mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-09-24 13:50:22 +01:00
main
571
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  Ama Senevirathneandamasen02
|
c18da92569 |
fix(postprocess): attach unmatched chaptered audio files to existing book group (#1176) (#1309)
### Summary Fixes #1176 When downloading an audiobook with many chaptered tracks (e.g. 250+ `.flac` or `.mp3` files), indexer XML or release metadata often caps the file list at ~100-110 entries. When the release extracts on disk, `match_plan_to_files()` matched those first ~110 files to the planned book group, while the remaining 140+ files fell into `unmatched` and triggered fallback heuristic grouping. Because heuristic grouping parsed the folder name (`Westwell - Hot & Cold (2023)`) and stripped the series/author prefix, it generated a second book titled `Hot & Cold` containing the remaining tracks, resulting in two split book folders. ### Changes - In `match_plan_to_files()` (`shelfmark/download/postprocess/packs.py`), check `unmatched` files before falling back to heuristic multi-book splitting. - If an unmatched file is chaptered audio (`.flac`, `.mp3`, `.aac`, etc.) and shares the directory with an existing book group, or if the plan was a single-book plan, append it to that group instead of creating a secondary book. - Non-chaptered standalone books (e.g. `.m4b`, `.epub`) or files in separate subfolders continue to fall back to heuristic grouping as before. - Added unit tests in `tests/download/test_packs.py` verifying: 1. Truncated track list in single folder properly appends remaining chaptered tracks without splitting. 2. Single-book plan with multi-disc audio files (`CD1`/`CD2`) groups together cleanly. 3. Multi-book packs with unmatched chaptered tracks route each track to its respective book folder. ### Testing Ran `uv run pytest tests/download/test_packs.py` and `uv run pytest tests/core/test_processing_packs.py` (all passed cleanly). Checked type annotations with `basedpyright` (0 errors) and formatting with `ruff`. Co-authored-by: amasen02 <amasen02@users.noreply.github.com> |
||
 Jorge Lima
|
97d1bb0df4 |
fix(bypass): keep Anna's Archive's aa_ddg_check so clearance replays (#1305)
## What Add `aa_ddg_check` to the cookie-store allowlist. One name, one test. ## Why Every replay of stored clearance ends in the `?check=1` redirect loop, so each search pays a fresh browser solve. On this instance (v1.3.15, WireGuard egress, 0 VPN restarts across the traces) not one replay was accepted in three days of DEBUG logs. The `__ddg*` cookies are stored and replayed correctly. Anna's Archive also sets a cookie of its own, `aa_ddg_check`, and its `?check=1` hop only answers with the page when that cookie is present too. The allowlist keeps `cf_*` and `__ddg*` names, so this one was never stored. ## Measured, same egress IP, cookies taken from one solve | replayed | plain `requests` | `curl_cffi`, Chrome TLS fingerprint | |---|---|---| | filtered `__ddg*` only (current behaviour) | 302 → 302 → 302 … loop | 302 → 302 → 302 … loop | | filtered + `__ddg8_/9_/10_` | loop | loop | | filtered + `aa_ddg_check` | **302 → 200, real search page** | 302 → 200 | | `aa_ddg_check` alone | 302 → 403 | — | So the TLS fingerprint is not the problem, the per-check trio is not the answer, and the cookie needs the `__ddg*` clearance next to it. Cookie attributes as issued: domain `.annas-archive.gl`, path `/`, expiry 90 days. It is not bound to the query, and it is accepted with a stock Python User-Agent. ## Through the real fetch path Same process, `html_get_page`, the name allowlisted, three different queries: ``` 1st: solve expected 25.8s bypass_calls=1 title='frankenstein shelley - search - an' md5=True 2nd: other query 9.5s bypass_calls=0 title='pride and prejudice austen - searc' md5=True 3rd: third query 4.8s bypass_calls=0 title='dracula stoker - search - anna's a' md5=True ``` ## Notes - `tests/bypass/test_ddg_cookie_reuse.py` gains `test_aa_check_cookie_is_stored`; its docstring table gains the row. The bypass tests need seleniumbase to import and do not run on my macOS host, so this leans on CI. `ruff check` and `ruff format --check` pass. The logic was checked directly against `cookie_store` with the settings registry stubbed. - `__ddgmark_` carries a 24 h expiry, so the store's clearance is good for about a day before the next solve, which is what a browser would see too. - Follow-up to #1286. Same instance, same method: DEBUG trace, then a probe script inside the container. |
||
  Matt Van HornandMatt Van Horn
|
9f11e83e1f |
fix: keep polling queued Real-Debrid torrents (#1303)
Add `queued` to the existing set of non-terminal Real-Debrid torrent states so `_handle_torrent_info` returns an in-progress `DownloadStatus` and leaves the mutable download state eligible for subsequent polling. Keep the change within the existing status-classification path rather than introducing a new helper or changing the broader handling of unknown statuses. The native Real-Debrid client currently treats the documented `queued` torrent status as a terminal error because it is absent from `_STATUS_DOWNLOADING`. This occurs after a torrent has been added and its files selected, particularly for uncached torrents that wait before downloading. A torrent-info payload with `status: queued`, zero progress, and a filename returns a non-complete `DownloadState.DOWNLOADING` result rather than `DownloadState.ERROR`; After handling `queued`, the internal download state remains non-terminal so a later status poll can be processed instead of returning a cached error. Fixes #1268 Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> |
||
 dependabot[bot]
|
b98c2cb83e |
build(deps): bump the python-deps group with 2 updates (#1302)
Bumps the python-deps group with 2 updates: [authlib](https://github.com/authlib/authlib) and [apprise](https://github.com/caronc/apprise). Updates `authlib` from 1.7.2 to 1.8.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.8.0</h2> <h2>What's Changed</h2> <ul> <li>Prefer <code>id_token_signed_response_alg</code> client metadata to guess algs by <a href="https://github.com/azmeuk"><code>@azmeuk</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/888">authlib/authlib#888</a></li> <li>fix: Catch InvalidKeyIdError in RFC 9068 JWTBearerTokenValidator by <a href="https://github.com/liudonggalaxy"><code>@liudonggalaxy</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/891">authlib/authlib#891</a></li> <li>fix: make leeway configurable in JWTBearerTokenValidator by <a href="https://github.com/mondi04"><code>@mondi04</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/903">authlib/authlib#903</a></li> <li>feat: add default jti claim to sign_jwt_bearer_assertion by <a href="https://github.com/liudonggalaxy"><code>@liudonggalaxy</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/897">authlib/authlib#897</a></li> <li>fix(oauth): cast sub claim to string in JWTBearerTokenGenerator by <a href="https://github.com/levinKaus"><code>@levinKaus</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/911">authlib/authlib#911</a></li> <li>Declare lower bounds for dependencies by <a href="https://github.com/azmeuk"><code>@azmeuk</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/912">authlib/authlib#912</a></li> <li>feat(client): use httpx2 instead of httpx by <a href="https://github.com/levinKaus"><code>@levinKaus</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/909">authlib/authlib#909</a></li> <li>Fix RFC7523 malformed claims handling by <a href="https://github.com/azmeuk"><code>@azmeuk</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/916">authlib/authlib#916</a></li> <li>Fix httpx oauth1 binary form data by <a href="https://github.com/shc261392"><code>@shc261392</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/779">authlib/authlib#779</a></li> <li>fix(starlette_client): remove default= keyword from config.get calls by <a href="https://github.com/aliaksei-protchanka"><code>@aliaksei-protchanka</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/770">authlib/authlib#770</a></li> <li>Added client_id parameter to AssertionClient by <a href="https://github.com/vilmar-hillow"><code>@vilmar-hillow</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/476">authlib/authlib#476</a></li> <li>fix(oauth): save device credential with authenticated client id by <a href="https://github.com/arpitjain099"><code>@arpitjain099</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/908">authlib/authlib#908</a></li> <li>fix(oauth1): correct protocol name in InsecureTransportError description by <a href="https://github.com/RavSinghChandan"><code>@RavSinghChandan</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/919">authlib/authlib#919</a></li> <li>fix(client): client can be flexible with jwt's header by <a href="https://github.com/lepture"><code>@lepture</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/922">authlib/authlib#922</a></li> <li>fix(oidc): omit claims when the value is None by <a href="https://github.com/lepture"><code>@lepture</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/923">authlib/authlib#923</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/mondi04"><code>@mondi04</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/903">authlib/authlib#903</a></li> <li><a href="https://github.com/levinKaus"><code>@levinKaus</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/911">authlib/authlib#911</a></li> <li><a href="https://github.com/aliaksei-protchanka"><code>@aliaksei-protchanka</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/770">authlib/authlib#770</a></li> <li><a href="https://github.com/vilmar-hillow"><code>@vilmar-hillow</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/476">authlib/authlib#476</a></li> <li><a href="https://github.com/arpitjain099"><code>@arpitjain099</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/908">authlib/authlib#908</a></li> <li><a href="https://github.com/RavSinghChandan"><code>@RavSinghChandan</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/919">authlib/authlib#919</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.7.2...v1.8.0">https://github.com/authlib/authlib/compare/v1.7.2...v1.8.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/1a86748b31a2b1940b09cf627d1b70e03d85c077"><code>1a86748</code></a> chore: release 1.8.0</li> <li><a href="https://github.com/authlib/authlib/commit/e4fb941d4959a11e875b34880c41f46ba7cd8c67"><code>e4fb941</code></a> Merge pull request <a href="https://redirect.github.com/authlib/authlib/issues/923">#923</a> from authlib/fix-921</li> <li><a href="https://github.com/authlib/authlib/commit/9f2cd2e4c8c2d88cd8c7831d2c612ad38a4b0958"><code>9f2cd2e</code></a> Merge pull request <a href="https://redirect.github.com/authlib/authlib/issues/922">#922</a> from authlib/fix-902</li> <li><a href="https://github.com/authlib/authlib/commit/5d53239e8a0ca7ea1c241e84bfd5fd453203a94a"><code>5d53239</code></a> fix(oidc): omit claims when the value is None</li> <li><a href="https://github.com/authlib/authlib/commit/772bc72fe8440e6c5dd0a6615fb42d7466f85546"><code>772bc72</code></a> Merge pull request <a href="https://redirect.github.com/authlib/authlib/issues/919">#919</a> from RavSinghChandan/fix-oauth1-insecure-transport-de...