git checkout readiness markers and <code>.ok</code> files in dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21891">#21891</a>)</li> <li>Preserve always-false <code>python_version</code> markers when parsing their serialized form (<a href="https://redirect.github.com/astral-sh/uv/pull/21939">#21939</a>)</li> </ul> <h3>Rust API</h3> <ul> <li>Restore the public <code>FlatDistributions</code> export and its <code>BTreeMap</code> conversion for downstream resolvers (<a href="https://redirect.github.com/astral-sh/uv/pull/21965">#21965</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Make individual preview-feature reference entries linkable by name (<a href="https://redirect.github.com/astral-sh/uv/pull/21950">#21950</a>)</li> </ul> <h2>0.12.18</h2> <p>Released on 2026-09-22.</p> <p>This release addresses <a href="https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7">GHSA-2cv4-cqwr-gwf7</a>, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.</p> <h3>Enhancements</h3> <ul> <li>Add <code>--output-format json</code> to <code>uv pip install</code> and <code>uv pip sync</code>, including for <code>--dry-run</code> and <code>--check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21893">#21893</a>)</li> <li>Add <code>--check</code> to <code>uv pip install</code> and <code>uv pip sync</code> to report planned changes without modifying the environment (<a href="https://redirect.github.com/astral-sh/uv/pull/21844">#21844</a>)</li> <li>Identify failures from <code>get_requires_for_build_*</code> hooks correctly in build errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21881">#21881</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Validate build requirements for <code>uv build --no-build-isolation</code> with <code>--preview-features build-dependency-check</code>; use <code>--skip-dependency-check</code> to opt out (<a href="https://redirect.github.com/astral-sh/uv/pull/21880">#21880</a>)</li> </ul> <h3>Performance</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/bea138450f0e620a4ce5765b0e38cff7b9f0799f"><code>bea1384</code></a> Bump version to 0.12.19 (<a href="https://redirect.github.com/astral-sh/uv/issues/21975">#21975</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/299a93de4b94e754f260c673d2de456afbdd4fb7"><code>299a93d</code></a> Sync latest Python releases (<a href="https://redirect.github.com/astral-sh/uv/issues/21970">#21970</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/30de9e2cc92018c7c16a1ab66bb9b8341fbf0eff"><code>30de9e2</code></a> Preserve query parameters in direct URL metadata (<a href="https://redirect.github.com/astral-sh/uv/issues/21971">#21971</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0e7433eee906fe81709c95c5bde556263367f21f"><code>0e7433e</code></a> Filter distribution hashes in tests (<a href="https://redirect.github.com/astral-sh/uv/issues/21941">#21941</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/c73db78f0b00580b3c67279b59b85153a9d0264d"><code>c73db78</code></a> Omit unused runtime settings from lockfiles (<a href="https://redirect.github.com/astral-sh/uv/issues/21913">#21913</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/ad123420aaa75b3bdbccf81496aaece8b9045b30"><code>ad12342</code></a> Add a preview feature for lazy build backend imports (<a href="https://redirect.github.com/astral-sh/uv/issues/21967">#21967</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/dd965a276182e2d46d80439feecd03216cc6643a"><code>dd965a2</code></a> Restore <code>FlatDistributions</code> for downstream resolvers (<a href="https://redirect.github.com/astral-sh/uv/issues/21965">#21965</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/214d7f677585fbb0bb46fadef890335e388641c0"><code>214d7f6</code></a> Use Astra for PR security reviews (<a href="https://redirect.github.com/astral-sh/uv/issues/21959">#21959</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3db665232544183edcb80dd7077b8051b365e236"><code>3db6652</code></a> Disable incremental compilation when publishing docs (<a href="https://redirect.github.com/astral-sh/uv/issues/21955">#21955</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e18f413b23bfe5f33bcc1a3a3de330e4716aedcf"><code>e18f413</code></a> Reproduce editable project relocation failure (<a href="https://redirect.github.com/astral-sh/uv/issues/21948">#21948</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.16...0.12.19">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz>	2026-09-25 19:18:30 -04:00
splitsec2	ca25448529	perf(docker): keep the heavy build layers cacheable across builds - save 11minutes per build (#1379 ) With the amount of changes and testing I've been doing lately I noticed how long the builds were taking and how much each one pulled, so I went and looked at the Dockerfile. I think this balances cache and efficiency. Three changes needed to be stacked to make it happen. The version stamp sits above everything expensive. `ARG BUILD_VERSION` and `ENV BUILD_VERSION` are at the top of the `base` stage and the value carries the commit sha, so it changes on every commit. This invalidates the layer and everything below it, which means the apt install, the dependency sync and the Chromium install. Nothing in the build reads either variable. They're only used at runtime by entrypoint.sh, tor.sh, wireguard.sh and genDebug.sh, so they can move to the end of the final stages. `COPY . .` sits above the Chromium install. It's in `base`, and the `shelfmark` stage installs Chromium and the seleniumbase drivers after it, so any source change rebuilds those too. Moving the source copy and the runtime-paths block to the end of each final stage solves that. There's no cross-run cache. Runners are ephemeral, so without `cache-from` and `cache-to` every layer is rebuilt on every run whatever the ordering, and a rebuilt layer gets a new digest even when the content is identical. That's why reordering on its own doesn't change the load. Measured with a source-only change between two builds: \| \| Build \| Pull \| \|---\|---\|---\| \| before \| 13m 20s \| 526.5 MB \| \| after \| 2m 25s \| 3.7 MB \| 15 of 18 layers get reused where it was 5. The cache sits at 0.86 GB, which leaves room under the 10 GB repo budget for the uv caches in ci.yml and e2e-platform.yml. I tried `mode=max` first and it built a bit quicker at 1m 43s, but it used 5.15 GB of cache and the potential to impact other workflows so it didn't seem worth 40 seconds, but that is a single line fix if you want to. This means the runtime-paths block is now duplicated, once per final stage, and that's most of the diff. It has to sit below each stage's heavy layers to do its job and I couldn't find a way around that short of another shared stage, which looked like more complexity for complexity's sake. Happy to take another run at it if you'd rather have it 'DRY'. I checked the built image against the current one. Same size, it boots, /api/health returns 200, and BUILD_VERSION and RELEASE_VERSION are still stamped correctly. Also, I'll slow down on the PRs. Promise.	2026-09-25 18:07:05 -04:00