</li> <li><a href="https://github.com/authlib/authlib/commit/11794b00375127bbc4397e7ebd46e047c3935b64"><code>11794b0</code></a> Merge pull request <a href="https://redirect.github.com/authlib/authlib/issues/908">#908</a> from arpitjain099/chore/device-cred-authenticated-cli...</li> <li><a href="https://github.com/authlib/authlib/commit/13f2eb0589cec6df53c4e1146b11dc0cdd3012c7"><code>13f2eb0</code></a> fix(client): Added client_id parameter to AssertionClient (<a href="https://redirect.github.com/authlib/authlib/issues/476">#476</a>)</li> <li><a href="https://github.com/authlib/authlib/commit/dde5b7a8015904aba63dad76d7286aa431249783"><code>dde5b7a</code></a> fix(client): rollback</li> <li><a href="https://github.com/authlib/authlib/commit/e4aec8c5c1e333951f49ba6aa3fe7487c6fce670"><code>e4aec8c</code></a> fix(client): remove default= keyword from starlette client config.get calls (...</li> <li><a href="https://github.com/authlib/authlib/commit/62f41cc2f55c15e658f7a0d2bdcb23feeeb93410"><code>62f41cc</code></a> fix(client): httpx oauth1 binary form data (<a href="https://redirect.github.com/authlib/authlib/issues/779">#779</a>)</li> <li>Additional commits viewable in <a href="https://github.com/authlib/authlib/compare/v1.7.2...v1.8.0">compare view</a></li> </ul> </details> <br /> Updates `apprise` from 1.13.0 to 1.13.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/caronc/apprise/releases">apprise's releases</a>.</em></p> <blockquote> <h2>Release v1.13.1</h2> <h2>What's Changed</h2> <p>Just a small update to fix a small stability issue with Attachments under some circumstances and the few PR's made by others in one more small bundle.</p> <p><strong>Note:</strong> ⚠️ <strong>This will be the last version of Apprise v1.x</strong> (this time i mean it 😉 ) . Future releases will be under Apprise v2.x. Again, I strongly want to urge Developers: <em>please</em> make sure you pin your <code>projects.toml</code> or <code>requirements.txt</code> to <code>apprise >=1.0.0, <2.0.0</code>. v2.x will be awesome, but it WILL introduce breaking changes your software may need to adapt to. I will still continue supporting the v1.x branch should security issues arise for at year or two, but eventually v2.x would be the way to go.</p> <h3>📣 New Notification Services:</h3> <ul> <li>Add Signalgrid notification service plugin by <a href="https://github.com/signalgridco"><code>@signalgridco</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1710">caronc/apprise#1710</a></li> <li>Add Lauther notification support by <a href="https://github.com/csanadymiklos"><code>@csanadymiklos</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1715">caronc/apprise#1715</a></li> </ul> <h3>🐞 Bugfixes</h3> <ul> <li>Fixes Gento Linux issue with memory based attachment handling in <a href="https://redirect.github.com/caronc/apprise/pull/1709">caronc/apprise#1709</a> <ul> <li>☝️ This is the core reason for this minor update</li> </ul> </li> <li>Allow periods in Pingram API keys (JWT format) by <a href="https://github.com/lipusal"><code>@lipusal</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1714">caronc/apprise#1714</a></li> <li>fixes intermittent test failures for matrix in <a href="https://redirect.github.com/caronc/apprise/pull/1717">caronc/apprise#1717</a></li> </ul> <h3>💡 Features</h3> <p>n/a</p> <h3>❤️ Life-Cycle Support</h3> <ul> <li>Allow Py 3.13+, please by <a href="https://github.com/milos-korenciak"><code>@milos-korenciak</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1711">caronc/apprise#1711</a></li> <li>fix(matrix): typofix in label by <a href="https://github.com/arthurlutz"><code>@arthurlutz</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1707">caronc/apprise#1707</a></li> <li>docs: fix typo recomended -> recommended by <a href="https://github.com/vaibhav8a"><code>@vaibhav8a</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1716">caronc/apprise#1716</a></li> </ul> <h2>Installation</h2> <p>Apprise is available <a href="https://pypi.org/project/apprise/">on PyPI</a> through <em>pip</em>:</p> <pre lang="bash"><code># Install Apprise v1.13.1 from PyPI pip install apprise==1.13.1 </code></pre> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/arthurlutz"><code>@arthurlutz</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1707">caronc/apprise#1707</a></li> <li><a href="https://github.com/milos-korenciak"><code>@milos-korenciak</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1711">caronc/apprise#1711</a></li> <li><a href="https://github.com/vaibhav8a"><code>@vaibhav8a</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1716">caronc/apprise#1716</a></li> <li><a href="https://github.com/signalgridco"><code>@signalgridco</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1710">caronc/apprise#1710</a></li> <li><a href="https://github.com/csanadymiklos"><code>@csanadymiklos</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1715">caronc/apprise#1715</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/caronc/apprise/compare/v1.13.0...v1.13.1">https://github.com/caronc/apprise/compare/v1.13.0...v1.13.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/caronc/apprise/commit/cf4da87eab713370a62d7a4f9ca64dcd3bffdf61"><code>cf4da87</code></a> bumped version to v1.13.1</li> <li><a href="https://github.com/caronc/apprise/commit/0386b1cc093b3c55cfcebf4bdce17fc4309e0bd7"><code>0386b1c</code></a> Add Lauther notification support (<a href="https://redirect.github.com/caronc/apprise/issues/1715">#1715</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/3299eb37aa60ed729f935f039b79a9f9786e7424"><code>3299eb3</code></a> Add Signalgrid notification support (<a href="https://redirect.github.com/caronc/apprise/issues/1710">#1710</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/e05331ba9b5d2ace834b23e49728065ffebcb377"><code>e05331b</code></a> relaxed some noisy logging</li> <li><a href="https://github.com/caronc/apprise/commit/8f73f6a0cdb83e6187624715a12e8f36dd8a1bbc"><code>8f73f6a</code></a> Fixes intermittent test failures for matrix on py39 (<a href="https://redirect.github.com/caronc/apprise/issues/1717">#1717</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/0af1bb2097dad2557f55a523d09269341fa3fdfb"><code>0af1bb2</code></a> docs: fix typo recomended -> recommended (<a href="https://redirect.github.com/caronc/apprise/issues/1716">#1716</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/8df288a1824711bc6b1bdb59c1b5b356e4da3fd5"><code>8df288a</code></a> Allow periods in Pingram API keys (JWT format) (<a href="https://redirect.github.com/caronc/apprise/issues/1714">#1714</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/aa7221b7cabe757e000a1e6e019fc8f91ec517a0"><code>aa7221b</code></a> Allow Py 3.13+ (<a href="https://redirect.github.com/caronc/apprise/issues/1711">#1711</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/e93c9360c5ae2ed729a282bc454f6ceeb4abd9e1"><code>e93c936</code></a> Fixes Gento Linux issue with memory based attachment handling (<a href="https://redirect.github.com/caronc/apprise/issues/1709">#1709</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/4e6f4b117fa356f7ba0a076080c4927fcf78bc47"><code>4e6f4b1</code></a> typofix in matrix:// label (<a href="https://redirect.github.com/caronc/apprise/issues/1707">#1707</a>)</li> <li>See full diff in <a href="https://github.com/caronc/apprise/compare/v1.13.0...v1.13.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 CaliBrain
|
9452ebc70d |
fix(bypass): stop handing solvers DDoS-Guard's ?check=1 probe URL (#1300)
html_get_page follows Anna's Archive redirects by hand, and DDoS-Guard's gate answers /search with a 302 to the same path plus `check=1`. The follower walks that handshake by reassigning `current_url`, so every downstream handoff - the 403 branch, the 503-challenge branch, both redirect-loop rescues - passed the *probe* URL to the bypasser rather than the page we actually wanted. A solver opens that in a fresh browser holding none of the cookies the probe exists to collect, so DDoS-Guard cannot verify it automatically and serves the manual CAPTCHA page that nothing can solve. The #1292 log is exactly that: a 403 handed off on `&check=1`, FlareSolverr answering "Challenge solved!", and a 4721-byte DDOS-GUARD captcha page coming back. - `_solvable_url()` strips the probe parameter, applied at the single choke point in `_run_bypasser` so all four handoffs are covered. Scoped to the hosts whose redirects we follow manually; a URL without the parameter is returned by identity, so nothing else is re-encoded. The same reports showed three further defects, all of which stand whatever the host was reacting to: - The external bypasser logged that the solve had not cleared the protection and then returned the challenge page as a success. That skipped the one recovery left - get_bypassed_page's retry-and-rotate loop, where the next mirror is a different DDoS-Guard host - and filed the captcha page's own __ddg cookies as that host's clearance, to be replayed on every later request. It now raises ChallengeNotSolvedError before storing anything. - "Check that the bypasser is reachable and working" was the one piece of advice guaranteed to waste the reporter's time: it was reachable, it ran a full solve, and it returned a captcha. ChallengeNotSolvedError carries the marker so the search layer can name the host as the cause instead of the bypasser. - The untabled-page fingerprint logged `attempt_url`, which html_get_page has since rotated past. The #1298 bundle reported the page against annas-archive.gl when the body had come from .pk - the triage cost #1289 added the line to remove. The search now asks for the response URL and logs that. Its give-up shape is the tuple ("", url), which is truthy, so the exhaustion check reads the body rather than the response. Regression fixtures are built from the pages in the reports. The two behavioural handoff tests were checked against the unfixed code: both fail there, reproducing the reporter's log line verbatim. Refs #1292 Refs #1298v1.3.15 |
||
|
CaliBrain
|
d3f4ccd79a |
seleniumbase==4.53.5 (#1299)
replaces #1296 |
||
|
CaliBrain
|
cb690b45b8 |
fix(prowlarr): rank releases by author instead of querying for it (#1293) (#1295)
MyAnonamouse is the only indexer Shelfmark treats as enriched, and it
alone was sent {title} {author} while every other indexer got the title
on its own. MAM matches all search terms conjunctively, so whenever the
metadata provider spelled the author differently to the tracker -
Hardcover says Timothy Ferriss, MAM lists Tim Ferriss - the search came
back empty and the UI reported No releases found for this book, with the
release sitting on the tracker the whole time.
The enriched flag is a statement about responses: MAM returns clean
author and bookTitle attributes, which is why it earns format detection
and preferential ordering. Using that same flag to shape the request is
the actual defect, and it is why turning the flag off recovers the
search but takes format detection down with it.
So the query is title-only for every indexer now, and the author orders
the results rather than narrowing them. MAM already hands us its author
field, so agreement is judged on data we hold instead of by an AND we
cannot control. The ranking is three-way on purpose - agrees, no
metadata, disagrees - so an indexer reporting no author does not sort
below one reporting the wrong author.
A wrong verdict costs a release its position, never its visibility: a
transliteration such as Dostoevsky against Dostoyevsky sorts last
instead of vanishing. That is what makes the loose token comparison safe
to ship without a tuning knob.
Falling back to a title-only query on zero results was the alternative.
It only rescues total failure - if two of six editions happen to use the
provider's spelling, the search returns those two, no fallback fires,
and the user quietly gets a truncated list. It also spends a round trip
inside the search deadline and stacks a retry on an indexer that may
still be solving a challenge (#1249).
Manual queries skip author ranking: they are the user's own words and
should not be reordered against the metadata they were typed to
override.
v1.3.14
|
||
|
CaliBrain
|
3d7ea40088 |
fix(search): reach the server's deadline, query one author (#1285, #1252) (#1287)
Two independent reasons a working search reported failure to the user. 1. The client gave up before the server did (#1285) `/api/releases` bounds one release search with RELEASE_SEARCH_TIMEOUT (default 300s) and answers a spent budget with a sentence naming the real cause - the machinery added for #1276. The frontend then aborted the direct_download search at a hard-coded 180s, so it always won the race: the user saw "Request timed out. Check your network connection or proxy configuration." instead, and raising RELEASE_SEARCH_TIMEOUT changed nothing they could observe, the 180s being baked into the hashed bundle inside the image. - /api/config reports the effective (clamped) budget, and the client derives its abort from it plus a margin, so the server always answers first. - Direct-mode search shows what the server actually said. Every non-auth failure was relabelled "Unable to reach download source. Network may be restricted or mirrors blocked.", which discarded the explanation and blamed the user's network. ApiResponseError now carries `serverMessage`, set only when the server explained itself, so the status-line placeholder still falls back. Two latency fixes for the cost that made the timeout reachable at all: - Fetch each distinct AA search URL once per search. The language-filter retry re-runs every title variant, and with DIRECT_DOWNLOAD_LANGUAGE_FROM_PATH on both passes build a byte-identical URL - behind DDoS-Guard each repeat is a fresh browser solve. - Drop the solve-only bypass method. `_bypass_method_cdp_gui_click` opens with exactly that call and returns the moment it works, so the entry ahead of it could only repeat the half that had already failed, plus the backoff before the method that does work started. Reported at 0/19 successes and ~5.5s of each ~26s solve against DDoS-Guard. 2. The query carried every contributor, not one author (#1252) `_pick_search_author` returned `book.search_author` verbatim while the authors[] fallback beside it deliberately narrowed to the first name before a comma. Both fields routinely arrive holding every contributor joined with ", ": the frontend builds `book.author` as `authors.join(', ')` for display (bookTransformers.ts) and the release modal sends that display string straight back as the `author` parameter, and `browse_record_to_book_metadata` and the manual-search branch both split the joined text into `authors` while still passing the unsplit string as `search_author`, so the split was never used. A book whose metadata lists translators was therefore searched for as Blindness Jose Saramago, Giovanni Pontiero, <persian translator> which matches nothing on Anna's Archive. The bypass succeeds, the search comes back empty, and the user is told the book has no releases. Narrowed in one place, `search_plan.first_author`, so the two branches cannot drift apart again, and applied to the IRC source, which built its query with the same verbatim preference. Hardcover is unaffected: it already sets `search_author` from `_simplify_author_for_search(authors[0])`, which resolves "Last, First" itself and never yields a multi-author string. |
||
|
CaliBrain
|
633004ecf0 |
fix(search): stop reading real Anna's Archive pages as unsolved challenges (#1294)
`_looks_like_challenge_page` substring-matched "ddos-guard"/"cloudflare" over the whole document. DDoS-Guard-fronted sites carry those strings on their own pages - Anna's Archive ships a `DDOS-GUARD` comment in the inline JS it serves on every page - so every real AA response that was not a results table was reported as an unsolved protection challenge, sending users off to fix a bypasser that had just succeeded. Measured against live pages: a served AA page (HTTP 200) is 182,685 bytes and matched the old detector; the real interstitial is 902 bytes. - `_looks_like_challenge_page` now delegates to the shared `challenge_marker()`, whose 64 KB cap is what separates a few-KB interstitial from the page behind it. `download/http.py` already used it; this module carried an unguarded private copy. - `_looks_like_aa_page` is checked ahead of the challenge branch. A genuine interstitial carries no AA markers, so nothing actually blocked leaks through. Also adds the diagnostics whose absence made #1289 guesswork: the debug bundle carries no response bodies, so "unsolved protection challenge" and FlareSolverr's "Challenge solved!" were indistinguishable after the fact. - `_log_untabled_search_page()` fingerprints the one ambiguous shape at INFO - size, size-cap verdict, AA markers, challenge marker - with a bounded 700-char head at DEBUG. Best-effort: it swallows its own errors. - The external bypasser records what it actually returned, and warns when it reports success while handing back a challenge page. Regression tests use fixtures built from the live pages rather than invented ones; the previous fixtures were two-line synthetic pages with no "ddos-guard" substring, which is why nothing caught this. Closes #1289 Closes #1292 |
||
|
dependabot[bot]
|
c06b8ce8ef |
build(deps): bump the python-deps group with 3 updates (#1288)
Bumps the python-deps group with 3 updates: [seleniumbase](https://github.com/seleniumbase/SeleniumBase), [prek](https://github.com/j178/prek) and [ruff](https://github.com/astral-sh/ruff). Updates `seleniumbase` from 4.52.3 to 4.52.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.52.4 - Add Remote WebDriver Timeout setting</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/cf4af2a92414010ca49c5ba14e59cf73dc8badea">Add REMOTE_WEBDRIVER_TIMEOUT setting for Remote WebDriver HTTP requests</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Add REMOTE_WEBDRIVER_TIMEOUT setting for Remote WebDriver HTTP requests by <a href="https://github.com/TaylorMcGinnis"><code>@TaylorMcGinnis</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4473">seleniumbase/SeleniumBase#4473</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.52.3...v4.52.4">https://github.com/seleniumbase/SeleniumBase/compare/v4.52.3...v4.52.4</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/5879697828e55a6c6ef8f7436c01023e3af92108"><code>5879697</code></a> Version 4.52.4</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/2182f3c9ece14ac0cc1d4fdb4c24470e0e0ac63e"><code>2182f3c</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4473">#4473</a> from TaylorMcGinnis/remote-webdriver-timeout</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ffe06d572308b7cca77644dd22f7560dd3c4eda4"><code>ffe06d5</code></a> Update GitHub Actions</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/cf4af2a92414010ca49c5ba14e59cf73dc8badea"><code>cf4af2a</code></a> Add REMOTE_WEBDRIVER_TIMEOUT setting for Remote WebDriver HTTP requests</li> <li>See full diff in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.52.3...v4.52.4">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.4.14 to 0.5.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.5.0</h2> <h2>Release Notes</h2> <p>Released on 2026-08-27.</p> <h3>Highlights</h3> <h4>Choose where hook toolchains come from</h4> <p><code>language_version</code> now accepts a source <code>preference</code> alongside the version <code>request</code>, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use <code>managed</code> (the default) or <code>system</code> to choose which source prek tries first while still allowing fallback and downloads. Use <code>only-managed</code> or <code>only-system</code> to require one source.</p> <p>For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:</p> <pre lang="yaml"><code>repos: - repo: local hooks: - id: ruff name: ruff language: python entry: ruff check additional_dependencies: [ruff] language_version: request: "3.12" preference: only-managed </code></pre> <p>With <code>only-managed</code>, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from <code>PATH</code>, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.</p> <p>Existing scalar values such as <code>language_version: "3.12"</code> continue to work. See <a href="https://prek.j178.dev/0.5.0/languages/#toolchain-management-and-language_version">toolchain management and <code>language_version</code></a> for the full source-selection behavior. (<a href="https://redirect.github.com/j178/prek/pull/2613">#2613</a>)</p> <h3>Breaking changes</h3> <p>The breaking changes in this release are mostly small cleanups, and most users should not be affected.</p> <ul> <li>Group names can no longer start with <code>@</code>. This prefix is now reserved for special group selectors such as the new <code>@ungrouped</code> selector. (<a href="https://redirect.github.com/j178/prek/pull/2617">#2617</a>)</li> <li><code>PREK_MAX_CONCURRENCY</code> has been removed. Use <code>PREK_CONCURRENT_HOOKS</code> and <code>PREK_CONCURRENT_BATCHES</code> to control hook and per-hook batch concurrency separately. (<a href="https://redirect.github.com/j178/prek/pull/2620">#2620</a>)</li> <li>The top-level <code>prek init-template-dir</code> command has been removed. Use <code>prek util init-template-dir</code>, or <code>prek init-templatedir</code> for drop-in compatibility with <code>pre-commit</code>. (<a href="https://redirect.github.com/j178/prek/pull/2623">#2623</a>)</li> <li><code>prek auto-update</code> has been removed. Use <code>prek update</code>, or <code>prek autoupdate</code> for drop-in compatibility with <code>pre-commit</code>. (<a href="https://redirect.github.com/j178/prek/pull/2619">#2619</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/master/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.5.0</h2> <p>Released on 2026-08-27.</p> <h3>Highlights</h3> <h4>Choose where hook toolchains come from</h4> <p><code>language_version</code> now accepts a source <code>preference</code> alongside the version <code>request</code>, letting you control where prek looks for a compatible toolchain when it creates a hook environment. Use <code>managed</code> (the default) or <code>system</code> to choose which source prek tries first while still allowing fallback and downloads. Use <code>only-managed</code> or <code>only-system</code> to require one source.