dependabot[bot]	83f86242b4	build(deps): bump the docker-base-image-digests group with 2 updates (#1348 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `50c8e8c` to `ebfe2f9` Updates `astral-sh/uv` from 0.12.13 to 0.12.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.16</h2> <h2>Release Notes</h2> <p>Released on 2026-09-17.</p> <h3>Python</h3> <ul> <li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify downloaded wheels and source distributions against hashes supplied by package indexes (<a href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li> <li>Allow <code>build-constraint-dependencies</code> entries to include hashes for verifying downloaded build dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li> <li>Honor Darwin <code>platform_release</code> markers in <code>required-environments</code> using macOS wheel deployment targets (<a href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li> <li>Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (<a href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Support <code>lock-without-metadata</code> across all dependency types while retaining <code>package.metadata</code> for remote URL dependencies to enable offline validation (<a href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li> <li>Honor configured and command-line index settings, including credentials, in <code>uv upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li> <li>Allow <code>uv check</code> to run in projects that are not managed by uv and outside workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li> <li>Respect <code>--python</code> and <code>UV_PYTHON</code> when selecting the Python version for <code>uv check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Redact Azure shared access signatures from displayed and logged URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li> <li>Check archive sizes from <code>pylock.toml</code> before reusing cached distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li> <li>Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (<a href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li> <li>Use the bundled <code>uv_build</code> backend only when its version matches active version pins (<a href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li> <li>Handle malformed index URLs without panicking when credentials are configured (<a href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li> <li>Report a configuration error instead of panicking for proxy URLs without a host (<a href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li> <li>Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (<a href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li> </ul> <h2>Install uv 0.12.16</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 \| iex" </code></pre> <h2>Download uv 0.12.16</h2> <p>\| File \| Platform \| Checksum \|</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.16</h2> <p>Released on 2026-09-17.</p> <h3>Python</h3> <ul> <li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify downloaded wheels and source distributions against hashes supplied by package indexes (<a href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li> <li>Allow <code>build-constraint-dependencies</code> entries to include hashes for verifying downloaded build dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li> <li>Honor Darwin <code>platform_release</code> markers in <code>required-environments</code> using macOS wheel deployment targets (<a href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li> <li>Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (<a href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Support <code>lock-without-metadata</code> across all dependency types while retaining <code>package.metadata</code> for remote URL dependencies to enable offline validation (<a href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li> <li>Honor configured and command-line index settings, including credentials, in <code>uv upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li> <li>Allow <code>uv check</code> to run in projects that are not managed by uv and outside workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li> <li>Respect <code>--python</code> and <code>UV_PYTHON</code> when selecting the Python version for <code>uv check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Redact Azure shared access signatures from displayed and logged URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li> <li>Check archive sizes from <code>pylock.toml</code> before reusing cached distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li> <li>Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (<a href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li> <li>Use the bundled <code>uv_build</code> backend only when its version matches active version pins (<a href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li> <li>Handle malformed index URLs without panicking when credentials are configured (<a href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li> <li>Report a configuration error instead of panicking for proxy URLs without a host (<a href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li> <li>Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (<a href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li> </ul> <h2>0.12.15</h2> <p>Released on 2026-09-15.</p> <h3>Performance</h3> <ul> <li>Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (<a href="https://redirect.github.com/astral-sh/uv/pull/21675">#21675</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix regressions in <code>0.12.14</code> when installing to symlinked destinations or using <code>uv pip install --target .</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21699">#21699</a>)</li> </ul> <h2>0.12.14</h2> <p>Released on 2026-09-15.</p> <h3>Enhancements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/761ff1379b3b79f61fc8d421dfe4fe064834e084"><code>761ff13</code></a> Bump version to 0.12.16 (<a href="https://redirect.github.com/astral-sh/uv/issues/21809">#21809</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a2f820ad0cebb7118f7686be3619d48df5121f6e"><code>a2f820a</code></a> Assign release pull requests to the workflow initiator (<a href="https://redirect.github.com/astral-sh/uv/issues/21808">#21808</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6dffe7e03898409c04e2f46436bffa60abbae465"><code>6dffe7e</code></a> Ignore <code>UV_NATIVE_TLS</code> when <code>UV_SYSTEM_CERTS</code> is set (<a href="https://redirect.github.com/astral-sh/uv/issues/21805">#21805</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/7bc36767ae3ea0d45e3cc6f219765fdec2992a33"><code>7bc3676</code></a> Avoid warning when both <code>native-tls</code> and <code>system-certs</code> are configured (<a href="https://redirect.github.com/astral-sh/uv/issues/21806">#21806</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/07b838a33179967b87d513825b02504a75b21b3a"><code>07b838a</code></a> Avoid warning when both <code>UV_NATIVE_TLS</code> and <code>UV_SYSTEM_CERTS</code> are set (<a href="https://redirect.github.com/astral-sh/uv/issues/21788">#21788</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/5d64ede21e9e835e59ecd85329ebefd43faa8211"><code>5d64ede</code></a> Remove Hash API (<a href="https://redirect.github.com/astral-sh/uv/issues/21786">#21786</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9ddc4308551335e9c2ab6571ea0cf529eccf3e76"><code>9ddc430</code></a> Move shared thread initialization into uv-threads (<a href="https://redirect.github.com/astral-sh/uv/issues/21746">#21746</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/ef1e0689b4612796d7781ebeae7866028c6c9e82"><code>ef1e068</code></a> Make Git stamping opt-in for development builds (<a href="https://redirect.github.com/astral-sh/uv/issues/21750">#21750</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6ce09770cec30b30cdc66c3595517dce2b112562"><code>6ce0977</code></a> Avoid panics for non-base index URLs (<a href="https://redirect.github.com/astral-sh/uv/issues/21784">#21784</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/47f19ec154f325ade7d6045c4e785531c24635f7"><code>47f19ec</code></a> Return an error for failed VerbatimUrl path conversions (<a href="https://redirect.github.com/astral-sh/uv/issues/21783">#21783</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.13...0.12.16">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-19 23:18:59 -04:00