</p> <p>For example, this local Ruff hook requires a Python 3.12 toolchain managed by prek:</p> <pre lang="yaml"><code>repos: - repo: local hooks: - id: ruff name: ruff language: python entry: ruff check additional_dependencies: [ruff] language_version: request: "3.12" preference: only-managed </code></pre> <p>With <code>only-managed</code>, prek reuses a compatible toolchain from its managed store or downloads one when needed. It never falls back to Python from <code>PATH</code>, an OS package manager, or a version manager, so toolchain selection does not depend on the developer or CI machine's external environment.</p> <p>Existing scalar values such as <code>language_version: "3.12"</code> continue to work. See <a href="https://prek.j178.dev/0.5.0/languages/#toolchain-management-and-language_version">toolchain management and <code>language_version</code></a> for the full source-selection behavior. (<a href="https://redirect.github.com/j178/prek/pull/2613">#2613</a>)</p> <h3>Breaking changes</h3> <p>The breaking changes in this release are mostly small cleanups, and most users should not be affected.</p> <ul> <li>Group names can no longer start with <code>@</code>. This prefix is now reserved for special group selectors such as the new <code>@ungrouped</code> selector. (<a href="https://redirect.github.com/j178/prek/pull/2617">#2617</a>)</li> <li><code>PREK_MAX_CONCURRENCY</code> has been removed. Use <code>PREK_CONCURRENT_HOOKS</code> and <code>PREK_CONCURRENT_BATCHES</code> to control hook and per-hook batch concurrency separately. (<a href="https://redirect.github.com/j178/prek/pull/2620">#2620</a>)</li> <li>The top-level <code>prek init-template-dir</code> command has been removed. Use <code>prek util init-template-dir</code>, or <code>prek init-templatedir</code> for drop-in compatibility with <code>pre-commit</code>. (<a href="https://redirect.github.com/j178/prek/pull/2623">#2623</a>)</li> <li><code>prek auto-update</code> has been removed. Use <code>prek update</code>, or <code>prek autoupdate</code> for drop-in compatibility with <code>pre-commit</code>. (<a href="https://redirect.github.com/j178/prek/pull/2619">#2619</a>)</li> </ul> <h3>Enhancements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/67f85359486c57b0fc145ae948283713bf33bf94"><code>67f8535</code></a> Bump version to 0.5.0 (<a href="https://redirect.github.com/j178/prek/issues/2631">#2631</a>)</li> <li><a href="https://github.com/j178/prek/commit/4546befaacb22177be1a7590fb944cad0664ad73"><code>4546bef</code></a> Remove legacy <code>init-template-dir</code> command (<a href="https://redirect.github.com/j178/prek/issues/2623">#2623</a>)</li> <li><a href="https://github.com/j178/prek/commit/e63bd4be1ead8c09effeac5c451c5efd94e1f643"><code>e63bd4b</code></a> Remove hook marker schema 0 (<a href="https://redirect.github.com/j178/prek/issues/2622">#2622</a>)</li> <li><a href="https://github.com/j178/prek/commit/8c433ae73124cef61c390217e0163adbb6a17cd9"><code>8c433ae</code></a> Remove config-tracking cache bootstrap (<a href="https://redirect.github.com/j178/prek/issues/2621">#2621</a>)</li> <li><a href="https://github.com/j178/prek/commit/62ca460aea7d5e24ca27e79cd1128ab91ce396c1"><code>62ca460</code></a> Remove <code>PREK_MAX_CONCURRENCY</code> (<a href="https://redirect.github.com/j178/prek/issues/2620">#2620</a>)</li> <li><a href="https://github.com/j178/prek/commit/e2468eae017a0cb5e68fd54f96e6b66f5d6db598"><code>e2468ea</code></a> Remove legacy update aliases (<a href="https://redirect.github.com/j178/prek/issues/2619">#2619</a>)</li> <li><a href="https://github.com/j178/prek/commit/795c3a46b3c1b20a343a5fe8ec0d1b9fea79ade9"><code>795c3a4</code></a> Group run options in CLI help (<a href="https://redirect.github.com/j178/prek/issues/2629">#2629</a>)</li> <li><a href="https://github.com/j178/prek/commit/b27eb6edf4779994f4e484be605119291f858fc6"><code>b27eb6e</code></a> Document prek run architecture (<a href="https://redirect.github.com/j178/prek/issues/2630">#2630</a>)</li> <li><a href="https://github.com/j178/prek/commit/7dd9aa9149854bb0a37bde6ed64e3d1b42c46fdb"><code>7dd9aa9</code></a> Avoid persisting docs workflow credentials (<a href="https://redirect.github.com/j178/prek/issues/2627">#2627</a>)</li> <li><a href="https://github.com/j178/prek/commit/23815bdd83ce766e93647a98cfc091ec15b0d9ba"><code>23815bd</code></a> Remove the <code>@builtin</code> group selector (<a href="https://redirect.github.com/j178/prek/issues/2628">#2628</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.4.14...v0.5.0">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.4 to 0.16.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.5</h2> <h2>Release Notes</h2> <p>Released on 2026-08-27.</p> <h3>Preview features</h3> <ul> <li>Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28049">#28049</a>)</li> <li>Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27666">#27666</a>)</li> <li>Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/pull/27877">#27877</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-async</code>] Detect blocking generic HTTP requests (<code>ASYNC210</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28024">#28024</a>)</li> <li>[<code>flake8-datetimez</code>] Allow timezone-safe <code>strptime</code> chains (<code>DTZ007</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28023">#28023</a>)</li> <li>[<code>flake8-simplify</code>] Respect side effects in <code>lambda</code> defaults (<code>SIM401</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28000">#28000</a>)</li> </ul> <h3>Server</h3> <ul> <li>Fix duplicated "of" in <code>ClientOptions</code> doc comment (<a href="https://redirect.github.com/astral-sh/ruff/pull/27978">#27978</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/pull/27910">#27910</a>)</li> <li>Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27906">#27906</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/aarushkandukoori"><code>@aarushkandukoori</code></a></li> </ul> <h2>Install ruff 0.16.5</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.5/ruff-installer.ps1 | iex" </code></pre> <h2>Download ruff 0.16.5</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.5</h2> <p>Released on 2026-08-27.</p> <h3>Preview features</h3> <ul> <li>Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28049">#28049</a>)</li> <li>Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27666">#27666</a>)</li> <li>Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/pull/27877">#27877</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-async</code>] Detect blocking generic HTTP requests (<code>ASYNC210</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28024">#28024</a>)</li> <li>[<code>flake8-datetimez</code>] Allow timezone-safe <code>strptime</code> chains (<code>DTZ007</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28023">#28023</a>)</li> <li>[<code>flake8-simplify</code>] Respect side effects in <code>lambda</code> defaults (<code>SIM401</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28000">#28000</a>)</li> </ul> <h3>Server</h3> <ul> <li>Fix duplicated "of" in <code>ClientOptions</code> doc comment (<a href="https://redirect.github.com/astral-sh/ruff/pull/27978">#27978</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/pull/27910">#27910</a>)</li> <li>Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/pull/27906">#27906</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AlexWaygood"><code>@AlexWaygood</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/jelle-openai"><code>@jelle-openai</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/aarushkandukoori"><code>@aarushkandukoori</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/9e4938c4a60bed3e87a11ee1e1db1bd23f4d964a"><code>9e4938c</code></a> Bump 0.16.5 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28110">#28110</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/aad0e909ef1390f4b2a3ba8aa0a67fb8ea5cbacd"><code>aad0e90</code></a> Allow rules without codes (<a href="https://redirect.github.com/astral-sh/ruff/issues/28049">#28049</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/5fdab73c5052350400c36b08c5d7710210343bc4"><code>5fdab73</code></a> Update preview default rules and categories (<a href="https://redirect.github.com/astral-sh/ruff/issues/27877">#27877</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/29c8e5b2d0a46eb7dc4ff11c1b0a0dc5ccea52e4"><code>29c8e5b</code></a> Document rule acceptance guidelines (<a href="https://redirect.github.com/astral-sh/ruff/issues/27910">#27910</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/50a4d7fd106603a5616b01ac3bef3306252b248f"><code>50a4d7f</code></a> Document the new category selectors (<a href="https://redirect.github.com/astral-sh/ruff/issues/27906">#27906</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ada87950ea188f882f69b7bd6e2213a9696e3ee2"><code>ada8795</code></a> Introduce category selectors (<a href="https://redirect.github.com/astral-sh/ruff/issues/27666">#27666</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d8947238863b61922bfc83f07edcc697c1cc07c0"><code>d894723</code></a> [ty] Infer lambda parameters through callable type aliases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28109">#28109</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/2685fdebbcf9938736fed8c45886a629f9c99a06"><code>2685fde</code></a> [ty] Narrow functional enum members in <code>==</code> and <code>match</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28103">#28103</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/efcffd2178ce62e9951a53d4c50cadc225a0cfec"><code>efcffd2</code></a> [ty] Intersection simplifications with subtype-related generic specialization...</li> <li><a href="https://github.com/astral-sh/ruff/commit/eb780488037504e11f145ed778654fd8a825028b"><code>eb78048</code></a> [ty] Bump ecosystem-analyzer for HTML escaping (<a href="https://redirect.github.com/astral-sh/ruff/issues/28104">#28104</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.4...0.16.5">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 Nicholas Velten
|
69ff0d6a78 |
fix: trim a credit list in search_author to the first name (#1290)
Fixes #1252 for the case in the second report. `_pick_search_author` returns `search_author` untouched but trims `authors[0]` to its first comma-separated name. So the same credit list searches differently depending on which field carries it: ``` via authors[0] -> "Blindness Jose Saramago" via search_author -> "Blindness Jose Saramago, Giovanni Pontiero, Zohreh Eftekhari" ``` Anna's Archive answers the second one with nothing. That is the query in @theDoz12's log, and it explains the shape of the report: the bypass succeeds, the search runs, and the UI still says no releases. Nothing in the download path is broken, the query simply cannot match. Measured against live AA on 1.3.14, same book, same source, only the field carrying the author changed: | query | releases | | --- | --- | | `Blindness Jose Saramago, Giovanni Pontiero, Zohreh Eftekhari` | 0 | | `Blindness Jose Saramago` | 49 | | `Blindness` | 50 | With the patch the second form is produced from either field, and the same search returns 49. Three regression tests added, including one that asserts both fields yield the same query. On `tests/core/test_search_plan.py` the run goes from 5 failures to 3; the 3 that remain are the language tests, which fail identically with and without this change on my machine. Worth saying what this does not cover: the first report in that issue ends with `Found 2 releases via ISBN` and still shows nothing, so that one is a different fault further along. I could not reproduce it here. |