dependabot[bot]	9eb47989ec	build(deps): bump the docker-base-image-digests group with 2 updates (#1328 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `e67514e` to `50c8e8c` Updates `astral-sh/uv` from 0.12.9 to 0.12.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.13</h2> <h2>Release Notes</h2> <p>Released on 2026-09-10.</p> <h3>Python</h3> <ul> <li>Add GraalPy 3.13.0 (<a href="https://redirect.github.com/astral-sh/uv/pull/21431">#21431</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify hashes when downloading PEP 658 metadata sidecars (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Respect <code>ty</code> exclusions when <code>uv check</code> automatically selects members of a virtual workspace (<a href="https://redirect.github.com/astral-sh/uv/pull/21555">#21555</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (<a href="https://redirect.github.com/astral-sh/uv/pull/21279">#21279</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (<a href="https://redirect.github.com/astral-sh/uv/pull/18713">#18713</a>)</li> <li>Prefer <code>core-metadata</code> over legacy aliases in JSON index responses (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h2>Install uv 0.12.13</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 \| iex" </code></pre> <h2>Download uv 0.12.13</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.13</h2> <p>Released on 2026-09-10.</p> <h3>Python</h3> <ul> <li>Add GraalPy 3.13.0 (<a href="https://redirect.github.com/astral-sh/uv/pull/21431">#21431</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify hashes when downloading PEP 658 metadata sidecars (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Respect <code>ty</code> exclusions when <code>uv check</code> automatically selects members of a virtual workspace (<a href="https://redirect.github.com/astral-sh/uv/pull/21555">#21555</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (<a href="https://redirect.github.com/astral-sh/uv/pull/21279">#21279</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (<a href="https://redirect.github.com/astral-sh/uv/pull/18713">#18713</a>)</li> <li>Prefer <code>core-metadata</code> over legacy aliases in JSON index responses (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h2>0.12.12</h2> <p>Released on 2026-09-09.</p> <p>The executables in our macOS and Windows release archives and <code>uv</code> and <code>uv_build</code> wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.</p> <h3>Bug fixes</h3> <ul> <li>Exclude distributions uploaded after the <code>exclude-newer</code> cutoff from lockfiles and generated requirement hashes (<a href="https://redirect.github.com/astral-sh/uv/pull/21539">#21539</a>)</li> </ul> <h2>0.12.11</h2> <p>Released on 2026-09-08.</p> <h3>Preview features</h3> <ul> <li>Generate missing artifact hashes when exporting <code>pylock.toml</code> files to ensure they conform to PEP 751 (<a href="https://redirect.github.com/astral-sh/uv/pull/20146">#20146</a>)</li> <li>Warn when <code>pylock.toml</code> artifact hash tables are empty, which will be rejected in a future uv release (<a href="https://redirect.github.com/astral-sh/uv/pull/21462">#21462</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (<a href="https://redirect.github.com/astral-sh/uv/pull/21478">#21478</a>)</li> <li>Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (<a href="https://redirect.github.com/astral-sh/uv/pull/21468">#21468</a>)</li> <li>Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (<a href="https://redirect.github.com/astral-sh/uv/pull/21500">#21500</a>)</li> <li>Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (<a href="https://redirect.github.com/astral-sh/uv/pull/21499">#21499</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/0ebbd9274a55a8a53a13970be3b97e4209598e17"><code>0ebbd92</code></a> Bump version to 0.12.13 (<a href="https://redirect.github.com/astral-sh/uv/issues/21594">#21594</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/17ccae34815e249c66e53abe21916c3c0b6413e5"><code>17ccae3</code></a> Use separate Depot projects for Docker development builds (<a href="https://redirect.github.com/astral-sh/uv/issues/21591">#21591</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/8c18e15bd36dff0e17509cc68c3721798ae1ec2b"><code>8c18e15</code></a> Use the workflow revision for PR security review configuration (<a href="https://redirect.github.com/astral-sh/uv/issues/21592">#21592</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9ebb1f6a72db257a689049ee060b7cf93638aada"><code>9ebb1f6</code></a> Clarify release pipeline job names (<a href="https://redirect.github.com/astral-sh/uv/issues/21561">#21561</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d87450d82b3941507e48ac8b57f72a9d00709289"><code>d87450d</code></a> Omit unused <code>exclude-newer-package</code> entries from script locks (<a href="https://redirect.github.com/astral-sh/uv/issues/21589">#21589</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/911f3a208c104b07b2f4da3a2283564d9a95c403"><code>911f3a2</code></a> Refactor release artifact handling (<a href="https://redirect.github.com/astral-sh/uv/issues/21556">#21556</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a712e811024933ec441667659d6df73c04f5b678"><code>a712e81</code></a> Separate Docker release builds from publishing (<a href="https://redirect.github.com/astral-sh/uv/issues/21586">#21586</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/4196dae60a0cc542bd43c0188f8b4c6dbfa0df98"><code>4196dae</code></a> Use xhigh effort for PR security review (<a href="https://redirect.github.com/astral-sh/uv/issues/21530">#21530</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a51624b4791456260f72068ae878796233f72809"><code>a51624b</code></a> Reduce PR security review reporting work (<a href="https://redirect.github.com/astral-sh/uv/issues/21528">#21528</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/63e28b69821b4b55b90287d799cbf97ff6ba0f74"><code>63e28b6</code></a> Use <code>editpe</code> for trampoline resource edits (<a href="https://redirect.github.com/astral-sh/uv/issues/18713">#18713</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.9...0.12.13">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-11 02:07:12 -04:00
dependabot[bot]	22aa59e567	build(deps): bump the docker-base-image-digests group with 2 updates (#1306 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `d32cdf6` to `e67514e` Updates `astral-sh/uv` from 0.12.5 to 0.12.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.9</h2> <h2>Release Notes</h2> <p>Released on 2026-09-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.15.0rc2 (<a href="https://redirect.github.com/astral-sh/uv/pull/21413">#21413</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21415">#21415</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Add <code>--no-locked</code> and <code>--no-frozen</code> to disable lock modes enabled by <code>UV_LOCKED</code> and <code>UV_FROZEN</code> for a single invocation (<a href="https://redirect.github.com/astral-sh/uv/pull/21408">#21408</a>)</li> <li>Report the exact command-line lock-mode flag in warnings and errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21402">#21402</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (<a href="https://redirect.github.com/astral-sh/uv/pull/21372">#21372</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Update <code>async_http_range_reader</code> to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (<a href="https://redirect.github.com/astral-sh/uv/pull/21401">#21401</a>)</li> <li>Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (<a href="https://redirect.github.com/astral-sh/uv/pull/21382">#21382</a>)</li> <li>Redact secrets in signed URLs from retry diagnostics, including nested request errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21381">#21381</a>)</li> <li>Give <code>--locked</code>, <code>--frozen</code>, <code>--check</code>, and <code>--check-exists</code> precedence over conflicting <code>UV_LOCKED</code> and <code>UV_FROZEN</code> values (<a href="https://redirect.github.com/astral-sh/uv/pull/21396">#21396</a>)</li> <li>Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (<a href="https://redirect.github.com/astral-sh/uv/pull/21400">#21400</a>)</li> </ul> <h2>Install uv 0.12.9</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 \| iex" </code></pre> <h2>Download uv 0.12.9</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.9</h2> <p>Released on 2026-09-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.15.0rc2 (<a href="https://redirect.github.com/astral-sh/uv/pull/21413">#21413</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21415">#21415</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Add <code>--no-locked</code> and <code>--no-frozen</code> to disable lock modes enabled by <code>UV_LOCKED</code> and <code>UV_FROZEN</code> for a single invocation (<a href="https://redirect.github.com/astral-sh/uv/pull/21408">#21408</a>)</li> <li>Report the exact command-line lock-mode flag in warnings and errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21402">#21402</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (<a href="https://redirect.github.com/astral-sh/uv/pull/21372">#21372</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Update <code>async_http_range_reader</code> to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (<a href="https://redirect.github.com/astral-sh/uv/pull/21401">#21401</a>)</li> <li>Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (<a href="https://redirect.github.com/astral-sh/uv/pull/21382">#21382</a>)</li> <li>Redact secrets in signed URLs from retry diagnostics, including nested request errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21381">#21381</a>)</li> <li>Give <code>--locked</code>, <code>--frozen</code>, <code>--check</code>, and <code>--check-exists</code> precedence over conflicting <code>UV_LOCKED</code> and <code>UV_FROZEN</code> values (<a href="https://redirect.github.com/astral-sh/uv/pull/21396">#21396</a>)</li> <li>Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (<a href="https://redirect.github.com/astral-sh/uv/pull/21400">#21400</a>)</li> </ul> <h2>0.12.8</h2> <p>Released on 2026-08-31.</p> <h3>Enhancements</h3> <ul> <li>Warn about invalid tool directories and continue upgrading valid tools with <code>uv tool upgrade --all</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21368">#21368</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Deduplicate identical files within and across cached wheels with the <code>content-addressed-cache</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21327">#21327</a>)</li> <li>Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (<a href="https://redirect.github.com/astral-sh/uv/pull/21340">#21340</a>)</li> <li>Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (<a href="https://redirect.github.com/astral-sh/uv/pull/21344">#21344</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (<a href="https://redirect.github.com/astral-sh/uv/pull/21379">#21379</a>)</li> <li>Speed up dependency graph construction from large lockfiles by indexing packages during traversal (<a href="https://redirect.github.com/astral-sh/uv/pull/21373">#21373</a>)</li> <li>Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (<a href="https://redirect.github.com/astral-sh/uv/pull/21377">#21377</a>)</li> <li>Speed up warm resolutions by reducing repeated marker interner work (<a href="https://redirect.github.com/astral-sh/uv/pull/21300">#21300</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Do not trust hashes from direct URLs discovered only in wheel metadata when installing with <code>--require-hashes</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21348">#21348</a>)</li> <li>Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (<a href="https://redirect.github.com/astral-sh/uv/pull/21366">#21366</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/9f928602938ac5cf1cd6b294a725833c16f5720e"><code>9f92860</code></a> Bump version to 0.12.9 (<a href="https://redirect.github.com/astral-sh/uv/issues/21422">#21422</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/29c546228ed6ba8970bb063960c9a767fae19236"><code>29c5462</code></a> Skip invalid scripts in <code>uv workspace list --scripts</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/21416">#21416</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/bf1d7e8049017a363565185a7df7e86f33041452"><code>bf1d7e8</code></a> Encapsulate wheel extraction directory ownership (<a href="https://redirect.github.com/astral-sh/uv/issues/21419">#21419</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6dacee042f58cea9184267ffb70c6960582bb210"><code>6dacee0</code></a> Run streaming ZIP extraction in a blocking task (<a href="https://redirect.github.com/astral-sh/uv/issues/21372">#21372</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/91d1ebf1b4ea1fc00928b412a9da23639aacb086"><code>91d1ebf</code></a> Sync latest Python releases (<a href="https://redirect.github.com/astral-sh/uv/issues/21415">#21415</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6a61ddb2c094ab44e55a2cc5bb4a88b7c08d733a"><code>6a61ddb</code></a> Revert "Limit CI planner checkout depth" (<a href="https://redirect.github.com/astral-sh/uv/issues/21414">#21414</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e9d1816b538468e7deb8f267f28775007706b866"><code>e9d1816</code></a> Add CPython 3.15.0rc2 (<a href="https://redirect.github.com/astral-sh/uv/issues/21413">#21413</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e888329afc22fa3e34f93d5ae5e23fbc87328952"><code>e888329</code></a> Remove unreachable lock configuration sources (<a href="https://redirect.github.com/astral-sh/uv/issues/21409">#21409</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/bf041f9245952ba7c9e3c29aebe0a8acc2bc983d"><code>bf041f9</code></a> Allow negating locked and frozen modes (<a href="https://redirect.github.com/astral-sh/uv/issues/21408">#21408</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/feffc0b5bbf8aeca1dff4a6f042a58e44a5daf09"><code>feffc0b</code></a> Bump async_http_range_reader to 0.11.1 (<a href="https://redirect.github.com/astral-sh/uv/issues/21401">#21401</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.5...0.12.9">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-04 11:03:26 -04:00
dependabot[bot]	b317dd1110	build(deps): bump python from `cae66f2` to `cad9a2c` (#1307 ) > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps python from `cae66f2` to `cad9a2c`. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.7-slim&new-version=3.14.7-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-04 11:03:15 -04:00
dependabot[bot]	faaa119884	build(deps): bump python from `ce40764` to `cae66f2` (#1278 ) Bumps python from `ce40764` to `cae66f2`. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.7-slim&new-version=3.14.7-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-30 12:18:03 -04:00
dependabot[bot]	cb3f6fee82	build(deps): bump astral-sh/uv from 0.11.3 to 0.12.5 in the docker-base-image-digests group (#1247 ) Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.11.3 to 0.12.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.5</h2> <h2>Release Notes</h2> <p>Released on 2026-08-14.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.21, 3.11.16, and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21138">#21138</a>)</li> <li>Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (<a href="https://redirect.github.com/astral-sh/uv/pull/21134">#21134</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21130">#21130</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Allow <code>--index</code> and <code>--default-index</code> to select configured package indexes by name with the <code>index-by-name</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/17455">#17455</a>)</li> <li>Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (<a href="https://redirect.github.com/astral-sh/uv/pull/21131">#21131</a>)</li> <li>Fall back to logical file sizes when using <code>cache-physical-space</code> on filesystems that do not support physical-space accounting (<a href="https://redirect.github.com/astral-sh/uv/pull/21133">#21133</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Resolve relative package index paths in PEP 723 scripts against the script directory (<a href="https://redirect.github.com/astral-sh/uv/pull/21097">#21097</a>)</li> </ul> <h2>Install uv 0.12.5</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.sh \| sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.ps1 \| iex" </code></pre> <h2>Download uv 0.12.5</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-unknown-linux-gnu.tar.gz">uv-i686-unknown-linux-gnu.tar.gz</a></td> <td>x86 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-powerpc64le-unknown-linux-gnu.tar.gz">uv-powerpc64le-unknown-linux-gnu.tar.gz</a></td> <td>PPC64LE Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.5</h2> <p>Released on 2026-08-14.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.21, 3.11.16, and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21138">#21138</a>)</li> <li>Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (<a href="https://redirect.github.com/astral-sh/uv/pull/21134">#21134</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21130">#21130</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Allow <code>--index</code> and <code>--default-index</code> to select configured package indexes by name with the <code>index-by-name</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/17455">#17455</a>)</li> <li>Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (<a href="https://redirect.github.com/astral-sh/uv/pull/21131">#21131</a>)</li> <li>Fall back to logical file sizes when using <code>cache-physical-space</code> on filesystems that do not support physical-space accounting (<a href="https://redirect.github.com/astral-sh/uv/pull/21133">#21133</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Resolve relative package index paths in PEP 723 scripts against the script directory (<a href="https://redirect.github.com/astral-sh/uv/pull/21097">#21097</a>)</li> </ul> <h2>0.12.4</h2> <p>Released on 2026-08-13.</p> <h3>Enhancements</h3> <ul> <li>Prefer post-quantum key exchange and enable opt-in TLS diagnostics (<a href="https://redirect.github.com/astral-sh/uv/pull/21054">#21054</a>)</li> <li>Accept whitespace before versions in noncompliant wildcard comparisons such as <code>Requires-Python: >= 3.5.</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21012">#21012</a>)</li> <li>Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (<a href="https://redirect.github.com/astral-sh/uv/pull/20944">#20944</a>)</li> <li>Omit source-span carets from diagnostics for empty PEP 508 requirements (<a href="https://redirect.github.com/astral-sh/uv/pull/21094">#21094</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Add <code>uv check --no-install-project</code> and respect <code>UV_NO_INSTALL_PROJECT</code> to install dependencies without building or installing the project (<a href="https://redirect.github.com/astral-sh/uv/pull/21085">#21085</a>)</li> <li>Make the ty subprocess invoked by <code>uv check</code> honor uv's color and progress settings, including quiet mode (<a href="https://redirect.github.com/astral-sh/uv/pull/21086">#21086</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (<a href="https://redirect.github.com/astral-sh/uv/pull/20804">#20804</a>)</li> <li>Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (<a href="https://redirect.github.com/astral-sh/uv/pull/21041">#21041</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Use windowed <code>pythonw.exe</code> launchers for virtual environments created from managed Python minor-version links (<a href="https://redirect.github.com/astral-sh/uv/pull/19235">#19235</a>)</li> <li>Allow <code>uv lock</code> to proceed when <code>.venv</code> is an unusable project environment (<a href="https://redirect.github.com/astral-sh/uv/pull/21068">#21068</a>)</li> <li>Respect <code>fork-strategy</code> when ordering forks created from <code>environments</code> or existing lockfile <code>resolution-markers</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21000">#21000</a>)</li> <li>Preserve consecutive wildcard Python minor-version exclusions such as <code>!=3.11., !=3.12.*</code> in <code>uv.lock</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21045">#21045</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/210d1f6785e95a8c8c0d53e284408c9be1134700"><code>210d1f6</code></a> Bump version to 0.12.5 (<a href="https://redirect.github.com/astral-sh/uv/issues/21140">#21140</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/802a9162a1153ddee799a0080c80a38d96009d91"><code>802a916</code></a> Sync latest Python releases: 3.10.21, 3.11.16, 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/issues/21138">#21138</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a6904bbdabd3c6ac42b1051896ff597c8bd1895a"><code>a6904bb</code></a> Order equal-priority Python installations by key (<a href="https://redirect.github.com/astral-sh/uv/issues/21134">#21134</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/728a70d25c0889d9aaa53776256c3a843eea67a6"><code>728a70d</code></a> Improve automated fixes for related bug manifestations (<a href="https://redirect.github.com/astral-sh/uv/issues/21102">#21102</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/b82b0383fc3471227aa864f18d2c1c8efac8b9f1"><code>b82b038</code></a> Include hashes in cyclonedx exports (<a href="https://redirect.github.com/astral-sh/uv/issues/21131">#21131</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/8011778d41f2c96fb0b856fb3cbcb4ec8d28cb63"><code>8011778</code></a> Simplify editable requirement errors and hints (<a href="https://redirect.github.com/astral-sh/uv/issues/21130">#21130</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/dca33f5e6799f2aefee52729732a839a3b358740"><code>dca33f5</code></a> Fall back to logical cache accounting on unsupported filesystems (<a href="https://redirect.github.com/astral-sh/uv/issues/21133">#21133</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3a76e496e36783371a6d91a8f4834478964d36ca"><code>3a76e49</code></a> Get rid of <code>Lock::with_manifest</code>, make <code>Lock::from_resolution</code> take the manif...</li> <li><a href="https://github.com/astral-sh/uv/commit/7e6caa45f62a0506fea1b8ecfa0558e5d62d520c"><code>7e6caa4</code></a> Support referencing indexes by name via <code>--index</code> and <code>--default-index</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/17455">#17455</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/298dda41bff49bbd0a2f397e1662ab09b9cd148e"><code>298dda4</code></a> Fix relative indexes in PEP 723 scripts (<a href="https://redirect.github.com/astral-sh/uv/issues/21097">#21097</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.11.3...0.12.5">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/uv&package-manager=docker&previous-version=0.11.3&new-version=0.12.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-24 01:57:00 -04:00
CaliBrain	7d56624ab6	fix: group multi-file audiobooks that arrive as an archive (#1254 ) Follow-up to #1237. \`rename_and_group\` only grouped when the source root was a directory, so a multi-file audiobook delivered as a single archive fell through to the flat path: a \`Book.zip\` of twelve chapters landed loose in the destination root with its original chapter names — the layout #1181 is about. The \`is_dir()\` guard was there to keep \`Book.zip/\` from becoming the folder name, but skipping the file case gives up the grouping instead of naming it. A non-directory source can only produce several book files by having been extracted (\`collect_staged_files\` returns a single-element list for every other file shape), so the archive stem is the release name and the suffix is packaging: group under \`Book/\`. Also regenerates the env docs for the new option and gives it the same \"do not use with ingest folders\" caveat Rename and Organize carries, since both now create directories in the destination. Tested: reverting only the source fix makes both new tests fail and the \`rename\` control case pass, so grouping stays opt-in. Full non-e2e suite green (2653 passed).	2026-08-21 10:43:06 -04:00