||
 Nathan H
|
3937ae119b |
feat(homepage): Always show controls (#1269)
I found using the main search menu frustrating. Often times, I would type in what I want, then select the category, only for it to get erased. And the menu closing over and over was distracting. So this PR makes the buttons stick around permanently and it removes the search field text changing with each button press. Obviously, this is just what I want, but I figured I'd at least put a PR up for it. <img width="1017" height="423" alt="image" src="https://github.com/user-attachments/assets/7b84fd69-d6d3-4749-842f-e04a6e792ccc" /> <img width="682" height="418" alt="image" src="https://github.com/user-attachments/assets/82a251ee-cb4a-488f-b1ba-45fb2bb6714d" /> |
||
|
Jorge Lima
|
d7fe28595c |
fix(bypass): wait for the solved page before reading its source (#1286)
Follow-up to #1276 with a measurement from the instance I reported there. v1.3.13 solves the challenge again, but on my setup the solve was being thrown away immediately afterwards: ``` 19:26:08 Bypass successful using _bypass_method_cdp_gui_click 19:26:16 Bypass failed (attempt 1/10): TimeoutError: Time ran out while waiting for: {html} ``` `_get()` ends with `return await page.get_page_source()`, which is `find("html", timeout=1)` in SeleniumBase. One second is enough for a page that is already sitting on its content, but Anna's Archive answers a cleared check with a redirect to the real page, so the document is not there yet. The solve is discarded, the whole attempt restarts, and the extra requests are what earn the 429 that `note_rate_limited()` then parks the host for — 120 s, then 300 s. ## Change `_read_page_source()` waits for the document itself, with a `BYPASS_PAGE_SOURCE_TIMEOUT` setting (default 20 s, min 1, max 120) in Direct Download → Cloudflare Bypass, next to the existing bypasser timeouts. ## Measured on a live instance I patched the wait in the running container (`find("html", timeout=1)` → `timeout=20` in the installed seleniumbase, which is the same effect as this PR) and re-ran the same searches on the same host, k3s behind a Surfshark WireGuard exit, internal bypasser, v1.3.13: | | 1 s wait | 20 s wait | |---|---|---| | `Time ran out while waiting for: {html}` | one per solve | none | | 429 backoffs | 2 (120 s, then 300 s) | none | | Search for a book AA has | 199 s and 200 s, both errored | 61 s, 2 epub releases | A download after that took 5 s from LibGen, so the search was the whole cost. ## Tests Two tests in `tests/bypass/test_bypass_budgets.py`, the file already covering #1276: a page that needs longer than a second still yields its HTML, and `BYPASS_PAGE_SOURCE_TIMEOUT` overrides the default. `uv run pytest tests/ --ignore=tests/e2e`: 2848 passed, 47 skipped. Ruff check and format clean. The docs table is auto-generated, but running `scripts/generate_env_docs.py` here rewrote unrelated entries (Newznab, BOOK_LANGUAGE), so I added only the new entry by hand in the generator's format rather than commit that churn. One thing I could not judge from outside: whether 20 s is the right default for hosts other than AA. It only costs anything when a solve would otherwise be discarded, but I have measured it on one site. |
||
|
dependabot[bot]
|
68c0e83330 |
build(deps): bump the python-deps group with 2 updates (#1277)
Bumps the python-deps group with 2 updates: [gunicorn](https://github.com/benoitc/gunicorn) and [seleniumbase](https://github.com/seleniumbase/SeleniumBase). Updates `gunicorn` from 26.1.0 to 26.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/benoitc/gunicorn/releases">gunicorn's releases</a>.</em></p> <blockquote> <h2>gunicorn 26.2.0</h2> <p>Cleartext HTTP/2 lands, and an HTTP/2 security fix.</p> <h2>Cleartext HTTP/2 (h2c)</h2> <p><code>http2_cleartext</code> accepts <code>prior-knowledge</code>, <code>upgrade</code>, <code>both</code> or <code>off</code> (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; <code>upgrade</code> honours an HTTP/1.1 <code>Upgrade: h2c</code> request. Both work on the gthread, gevent and asgi workers.</p> <p>This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in <code>forwarded_allow_ips</code> are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.</p> <p>Do not expose a cleartext HTTP/2 port to the internet.</p> <h2>Security</h2> <p><code>HTTP2Request</code> built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and <code>header_map</code> policy, duplicate <code>Host</code> and <code>Content-Type</code>, control characters in values, and the <code>forwarded_allow_ips</code> trust gate. An untrusted client could set <code>SCRIPT_NAME</code> and forge <code>HTTP_*</code> entries in the WSGI environ, and decide <code>wsgi.url_scheme</code> through <code>:scheme</code>. Both request classes now share one policy mixin, and the scheme comes from the transport.</p> <p>If you serve HTTP/2, this is the reason to upgrade.</p> <h2>Other HTTP/2 fixes</h2> <p>WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. <code>sendfile()</code> is refused on HTTP/2 responses rather than bypassing framing.</p> <h2>Request bodies dropped on Upgrade requests</h2> <p>On the ASGI worker with the fast parser, any request carrying an <code>Upgrade</code> header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in <code>gunicorn_h1c</code> 0.6.9, which the <code>fast</code> extra now requires.</p> <p>Full changelog: <a href="https://gunicorn.org/news/">https://gunicorn.org/news/</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/benoitc/gunicorn/commit/36f2a3c1b80dfa41d70859d12c5bfbbdc23a3c38"><code>36f2a3c</code></a> gunicorn 26.2.0</li> <li><a href="https://github.com/benoitc/gunicorn/commit/cbba3505f423bfb91af3a87e49ed9d232f39a8fe"><code>cbba350</code></a> test: cover the h2c edge paths that had none</li> <li><a href="https://github.com/benoitc/gunicorn/commit/988541112ebcf3f795c020fc394aa7eed75f9f53"><code>9885411</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3703">#3703</a> from cormier/fix-inconsistency-in-control-socket-docs</li> <li><a href="https://github.com/benoitc/gunicorn/commit/86f0919806a2d4d4cce376cc2088352e7643b139"><code>86f0919</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3704">#3704</a> from methane/doc-wsgi-h1c</li> <li><a href="https://github.com/benoitc/gunicorn/commit/585355122efe736946b977c5605e404ff2d6ddd4"><code>5853551</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3712">#3712</a> from Rotzbua/patch-1</li> <li><a href="https://github.com/benoitc/gunicorn/commit/7bce87e2aa29a4a794eb2b113ff811cad6a80736"><code>7bce87e</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3700">#3700</a> from benoitc/fix/sponsor-logo-path</li> <li><a href="https://github.com/benoitc/gunicorn/commit/972dfb03b110c430712c32a3d92ef6397ff8eff6"><code>972dfb0</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3690">#3690</a> from melbinjp/docs/contributing-settings-path</li> <li><a href="https://github.com/benoitc/gunicorn/commit/7b3f16be8d9cc051538b7f0b58b236b37c9550f8"><code>7b3f16b</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3711">#3711</a> from benoitc/docs/http2-changelog</li> <li><a href="https://github.com/benoitc/gunicorn/commit/5bf237c0c7ef5bcdc63046645a17d6bafd609a34"><code>5bf237c</code></a> http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround</li> <li><a href="https://github.com/benoitc/gunicorn/commit/7cf03385c574228e28c4952fd410ed2df02acc94"><code>7cf0338</code></a> test: skip the fast-parser cases when gunicorn_h1c is absent</li> <li>Additional commits viewable in <a href="https://github.com/benoitc/gunicorn/compare/26.1.0...26.2.0">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.52.2 to 4.52.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.52.3 - MCP Server: Patch 1</h2> <h2>MCP Server: Patch 1</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/9bdc1133d096562111d3cc6465c6b0cd5dbfc38d">Fix the MCP Server on Python versions less than 3.14</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4471">seleniumbase/SeleniumBase#4471</a> --> (Due to this bug, the MCP Server only worked on Python 3.14+) --> (Caused by a missing line: <code>from __future__ import annotations</code>)</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0e14a09f2d2f2e62a85bacc890b1d9d48b9a0c79">Update logging messages</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/1584e5b1b83f7177c59810817942150d1ed3ecab">Update the docs for MCP servers</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/213580314cb106bcb14d857289eb494395f491ae">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/405c7c68599108fc99d1cf929e01b17d2c62cd7a">Update examples</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 1 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4472">seleniumbase/SeleniumBase#4472</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.52.2...v4.52.3">https://github.com/seleniumbase/SeleniumBase/compare/v4.52.2...v4.52.3</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/9112244cfada5d002f3d08c6dbf2a68d34598c51"><code>9112244</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4472">#4472</a> from seleniumbase/mcp-server-patch-1</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/bf1abf63240338b9ee58f4dc6e907e627411c27b"><code>bf1abf6</code></a> Version 4.52.3</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/405c7c68599108fc99d1cf929e01b17d2c62cd7a"><code>405c7c6</code></a> Update examples</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/213580314cb106bcb14d857289eb494395f491ae"><code>2135803</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/1584e5b1b83f7177c59810817942150d1ed3ecab"><code>1584e5b</code></a> Update the docs for MCP servers</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0e14a09f2d2f2e62a85bacc890b1d9d48b9a0c79"><code>0e14a09</code></a> Update logging messages</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/9bdc1133d096562111d3cc6465c6b0cd5dbfc38d"><code>9bdc113</code></a> Fix the MCP Server on Python versions less than 3.14</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/cbd624a8697c763d7d68f3e92dcd31f4636ae9d8"><code>cbd624a</code></a> Update the docs</li> <li>See full diff in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.52.2...v4.52.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
faaa119884 |
build(deps): bump python from ce40764 to cae66f2 (#1278)
Bumps python from `ce40764` to `cae66f2`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
be41a92436 |
build(deps-dev): bump the npm-deps group in /src/frontend with 7 updates (#1279)