Sujeito OperatorandCaliBrain	52c1702419	docker: mount uv at build time instead of copying it into every image (#1200 ) ### What this PR does `uv` stops being copied into the image and starts being mounted into the three `RUN`s that actually use it. The digest pin stays in exactly one place — it moves from the `COPY` to a stage declaration: ```dockerfile FROM ghcr.io/astral-sh/uv:0.11.3@sha256:90bbb3c... AS uv ``` ```dockerfile RUN --mount=type=cache,target=/root/.cache/uv \ --mount=from=uv,source=/uv,target=/usr/local/bin/uv \ uv sync --locked --no-default-groups ``` A stage consumed only through `--mount=from=` contributes no layer to anything published, so `uv` never lands in `base`. The two `RUN rm -f /usr/bin/uv /usr/bin/uvx` lines then have nothing left to delete and go with it. ### Why The `base` stage copies uv in, and both final stages try to take it back out: ```dockerfile # uv is only needed while building the image. RUN rm -f /usr/bin/uv /usr/bin/uvx ``` That intent is exactly right. The mechanism can't carry it out: a `RUN` adds a layer, it does not rewrite the layer underneath. The `COPY` layer is still pushed and still pulled by everyone. What the `rm` produces is a whiteout on top of it. ### Measured, not assumed Read off the published images over the registry API — `linux/amd64`, both built `2026-08-13T17:53Z`, pinned by digest so these numbers stay reproducible after tonight's scheduled rebuild: ``` ghcr.io/calibrain/shelfmark@sha256:9b6041f797cbcc1e5c50ab42bd010a8f747dfaac926080cb6269ddfae99cf820 layer COPY /uv /uvx /bin/ 24.3 MB of 585 MB total 4.1% of the pull layer RUN rm -f /usr/bin/uv /usr/bin/uvx 159 B ghcr.io/calibrain/shelfmark-lite@sha256:2eae503d791cef685e10135aaaff77077cfb4a31d6911e31216704988ce28b02 layer COPY /uv /uvx /bin/ 24.3 MB of 221 MB total 11.0% of the pull ``` The `rm` layer unpacks to exactly four tar entries: ``` usr/ usr/bin/ usr/bin/.wh.uv 0 bytes usr/bin/.wh.uvx 0 bytes ``` Two zero-length overlayfs whiteouts. That is the deletion behaving exactly as specified — and removing nothing at all from what anyone downloads. Same thing without the registry API: ``` $ docker manifest inspect ghcr.io/calibrain/shelfmark-lite:latest ``` and look for the ~24 MB layer; or `docker history` on a local build. ### To be clear about what the `rm` does and doesn't do It is not useless and I'm not claiming it is. It removes `uv` from the flattened filesystem, which is what the container sees at runtime and what Trivy/Grype scan by default — so the "don't ship a stale installer" half of the intent is already working today, the same way the `pip` removal above it does. This PR is about the other half: the bytes. After it, `uv` is absent from the filesystem and absent from the layers, so nothing regresses. This is image size, not a vulnerability, and I would not have opened it as anything else. ### Why this is safe - Nothing at runtime can depend on `uv` or `uvx` today, and that is read off your own artifact rather than argued: both are already whiteouted out of both published images. `uvx` is never invoked anywhere in the repo — `entrypoint.sh` has no `uv` in it, and the Makefile's `uv run` lines are the host-side dev workflow, outside the image. - `/usr/local/bin` is already on `PATH` in `python:3.14.7-slim`, and your `ENV PATH=/app/.venv/bin:$PATH` prepends rather than replaces, so `uv` resolves the same way it does now. - The pin does not move. Same image, same `sha256`, same resolution per target platform as `COPY --from=<image>` does today, so the `linux/amd64` and `linux/arm64` builds each keep getting their own `uv`. - `RUN --mount=` is already used three times in this file, so the frontend in use supports mounts; `from=` is part of the same feature. - Your `docker-build-check` job builds `shelfmark-lite` on every PR, so a build is the cheapest possible review of this change. As a first-time contributor my workflow runs sit at `action_required` until someone approves them — approving is enough to check the whole claim. ### Notes for reviewers - I have not built these images locally. There is no Docker daemon on the machine I run on. Every figure above is read from the published images over the registry API, and my own selftest re-reads them live on each run rather than trusting a note. - I left the `pip` removal in `base` alone. It has the same shape, but its stated goal — keeping a stale installer out of what scanners see — is genuinely achieved by the flattened filesystem, and `pip` arrives in the `python:slim` base layer where a Dockerfile change can't reach it anyway. - Written by an automated agent; saying so plainly seemed better than not. Signed-off-by: Sujeito Operator <operator@sujeito.org> Co-authored-by: CaliBrain <calibrain@l4n.xyz>	2026-08-15 11:32:37 -04:00
dependabot[bot]	78e1f4daba	Bump python from `83c1ceb` to `ce40764` (#1206 ) Bumps python from `83c1ceb` to `ce40764`. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.7-slim&new-version=3.14.7-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-15 11:16:14 -04:00
dependabot[bot]	7f770f54fa	Bump python from 3.14.6-slim to 3.14.7-slim (#1190 ) Bumps python from 3.14.6-slim to 3.14.7-slim. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.7-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-12 00:21:24 -04:00
CaliBrain	cc1a95f965	Fix protection bypass cancelled by stall detection at exactly 300s (#1184 ) A download that hits Cloudflare hung on "Bypassing protection..." for five minutes and then died, regardless of which bypasser was configured. html_get_page() started a BypassHeartbeat thread to keep the download marked alive during a bypass, but the thread had no loop: it fired one status event and returned. Even with the loop restored it could not have worked, because update_download_status() dedupes identical (status, message) tuples and returns before refreshing _last_activity, and the heartbeat re-sent the byte-identical payload already emitted just above it. So _last_activity was frozen for the whole bypass, while both bypassers are allowed to run longer than STALL_TIMEOUT (external FlareSolverr ~394s at default settings, internal 420s per get() call). The watchdog always won. From a reporter's log: 403 at 07:04:33.390, cancelled at 07:09:33.987 - exactly 300.000s, and 41s before the bypasser would have finished and reported the real error, an HTTP 500 from FlareSolverr the user never saw. The regression is not one commit. `1f093de` (#536) added the heartbeat and the dedup together and refreshed activity before the dedup return, so it worked. `ff094be` (#832) moved the refresh below that return while tightening stall detection for #823. `3a3a3ce` (#845) then deleted the heartbeat's while loop to silence a B023 lint, removing the last evidence of intent. The dedup itself is correct and stays: a keep-alive that ticks on a timer proves nothing about whether an operation is progressing, so letting it refresh the stall clock would make a wedged download immortal. Split the two concerns instead. Add shelfmark/download/activity.py. A long single-shot operation declares its own upper bound once, over a sentinel status carried on the existing status_callback channel - so no new parameter has to be threaded through every handler, post-processor and output module. The orchestrator intercepts the sentinel in its per-task closure and records an absolute deadline in _activity_grace, which stall detection honours alongside STALL_TIMEOUT. The grace never extends itself and is clamped to _MAX_ACTIVITY_GRACE_SECONDS, so an operation that overruns its own declared budget is still cancelled. Each bypasser now reports max_duration_seconds() derived from its own retry and timeout settings, and http.py asks whichever is active, plus 30s of slack so the bypasser's own deadline expires first and the user sees its real failure. On that path html_get_page() also emits status_callback("error", ...) rather than silently returning an empty page. Three further fixes on the same code path: - Extract the watchdog into _find_stalled_tasks() and _cancel_stalled_task(). It was the only place holding _progress_lock across a call into book_queue, whose terminal-status hooks reach a sqlite write that gevent does not patch, blocking the hub and every download worker. It now holds the lock for dict reads only. - Bound _CDP_WORKER.run(), which waited with timeout=None while holding the module-wide LOCKED, so a single wedged in-process CDP session blocked every subsequent bypass forever on non-Docker installs. - Broaden the coordinator loop's except clause back to Exception, with escalating backoff. `8d98e12` (#868) narrowed it to a six-type tuple to silence BLE001, which let gevent's LoopExit and similar kill the only thread driving the download queue - undoing #832's fix for #823 and resurfacing it as #1166. GreenletExit and gevent.Timeout still propagate. Fixes #1001 Refs #1166, #823	2026-08-11 02:25:28 -04:00
CaliBrain	dfcd7c9b00	Fix silent Hardcover search failures on rejected sort values (#1183 ) Hardcover forwards the `sort` argument to Typesense's `sort_by` and rejects the entire search if it dislikes the value -- an unknown field, a bare field name with no direction, or more than three sort keys. A rejected search is not a GraphQL error: it comes back as HTTP 200, no `errors` key, and a null `results` body. _extract_typesense_hits() reads that null as `hits=[], found=0`, so a failed search was indistinguishable from one that matched nothing. Users saw zero results with a healthy container and no log line explaining why. Add _execute_search_query(), used by the three sort-bearing call sites (book search, field typeahead, series resolution): - Detect the rejection via the null `results` body. A search that genuinely matched nothing still returns a results object with `found: 0`, so empty result sets are not mistaken for failures. - Retry once with an empty sort, which Hardcover always accepts, so searches return results instead of nothing. - Keep that fallback sticky for 15 minutes so every subsequent search does not pay for a request known to fail, and let it expire so sort order comes back on its own if the index is fixed upstream. - Log rejections that no sort can explain, and retries that also fail, at ERROR instead of discarding them. While the fallback is active, results fall back to Typesense's default ordering regardless of the selected sort. Degraded ordering beats no results, and it is now logged rather than silent. SORT_MAPPING itself is unchanged: all five of its values were verified against the live API and return results. The `sort: "relevance"` reported in #1179 was the raw SortOrder value sent by v1.3.5; the mapping already fixed that. What remained unfixed, and is fixed here, is that the failure was invisible. Fixes #1179	2026-08-11 01:35:41 -04:00
dependabot[bot]	bd9a22bd6c	Bump node from `a0b9bf0` to `d32cdf6` in the docker-base-image-digests group (#1168 ) Bumps the docker-base-image-digests group with 1 update: node. Updates `node` from `a0b9bf0` to `d32cdf6` [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node&package-manager=docker&previous-version=24-alpine&new-version=24-alpine)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-11 01:06:51 -04:00
dependabot[bot]	8eb9bd5c21	Bump python from `d3400aa` to `cea0e60` (#1131 ) Bumps python from `d3400aa` to `cea0e60`. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-24 18:33:45 -04:00
dependabot[bot]	2d949d4e7c	Bump python from `b877e50` to `d3400aa` (#1119 ) Bumps python from `b877e50` to `d3400aa`. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-19 02:52:03 -04:00
Alex SchittkoandCaliBrain	40d6a179b7	feat: native WireGuard VPN egress mode (USING_WIREGUARD) (#1097 ) Add an opt-in WireGuard egress path alongside the existing Tor mode --------- Co-authored-by: CaliBrain <calibrain@l4n.xyz>	2026-07-06 01:51:18 -04:00
CaliBrain	02a45c1a12	fix: pin chromium to 149.0.7827.196 — Debian's 150 breaks the CDP bypasser (#1105 )	2026-07-06 01:33:10 -04:00
Alex Schittko	8b4230ee9f	fix(bypass): resolve Xlib namespace collision breaking CDP browser startup (#1099 ) ## Problem The full (browser) image ships two conflicting distributions that both own the top-level `Xlib/` namespace: - `python-xlib` 0.33 (2022) — pulled by the `browser` extra - `python3-xlib` 0.15 (2014) — pulled transitively via `pyautogui` → `mouseinfo` Both install into the same `Xlib/` directory, so install order decides which files survive. When the 2014 `python3-xlib` lands last, `Xlib.X` is missing the `FamilyServerInterpreted` attribute that the SeleniumBase Pure-CDP driver references during browser startup. Every bypass attempt then fails with: ``` Pure CDP browser startup failed: module 'Xlib.X' has no attribute 'FamilyServerInterpreted' Bypasser error: RuntimeError: Pure CDP browser startup failed: module 'Xlib.X' has no attribute 'FamilyServerInterpreted' ``` Result: all Cloudflare / DDoS-Guard protected downloads fail on affected builds. ## Fix After the browser stack is installed, uninstall the stale `python3-xlib` and force-reinstall `python-xlib==0.33` so it deterministically owns the namespace. A build-time assertion checks `Xlib.X.FamilyServerInterpreted` exists so the image fails fast if the collision ever returns. `pyautogui` operates correctly against `python-xlib` 0.33 (superset API), so nothing else regresses. ## Testing - Reproduced live: a build where `python3-xlib` won produced the exact `FamilyServerInterpreted` error on every CDP browser start; removing it and reinstating `python-xlib==0.33` immediately restored `Chrome browser ready (Pure CDP)` and successful `_bypass_method_cdp_solve`. - The new build-time assertion prints `Xlib namespace OK: (0, 33)` and exits non-zero if the attribute is ever missing.	2026-07-04 09:50:33 -04:00
dependabot[bot]	14bd50bfd1	Bump python from `63a4c7f` to `b877e50` (#1100 ) Bumps python from `63a4c7f` to `b877e50`. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-04 09:46:45 -04:00
dependabot[bot]	76c55a488c	Bump node from `156b55f` to `a0b9bf0` in the docker-base-image-digests group (#1089 ) Bumps the docker-base-image-digests group with 1 update: node. Updates `node` from `156b55f` to `a0b9bf0` [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node&package-manager=docker&previous-version=24-alpine&new-version=24-alpine)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-26 14:53:45 -04:00
dependabot[bot]	08d0a04cf2	Bump python from `44dd044` to `63a4c7f` (#1090 ) Bumps python from `44dd044` to `63a4c7f`. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-26 14:53:28 -04:00
dependabot[bot]	3c1b79989a	Bump node from `fb71d01` to `156b55f` in the docker-base-image-digests group (#1075 ) Bumps the docker-base-image-digests group with 1 update: node. Updates `node` from `fb71d01` to `156b55f` [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node&package-manager=docker&previous-version=24-alpine&new-version=24-alpine)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-21 00:00:22 -04:00
dependabot[bot]	e41c1d4e8e	Bump python from 3.14.5-slim to 3.14.6-slim (#1076 ) Bumps python from 3.14.5-slim to 3.14.6-slim. [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.5-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-21 00:00:13 -04:00
dependabot[bot]	b5acbc1209	Bump node from `2bdb65e` to `fb71d01` in the docker-base-image-digests group (#1061 ) Bumps the docker-base-image-digests group with 1 update: node. Updates `node` from `2bdb65e` to `fb71d01` [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node&package-manager=docker&previous-version=24-alpine&new-version=24-alpine)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-06-14 01:41:02 -04:00
dependabot[bot]andCaliBrain	709d3828d9	Bump the docker-base-image-digests group across 1 directory with 2 updates (#1015 ) Bumps the docker-base-image-digests group with 2 updates in the / directory: node and python. Updates `node` from `d1b3b4d` to `2bdb65e` Updates `python` from 3.14-slim to 3.14.5-slim Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz>	2026-06-09 20:43:01 -04:00
Alex	b67df083e6	Remove installer tooling from runtime images (#978 )	2026-05-10 15:08:44 +01:00
Alex	f4daf05d03	Pin Docker base image digests (#969 )	2026-05-09 14:37:44 +01:00
Alex	41c4aa1d72	Updated permissions model and non-root support (#871 ) - Adds a non-root startup path at user 1000:1000 - skips privilege escalation and ownership checks. Works e.g. for kubernetes deployments (user 1000:1000 and runAsNonRoot enabled). - Remove startup check/chown commands for user-owned folders. Checks can be done with a "Test destination" button in settings which performs a test write. Users are responsible for fixing their own permissions. - Update docs	2026-04-12 08:22:32 +01:00