Bumps the npm-deps group in /src/frontend with 7 updates: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.5` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.0` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.63.0` | `0.65.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.80.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `@types/node` from 26.2.0 to 26.3.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `@types/react-dom` from 19.2.4 to 19.2.5 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom">compare view</a></li> </ul> </details> <br /> Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/releases">@vitejs/plugin-react's releases</a>.</em></p> <blockquote> <h2>plugin-react@6.1.0</h2> <h3>Add experimental native React Compiler support (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1419">#1419</a>)</h3> <p>Add experimental native React Compiler support.</p> <p>You can use it by installing <code>oxc-transform-react</code> and enabling it via the <code>compiler</code> option:</p> <pre lang="sh"><code>npm install -D oxc-transform-react </code></pre> <pre lang="js"><code>import { defineConfig } from 'vite' import react from '@vitejs/plugin-react' <p>export default defineConfig({<br /> plugins: [<br /> react({ compiler: true })<br /> ]<br /> })<br /> </code></pre></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md">@vitejs/plugin-react's changelog</a>.</em></p> <blockquote> <h2>6.1.0 (2026-08-19)</h2> <h3>Add experimental native React Compiler support (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1419">#1419</a>)</h3> <p>Add experimental native React Compiler support.</p> <p>You can use it by installing <code>oxc-transform-react</code> and enabling it via the <code>compiler</code> option:</p> <pre lang="sh"><code>npm install -D oxc-transform-react </code></pre> <pre lang="js"><code>import { defineConfig } from 'vite' import react from '@vitejs/plugin-react' <p>export default defineConfig({<br /> plugins: [<br /> react({ compiler: true })<br /> ]<br /> })<br /> </code></pre></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/39b31735bf79c2dd380eedaba7ed849256f92a29"><code>39b3173</code></a> release: plugin-react@6.1.0 (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1428">#1428</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/f1340b0c760b1c16e1b780eeba46fd933ddd52eb"><code>f1340b0</code></a> feat(react): add native React Compiler support (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1419">#1419</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/9ab698eafc38ffa14861db450291ed2f6f557557"><code>9ab698e</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1375">#1375</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react">compare view</a></li> </ul> </details> <br /> Updates `oxfmt` from 0.63.0 to 0.65.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/97e99b85483776a72928d675cc05b1cfc1130ba0"><code>97e99b8</code></a> release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26045">#26045</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/0db127cc16d28b97d84bac4ebeb302caf1a78c7e"><code>0db127c</code></a> release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25866">#25866</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/c07fe7c217774fd404740d34ee91ac03a6b726c2"><code>c07fe7c</code></a> feat(oxfmt): support <code>experimentalOperatorPosition</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25643">#25643</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/fed6681edaf3b9b45fbcc8fd7f987c86505d0b86"><code>fed6681</code></a> docs(oxfmt): skip expanding overrides options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25572">#25572</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.65.0/npm/oxfmt">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.78.0 to 1.80.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxlint's releases</a>.</em></p> <blockquote> <h2>oxlint v1.80.0 & oxfmt v0.65.0</h2> <h2>Table of Contents</h2> <ul> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/blob/HEAD/#oxlint-v1.80.0">Oxlint v1.80.0</a></li> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/blob/HEAD/#oxfmt-v0.65.0">Oxfmt v0.65.0</a></li> </ul> <h2>Oxlint v1.80.0</h2> <h3>🚀 Features</h3> <ul> <li>70c3e35 linter/typescript/no-confusing-non-null-assertion: Implement suggestion (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26012">#26012</a>) (Mikhail Baev)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>17ae11c linter/oxc/double-comparisons: Handle grouped logical expressions (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26044">#26044</a>) (camc314)</li> <li>8a353a7 linter/eslint/no-control-regex: Refine help message text (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25996">#25996</a>) (Rahul Mishra)</li> <li>8a9bdbd estree: Include decorators in <code>FormalParameterRest </code> spans (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26021">#26021</a>) (camc314)</li> <li>8d94cd1 linter/eslint/no-useless-rename: Preserve type modifiers (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26020">#26020</a>) (Cameron)</li> <li>2cde1f6 rust: Address nightly deprecations (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25998">#25998</a>) (Boshen)</li> <li>51d36d7 linter/vue: Resolve <code>vue</code> imports via shared import helpers (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25903">#25903</a>) (Connor Shea)</li> <li>83a68d2 linter/react/no-react-children: Resolve <code>react</code> imports by symbol (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25901">#25901</a>) (Connor Shea)</li> <li>124e196 linter: Resolve globals by reference, not by name (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25905">#25905</a>) (Connor Shea)</li> <li>a701bcc linter: Remove invalid React compiler doc links (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25900">#25900</a>) (Boshen)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>9b7e153 linter: Set <code>version</code> to 1.79.0 for rules shipped in 1.79.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25902">#25902</a>) (connorshea)</li> </ul> <h2>Oxfmt v0.65.0</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>bf37dd5 formatter: Preserve class decorators before export when the statement is suppressed (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26034">#26034</a>) (leaysgur)</li> </ul> <h2>oxlint v1.79.0 & oxfmt v0.64.0</h2> <h2>Table of Contents</h2> <ul> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/blob/HEAD/#oxlint-v1.79.0">Oxlint v1.79.0</a></li> <li><a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/blob/HEAD/#oxfmt-v0.64.0">Oxfmt v0.64.0</a></li> </ul> <h2>Oxlint v1.79.0</h2> <h3>💥 BREAKING CHANGES</h3> <ul> <li>8c4552d linter: [<strong>BREAKING</strong>] Split react/react-compiler into per-category rules (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25500">#25500</a>) (Boshen)</li> </ul> <p>See <a href="https://oxc.rs/blog/2026-08-18-react-compiler-support">React Compiler Support</a> for details.</p> <h3>🚀 Features</h3> <ul> <li>9b7394e linter/typescript/no-empty-object-type: Implement suggestion (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25833">#25833</a>) (Mikhail Baev)</li> </ul> <h3>🐛 Bug Fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this package will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.0.0">Keep a Changelog</a>.</p> <h2>[1.79.0] - 2026-08-18</h2> <h3>💥 BREAKING CHANGES</h3> <ul> <li>8c4552d linter: [<strong>BREAKING</strong>] Split react/react-compiler into per-category rules (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25500">#25500</a>) (Boshen)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>228e8e0 linter: Resolve inactive React compiler rules (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25830">#25830</a>) (Boshen)</li> <li>aa49d86 linter: Allow spread rule options in config types (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25675">#25675</a>) (ch3rry)</li> <li>36f8451 linter/eslint/no-eval: Align indirect default with ESLint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25656">#25656</a>) (camc314)</li> <li>beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25663">#25663</a>) (camc314)</li> <li>4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25660">#25660</a>) (camc314)</li> <li>285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25611">#25611</a>) (Mikhail Baev)</li> <li>4df5835 linter: Allow capitalized built-in calls (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25516">#25516</a>) (Boshen)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/97e99b85483776a72928d675cc05b1cfc1130ba0"><code>97e99b8</code></a> release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26045">#26045</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/0db127cc16d28b97d84bac4ebeb302caf1a78c7e"><code>0db127c</code></a> release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25866">#25866</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/228e8e0f85c0e7aeded02c5e27fd810004d3b41a"><code>228e8e0</code></a> fix(linter): resolve inactive React compiler rules (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25830">#25830</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/aa49d860465e6c00b6edfcbb8973d8dc95cc11ca"><code>aa49d86</code></a> fix(linter): allow spread rule options in config types (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25675">#25675</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/892238149b7c4dff808817ec5e27d1e0ecf63b11"><code>8922381</code></a> refactor(linter): remove inactive react config rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25740">#25740</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/8c4552dfa6bce0a9f06f41ca13e45e50d842c38c"><code>8c4552d</code></a> feat(linter)!: split react/react-compiler into per-category rules (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25500">#25500</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/36f845168ce854c1c970fea13997e16a18cbe55f"><code>36f8451</code></a> fix(linter/eslint/no-eval): align indirect default with ESLint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25656">#25656</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/beb724dce2e8b8466d851c04e16c38fa75623c5c"><code>beb724d</code></a> fix(linter/eslint/no-unused-vars): report bare underscore parameters (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25663">#25663</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/4004c101ca349f8e92932f6d056b18bfb4dff9a7"><code>4004c10</code></a> fix(linter/eslint/no-irregular-whitespace): check comments by default (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25660">#25660</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/285820eed6c49a45f8de18d3bfed1cc6b5d9da6d"><code>285820e</code></a> fix(linter/no-large-snapshots): precompile and document allowed snapshot matc...</li> <li>Additional commits viewable in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.80.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Updates `vite` from 8.2.1 to 8.2.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>plugin-legacy@8.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.2/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.2</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.2/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.2.1...v8.2.2">8.2.2</a> (2026-08-20)<!-- raw HTML omitted --></h2> <h3>Features</h3> <ul> <li><strong>deps:</strong> widen <code>@vitejs/devtools</code> peer range to v0.5.0 (<a href="https://redirect.github.com/vitejs/vite/issues/23302">#23302</a>) (<a href="https://github.com/vitejs/vite/commit/495d9ff5a7d843ca876a9e49799947a5deb704c7">495d9ff</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>bundled-dev:</strong> handle lazy request error (<a href="https://redirect.github.com/vitejs/vite/issues/23291">#23291</a>) (<a href="https://github.com/vitejs/vite/commit/3ba026dade4af56df08815310d3458fa110f5c5c">3ba026d</a>)</li> <li><strong>bundled-dev:</strong> hot update through circular imports instead of reloading (<a href="https://redirect.github.com/vitejs/vite/issues/23259">#23259</a>) (<a href="https://github.com/vitejs/vite/commit/3dbddefaafc091a879b06f9279296f776691e455">3dbddef</a>)</li> <li><strong>config:</strong> resolve sourcemap paths against sourcemap location (<a href="https://redirect.github.com/vitejs/vite/issues/23239">#23239</a>) (<a href="https://github.com/vitejs/vite/commit/05a003e6a17a84d75f907ea0f1598bc39b8dce6c">05a003e</a>)</li> <li><strong>css:</strong> don't pass empty targets to lightningcss (<a href="https://redirect.github.com/vitejs/vite/issues/23295">#23295</a>) (<a href="https://github.com/vitejs/vite/commit/2804636ff608d105928009d274ffba7cfbe55340">2804636</a>)</li> <li><strong>define:</strong> fix match escaped dots to support $-prefixed define keys (<a href="https://redirect.github.com/vitejs/vite/issues/23249">#23249</a>) (<a href="https://github.com/vitejs/vite/commit/dcf88bd2ad2b1a8845f9029587cc8c825e382d42">dcf88bd</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23217">#23217</a>) (<a href="https://github.com/vitejs/vite/commit/ba958bddfc9cabe302c6b34269dcf5c9634531e0">ba958bd</a>)</li> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23218">#23218</a>) (<a href="https://github.com/vitejs/vite/commit/83ecb2c8059e8ce946a7cc835d4c14ef78aef4fd">83ecb2c</a>)</li> <li><strong>module-runner:</strong> exclude completed modules from in-flight cycle detection (fix <a href="https://redirect.github.com/vitejs/vite/issues/22999">#22999</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23009">#23009</a>) (<a href="https://github.com/vitejs/vite/commit/d9b10a98db1c293ee64300bd75d568b44c8ae931">d9b10a9</a>)</li> <li><strong>optimizer:</strong> close custom extension analysis bundles (<a href="https://redirect.github.com/vitejs/vite/issues/23207">#23207</a>) (<a href="https://github.com/vitejs/vite/commit/8fb76752836f61224d3095b502fa237b478a06b2">8fb7675</a>)</li> <li>reduce Windows 8.3-short-name detection false-positives (<a href="https://redirect.github.com/vitejs/vite/issues/23066">#23066</a>) (<a href="https://github.com/vitejs/vite/commit/02cffa9e2d38d5d8f12e4043ee9d0f7abb1471e2">02cffa9</a>)</li> <li>respect <code>resolve.preserveSymlinks</code> when resolving root (fix <a href="https://redirect.github.com/vitejs/vite/issues/23197">#23197</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23198">#23198</a>) (<a href="https://github.com/vitejs/vite/commit/8413052731836d4aaf3eb94a0f25788dd35d2888">8413052</a>)</li> <li><strong>ssr:</strong> rewrite computed key of destructing parameter (<a href="https://redirect.github.com/vitejs/vite/issues/23307">#23307</a>) (<a href="https://github.com/vitejs/vite/commit/9db0b61d4c9c7caad7ea1d9670b637faf2bb6c93">9db0b61</a>)</li> <li><strong>vite:</strong> update outdated upstream file links in license comments (<a href="https://redirect.github.com/vitejs/vite/issues/23285">#23285</a>) (<a href="https://github.com/vitejs/vite/commit/c0f2fc607ee97ee4499337b04826420c00654065">c0f2fc6</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>build:</strong> note cssTarget precedence (<a href="https://redirect.github.com/vitejs/vite/issues/23200">#23200</a>) (<a href="https://github.com/vitejs/vite/commit/a20a35ec0685e374519864d0f41dd5f6e9ba0271">a20a35e</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li>fix ts errors in build test cases (<a href="https://redirect.github.com/vitejs/vite/issues/23209">#23209</a>) (<a href="https://github.com/vitejs/vite/commit/a0cfcf72f8ef8bf0f2f11d553333b9bb31f1d316">a0cfcf7</a>)</li> </ul> <h3>Code Refactoring</h3> <ul> <li>use JSON import attributes instead of readFileSync in constants (<a href="https://redirect.github.com/vitejs/vite/issues/23258">#23258</a>) (<a href="https://github.com/vitejs/vite/commit/1d9fa392a43229241f80630236f8552ce8f7cd0f">1d9fa39</a>)</li> <li>use named regex constants over inline literals (<a href="https://redirect.github.com/vitejs/vite/issues/22964">#22964</a>) (<a href="https://github.com/vitejs/vite/commit/5c1c6c609718303202832f706884192e1f1e9223">5c1c6c6</a>)</li> </ul> <h3>Tests</h3> <ul> <li><strong>define:</strong> close rolldown bundler after generate (<a href="https://redirect.github.com/vitejs/vite/issues/23231">#23231</a>) (<a href="https://github.com/vitejs/vite/commit/b4d66fee14d970f45b8a6f3d7d6aee73ca9b88ab">b4d66fe</a>)</li> <li><strong>module-runner:</strong> add TLA circular import case (<a href="https://redirect.github.com/vitejs/vite/issues/23299">#23299</a>) (<a href="https://github.com/vitejs/vite/commit/4a261f242831bef92afd2f1aacfb81eab9dec371">4a261f2</a>)</li> <li><strong>module-runner:</strong> simplify server-hmr tests (<a href="https://redirect.github.com/vitejs/vite/issues/23300">#23300</a>) (<a href="https://github.com/vitejs/vite/commit/599b44b6600ec426e10cd556908d53b027b0c4fb">599b44b</a>)</li> <li><strong>ssr:</strong> add destructing assignment case for moduleRunnerTransform (<a href="https://redirect.github.com/vitejs/vite/issues/23308">#23308</a>) (<a href="https://github.com/vitejs/vite/commit/cb77e2a93bad2a8ece00b4aa0ef507c092582c45">cb77e2a</a>)</li> </ul> <h3>Build System</h3> <ul> <li>use JSON import attributes instead of readFIleSync in rolldown configs (<a href="https://redirect.github.com/vitejs/vite/issues/23251">#23251</a>) (<a href="https://github.com/vitejs/vite/commit/d615bcdb23d96c1ca5ce1ee45e21d8d87381106f">d615bcd</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/de1111ab0be00879b404e7ed3b2a80e264edddc1"><code>de1111a</code></a> release: v8.2.2</li> <li><a href="https://github.com/vitejs/vite/commit/cb77e2a93bad2a8ece00b4aa0ef507c092582c45"><code>cb77e2a</code></a> test(ssr): add destructing assignment case for moduleRunnerTransform (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23308">#23308</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/9db0b61d4c9c7caad7ea1d9670b637faf2bb6c93"><code>9db0b61</code></a> fix(ssr): rewrite computed key of destructing parameter (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23307">#23307</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/8413052731836d4aaf3eb94a0f25788dd35d2888"><code>8413052</code></a> fix: respect <code>resolve.preserveSymlinks</code> when resolving root (fix <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23197">#23197</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23">#23</a>...</li> <li><a href="https://github.com/vitejs/vite/commit/05a003e6a17a84d75f907ea0f1598bc39b8dce6c"><code>05a003e</code></a> fix(config): resolve sourcemap paths against sourcemap location (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23239">#23239</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/495d9ff5a7d843ca876a9e49799947a5deb704c7"><code>495d9ff</code></a> feat(deps): widen <code>@vitejs/devtools</code> peer range to v0.5.0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23302">#23302</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/1d9fa392a43229241f80630236f8552ce8f7cd0f"><code>1d9fa39</code></a> refactor: use JSON import attributes instead of readFileSync in constants (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/2">#2</a>...</li> <li><a href="https://github.com/vitejs/vite/commit/2804636ff608d105928009d274ffba7cfbe55340"><code>2804636</code></a> fix(css): don't pass empty targets to lightningcss (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23295">#23295</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/599b44b6600ec426e10cd556908d53b027b0c4fb"><code>599b44b</code></a> test(module-runner): simplify server-hmr tests (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23300">#23300</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/4a261f242831bef92afd2f1aacfb81eab9dec371"><code>4a261f2</code></a> test(module-runner): add TLA circular import case (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23299">#23299</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v8.2.2/packages/vite">compare view</a></li> </ul> </details> <br /> Updates `vitest` from 4.1.10 to 4.1.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v4.1.11</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li>Revive global concurrency limit for test lifecycle [backport to v4] - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> and <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10992">vitest-dev/vitest#10992</a> <a href="https://github.com/vitest-dev/vitest/commit/5146df80b"><!-- raw HTML omitted -->(5146d)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: <ul> <li>Encode iframeId in tester iframe URL [backport to v4] - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a>, <strong>Pduhard</strong> and <strong>Claude Opus 4.8</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10955">vitest-dev/vitest#10955</a> <a href="https://github.com/vitest-dev/vitest/commit/10b2cd201"><!-- raw HTML omitted -->(10b2c)<!-- raw HTML omitted --></a></li> <li>Trigger playwright/chromium gc on lower disk availability [backport to v4] - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10951">vitest-dev/vitest#10951</a> <a href="https://github.com/vitest-dev/vitest/commit/9851dbc41"><!-- raw HTML omitted -->(9851d)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Restrict redirect mocks to the fs allowlist [backport to v4] - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10974">vitest-dev/vitest#10974</a> <a href="https://github.com/vitest-dev/vitest/commit/fe5a11d3c"><!-- raw HTML omitted -->(fe5a1)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v4.1.10...v4.1.11">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/9bd8d464e6328c567c2dbcd8fdd977d57a9425c2"><code>9bd8d46</code></a> chore: release v4.1.11 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10995">#10995</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/9851dbc41c286a30abfb6b29cce65f3e5b7b40a1"><code>9851dbc</code></a> fix(browser): trigger playwright/chromium gc on lower disk availability [back...</li> <li>See full diff in <a href="https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
7de9319c7a |
build(deps): bump the gh-actions group with 3 updates (#1280)