Alex	e3d5bd91fc	Bump node to 24 LTS (#853 )	2026-04-10 13:29:48 +01:00
Alex	3a3a3ce449	Add new python tooling + apply ruff linter cleanup (#845 ) - Adds `uv`, `ruff`, `pyright`, `vulture` and `pytest-xdist` - Move project, lockfile, docker build etc to uv - Align python tooling on 3.14 - Huge bulk of ruff linter fixes applied. Still in progress but all the core types are now enforced - Update CI and test helpers	2026-04-10 13:03:25 +01:00
Alexanddependabot[bot]	21a11b06b9	Dependency updates roll-up (#765 ) Supersedes the dependabot PRs after testing: - `actions/attest-build-provenance` - `docker/build-push-action` - `actions/checkout` - `seleniumbase` - `docker/metadata-action` - `actions/setup-node` - `python:3.14-slim` - `@types/node` - `postcss` - `react-router-dom` Left out for now: - `node:25-alpine` - `vite@8` - `@vitejs/plugin-react@6` --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-03-13 18:41:02 +00:00
Alex	7d992c3918	User DB cleanup and refactor (#686 ) - Refactored user and request code to avoid any database conflicts - Fix threading behavior with custom script execution - Harden the no_auth activity user filtering - Add a hint to add local admin if none is created - Added secret key to persist login states across updates / restarts	2026-03-02 15:41:15 +00:00
Alex	b10458a48b	Patch: Migrate bypasser to pure CDP + Misc fixes (#575 ) Bypasser: - Refactored internal bypasser logic to use SeleniumBase Pure CDP mode, removed chromedriver dependencies and UC code. - Added dedicated threading for internal bypasser functions, fixes any potential asyncio CPU spike behavior - Fixed WebGL issue with Chromium 144. Reverted 1.0.3 hotfix and updated to latest Chromium Misc: - Added M4A color mapping - Fix frontend language filtering with multi-language releases - Added "days" age for usenet/torrent releases - Improved entrypoint chown efficiency - Added `ONBOARDING` env variable, default true	2026-02-02 20:32:19 +00:00
Alex	10bfaec793	Fix: Broken bypasser dependencies (#540 )	2026-01-26 08:02:26 +00:00
Alex	edf25150bd	Fix: various external client issues (#505 )	2026-01-20 19:34:18 +00:00
Alex	afeae46821	Rename to Shelfmark and IRC adjustments (#415 )	2026-01-11 19:38:38 +00:00
Alex	06778184af	Fix: Directory config and init process (#396 )	2026-01-05 17:56:00 +00:00
Alex	a0f8d14c45	Hardcover enhancements, refactor and cleanup, PUID/PGID additions (#365 )	2025-12-28 22:51:40 +00:00
Alex	a99dc1501d	Prowlarr and IRC sources, Google Books, book series support + more (#361 ) ## Headline features ### Prowlarr plugin - search trackers and download usenet/torrent books - Search any usenet/torrent tracker via Prowlarr, returns books within Universal search - Configure download clients in the app settings (Qbittorrent, Deluge, Transmission, NZBget, SABnzbd) - Unified download and file handling within the app, same as AA. ### IRC plugin - Search IRCHighway #ebooks channel for books and download right in the app. - No setup needed - Credit to OpenBooks for the broad idea and inspiration for best practices for ebook-specific search and download. ### Google Books Metadata Provider - Create a Google Cloud API key and use Google Books as a metadata provider - Not the best source (Hardcover is still recommended), but another option and further redundancy for universal search ### Book series support - New "Series" search field in Hardcover provider - "Series order" sort option - lists books in reading order - "View Series" button in book details modal to search the full series - Series info display (e.g., "3 of 12 in The Wheel of Time") ## Others: - Better format filtering, helpful errors when formats rejected (e.g., "Found 3 ebooks but format not supported (.pdf). Enable in Settings > Formats." - Directory processing - Handles multi-file torrent/usenet downloads properly - Expand search toggle - Skip ISBN search to find more editions - Filtered authors - Uses primary authors only (excludes translators/narrators) for better search results - Language multi-select - Filter releases by multiple languages Docker / Build / Testing - pip cache mounts - Faster Docker builds via BuildKit cache - npm cache mounts - Faster frontend builds - APT cleanup - Smaller final image size - Added make restart command for quick restarts without rebuild - New pytest-based test framework with proper configuration (pyproject.toml) - Unit tests for all download clients (qBittorrent, Transmission, Deluge, NZBGet, SABnzbd) - Bencode parsing tests - Cache tests - Integration tests for Prowlarr handler - E2E test framework	2025-12-27 14:59:06 +00:00
Alex	823ceeef4a	Settings pass, SOCK5 proxy, RAR/ZIP handling + more (#355 ) - Further pass on settings UI, rearranging and adding further options - Full RAR/ZIP support, including automatic unzipping and moving valid file formats to ingest folder - SOCK5 proxy support - Full pass on the orchestrator to handle RAR/ZIP and category-specific ingest dirs regardless of release source. - Enhanced debug output to include new config JSON files - Further ReleaseModal refinement	2025-12-23 21:14:34 +00:00
Alex	a4173eafcb	Restructure + abstraction, plugin system, settings UI, universal search mode (#351 ) Key changes: \| Category \| Lines \| What it is \| \|--------------------------\|--------\|----------------------------------------------------------------------\| \| Docs \| ~2,100 \| plugin-settings.md, release-sources-plugin-guide.md, provider README \| \| Settings UI \| ~1,650 \| Modal, sidebar, field components (TextField, SelectField, etc.) \| \| ReleaseModal \| ~1,200 \| Universal mode release picker UI \| \| Metadata Providers \| ~2,100 \| Hardcover + OpenLibrary + base classes \| \| Core Infrastructure \| ~2,150 \| Cache decorator, queue, image cache, models, config \| \| main.py \| ~1,570 \| Flask routes (replaces old app.py but bigger) \| \| Orchestrator \| ~590 \| Download queue management \| \| Config/Settings Registry \| ~1,400 \| Backend settings system \| \| Frontend Hooks \| ~750 \| useSettings, useSearch, useDownloadTracking, etc. \| \| Other Frontend \| ~500 \| BookGetButton, ReleaseCell, utils \| \| Release Sources base \| ~320 \| Plugin interfaces \|	2025-12-22 12:13:11 -05:00
CaliBrain	15a61a5191	Fix tor timeout (#349 ) Tentative fix for #340	2025-12-18 15:53:39 -05:00
Alex	122a3633c2	APP_ENV removal and secure cookie handling (#333 ) Hey, made the tweaks we discussed, plus a couple related fixes :) - Removed APP_ENV entirely. All dev-specific functionality is enabled via `DEBUG: true` env var - Set secure cookie handling to false by default, added to the readme to enable if exclusively using HTTPS connection - Fixed healthcheck potentially not working with auth enabled - Removed APP_ENV from docker compose files and made sure app.db lines are included in all versions. APP_ENV in people's existing composes should get ignored entirely and will be put on the default env, so no issues when updating.	2025-12-11 17:13:41 -05:00
CaliBrain	0e2580030b	Change APP_ENV from 'prod' to 'dev' default (#331 ) Fix for #330	2025-12-08 14:48:33 -05:00
CaliBrain	b02ad7452c	Remove deprecated /request route prefix support (#318 ) This commit removes all references to the deprecated /request route prefix that was previously used for dual routing. The following changes were made: - Removed register_dual_routes() function that registered routes with /request prefix - Removed url_for_with_request() helper function for generating /request URLs - Removed call to register_dual_routes(app) at application startup - Removed /request/ prefixed favicon routes - Updated StatusEndpointFilter to remove /request/api/status log filtering - Removed unused flask_url_for import All routes now only use the standard paths without the /request prefix.	2025-11-16 15:41:29 -05:00
CaliBrain	50e53a13b0	Fix Dockerfile for arm64 qemu crashes (#316 ) Added build arguments for platform-specific builds and debug output.	2025-11-16 12:50:12 -05:00

1 2