Bumps the gh-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.7 to 4.37.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.8</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"><code>db488dd</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4102">#4102</a> from github/update-v4.37.8-9ee088e13</li> <li><a href="https://github.com/github/codeql-action/commit/1845f5ba8b4057590f49ee8e246c95ef2ba4b53f"><code>1845f5b</code></a> Update changelog for v4.37.8</li> <li><a href="https://github.com/github/codeql-action/commit/9ee088e13615f8d1eaef4766f9dde95d3356a8f6"><code>9ee088e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4080">#4080</a> from github/henrymercer/studious-giggle</li> <li><a href="https://github.com/github/codeql-action/commit/1aef003397c876c0ab5bd118e1b1f34c175622e9"><code>1aef003</code></a> Address review feedback on overlay disk flags</li> <li><a href="https://github.com/github/codeql-action/commit/508b83bc415e8df76ce8ea08c0cf42c2529ebc63"><code>508b83b</code></a> Merge main into overlay minimum disk feature branch</li> <li><a href="https://github.com/github/codeql-action/commit/d97b3428e8eebbb1810cf454d6397886d136b4ba"><code>d97b342</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4098">#4098</a> from github/mbg/permission-error-as-configuration-error</li> <li><a href="https://github.com/github/codeql-action/commit/47fa6222231b12097f83215dd7a6b4a0915841fd"><code>47fa622</code></a> Make <code>EACCES</code> a <code>ConfigurationError</code></li> <li><a href="https://github.com/github/codeql-action/commit/45693cc6882bb175b58a06818c91876e201037c7"><code>45693cc</code></a> Refactor <code>ENOSPC</code> check into <code>isDiskConfigurationError</code> function</li> <li><a href="https://github.com/github/codeql-action/commit/c2fd8f54d19fa46c94ed79cb92e6dd6606d61762"><code>c2fd8f5</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4081">#4081</a> from github/mario-campos/version-cache-to-disk</li> <li><a href="https://github.com/github/codeql-action/commit/c56f48e9bd458a387eb68a68534459e503e56b17"><code>c56f48e</code></a> Log unexpected conditions during caching CLI output</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.37.7 to 4.37.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.37.8</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"><code>db488dd</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4102">#4102</a> from github/update-v4.37.8-9ee088e13</li> <li><a href="https://github.com/github/codeql-action/commit/1845f5ba8b4057590f49ee8e246c95ef2ba4b53f"><code>1845f5b</code></a> Update changelog for v4.37.8</li> <li><a href="https://github.com/github/codeql-action/commit/9ee088e13615f8d1eaef4766f9dde95d3356a8f6"><code>9ee088e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4080">#4080</a> from github/henrymercer/studious-giggle</li> <li><a href="https://github.com/github/codeql-action/commit/1aef003397c876c0ab5bd118e1b1f34c175622e9"><code>1aef003</code></a> Address review feedback on overlay disk flags</li> <li><a href="https://github.com/github/codeql-action/commit/508b83bc415e8df76ce8ea08c0cf42c2529ebc63"><code>508b83b</code></a> Merge main into overlay minimum disk feature branch</li> <li><a href="https://github.com/github/codeql-action/commit/d97b3428e8eebbb1810cf454d6397886d136b4ba"><code>d97b342</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4098">#4098</a> from github/mbg/permission-error-as-configuration-error</li> <li><a href="https://github.com/github/codeql-action/commit/47fa6222231b12097f83215dd7a6b4a0915841fd"><code>47fa622</code></a> Make <code>EACCES</code> a <code>ConfigurationError</code></li> <li><a href="https://github.com/github/codeql-action/commit/45693cc6882bb175b58a06818c91876e201037c7"><code>45693cc</code></a> Refactor <code>ENOSPC</code> check into <code>isDiskConfigurationError</code> function</li> <li><a href="https://github.com/github/codeql-action/commit/c2fd8f54d19fa46c94ed79cb92e6dd6606d61762"><code>c2fd8f5</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4081">#4081</a> from github/mario-campos/version-cache-to-disk</li> <li><a href="https://github.com/github/codeql-action/commit/c56f48e9bd458a387eb68a68534459e503e56b17"><code>c56f48e</code></a> Log unexpected conditions during caching CLI output</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.7 to 4.37.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.8</h2> <p>No user facing changes.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28"><code>db488dd</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4102">#4102</a> from github/update-v4.37.8-9ee088e13</li> <li><a href="https://github.com/github/codeql-action/commit/1845f5ba8b4057590f49ee8e246c95ef2ba4b53f"><code>1845f5b</code></a> Update changelog for v4.37.8</li> <li><a href="https://github.com/github/codeql-action/commit/9ee088e13615f8d1eaef4766f9dde95d3356a8f6"><code>9ee088e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4080">#4080</a> from github/henrymercer/studious-giggle</li> <li><a href="https://github.com/github/codeql-action/commit/1aef003397c876c0ab5bd118e1b1f34c175622e9"><code>1aef003</code></a> Address review feedback on overlay disk flags</li> <li><a href="https://github.com/github/codeql-action/commit/508b83bc415e8df76ce8ea08c0cf42c2529ebc63"><code>508b83b</code></a> Merge main into overlay minimum disk feature branch</li> <li><a href="https://github.com/github/codeql-action/commit/d97b3428e8eebbb1810cf454d6397886d136b4ba"><code>d97b342</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4098">#4098</a> from github/mbg/permission-error-as-configuration-error</li> <li><a href="https://github.com/github/codeql-action/commit/47fa6222231b12097f83215dd7a6b4a0915841fd"><code>47fa622</code></a> Make <code>EACCES</code> a <code>ConfigurationError</code></li> <li><a href="https://github.com/github/codeql-action/commit/45693cc6882bb175b58a06818c91876e201037c7"><code>45693cc</code></a> Refactor <code>ENOSPC</code> check into <code>isDiskConfigurationError</code> function</li> <li><a href="https://github.com/github/codeql-action/commit/c2fd8f54d19fa46c94ed79cb92e6dd6606d61762"><code>c2fd8f5</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4081">#4081</a> from github/mario-campos/version-cache-to-disk</li> <li><a href="https://github.com/github/codeql-action/commit/c56f48e9bd458a387eb68a68534459e503e56b17"><code>c56f48e</code></a> Log unexpected conditions during caching CLI output</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd...db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
97e289ae13 | fix: search, Prowlarr and qBittorrent follow-ups (#1276, #1283) (#1284) v1.3.13 | ||
|
Jorge Lima
|
c95ee72ad5 |
fix(qbittorrent): keep magnets whose metadata is still pending (#1282)
## Problem
`QBittorrentClient.add_download()` waits 20 × 0.5 s for qBittorrent to
leave `metaDL`, then raises:
```
Failed to add to qbittorrent: Torrent metadata resolution was not confirmed within the visibility grace period
(response=TorrentsAddedMetadata({'added_torrent_ids': [], 'failure_count': 0, 'pending_count': 1, 'success_count': 0}))
```
The wait exists to learn qBittorrent's primary torrent ID, which for
hybrid torrents switches from the v1 hash to the truncated v2 hash once
metadata resolves. A magnet on a thin public swarm routinely needs
longer than 10 s to find a peer that will serve metadata, and the
download is then abandoned even though the add itself succeeded. The
torrent stays in qBittorrent (`base_handler` logs "leaving in
qbittorrent") and often completes minutes later with nobody watching it.
Seen on v1.3.12 with public indexers through Prowlarr: every magnet-only
release failed this way, while `.torrent` releases from a private
indexer were fine. qBittorrent showed the same torrents at `metaDL 0%
seeds=0/0`, and they resolved on their own well after shelfmark had
given up.
## Change
Return the info hash we already have instead of raising when the grace
period expires. Reads then resolve either identity:
- `get_status()` and `get_download_path()` use `_resolve_torrent()`
instead of `_get_torrent_info()`, so a v1 hash still matches after
qBittorrent re-keys the torrent to v2. `_torrent_matches_download_id`
already compares `hash`, `infohash_v1` and `infohash_v2`.
- `remove()` and `set_category()` address the torrent by its current
primary hash through a new `_current_hash()` helper, which falls back to
the ID it was given when the torrent cannot be resolved.
- The two magic numbers become `_METADATA_WAIT_POLLS` and
`_METADATA_WAIT_INTERVAL_SECONDS`.
The happy path does not change. When metadata resolves inside the grace
period the resolved primary hash comes back as before, and
`_resolve_torrent()` tries the exact-hash lookup first, so it costs no
extra request.
## Tests
`test_add_fails_when_metadata_never_resolves` asserted the old
behaviour, so it becomes
`test_add_keeps_torrent_when_metadata_never_resolves` and asserts the
info hash is returned.
`test_get_status_resolves_hash_after_metadata_switch` is new: it reads
status by the v1 hash after qBittorrent reports the torrent under its v2
hash.
`uv run pytest tests/ --ignore=tests/e2e` gives the same 55 failures
with and without this change (they are all in `tests/bypass/` and need
Chrome, which my machine has no headless setup for), and
`tests/prowlarr/` is green at 524 passed. Ruff check and format are
clean. I have not run this branch against a live qBittorrent, so a
second pair of eyes on the `remove()` path would help.
|
||
|
CaliBrain
|
b25acdb2ad |
fix(packs): don't disrupt normal downloads when inspecting for packs (#1274)
Follow-ups to the multi-book pack feature (#1270), which inspects every release before download. Two behaviours leaked into the ordinary single-book flow and are corrected here: - A flat folder of chaptered audio (`01 - Chapter.mp3`, `02 - ...`) was detected as a pack, because each track name parses to a series position, so clicking download popped the review panel for one normal audiobook. Flat folders are now split one-book-per-file only with real evidence of distinct books: two or more series positions, more than one title, and no chaptered audio (only the single-file m4b/m4a containers and ebook formats qualify). Subfolder packs and flat m4b/m4a packs are unchanged. - Every release that couldn't be inspected (usenet, magnet-only, sources without a list_files hook, ABB single-file) showed an info toast on download. That is now a console.warn, so a normal download is silent again. Adds regression tests for the chaptered-mp3 cases. |
||
|
dependabot[bot]
|
7569aaecc5 |
build(deps): bump seleniumbase from 4.52.1 to 4.52.2 in the python-deps group (#1273)
Bumps the python-deps group with 1 update: [seleniumbase](https://github.com/seleniumbase/SeleniumBase). Updates `seleniumbase` from 4.52.1 to 4.52.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.52.2 - MCP Server Support</h2> <h2>MCP Server Support</h2> <p><strong>If you love AI tools, this is one of the biggest releases this year for SeleniumBase!</strong> <strong>The new <code>seleniumbase-mcp</code> command starts the "Pure CDP Mode" MCP Server.</strong> <strong>(Be sure to install <code>seleniumbase[mcp]</code> to get <code>mcp>=2.0.0</code>!)</strong> <strong>(To debug the MCP server from a <code>git clone</code> of SeleniumBase, get <code>uv</code> as well before calling <code>mcp dev server.py</code> from the <code>SeleniumBase/mcp_servers/</code> folder.)</strong></p> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4014476e288d004a8de38eca582631c9c653fa22">Add a SeleniumBase MCP server</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ac7e449fbbc8a6e9347e65e4ced8176ba1655112">Add .mcp.json to the root folder</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/32fac6becaabbb288be42e98d6528108bdb05e73">Update setup.cfg files</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/168500f45b547c914539057f76e3cd31e0121461">Update .gitignore</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/bb495cb23e405ab9a523068cdb64b48f487f22c5">Update .dockerignore</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f030eae7b492f41d1c74c731e775f21b853afbdf">Add configuration for using the new MCP server</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/422bb2fc11bd6ef58758c0eff1456f033a94db1f">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7b245c033dc47e356fdaa99b5db7ebf965329bfe">Update ReadMe files</a></li> </ul> <p><strong>Note that you will need <code>mcp>=2.0.0</code> for the MCP Server to work!</strong></p> <p>⚠️ Note: Due to a typing bug, (<a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4471">seleniumbase/SeleniumBase#4471</a>), the MCP Server in this release only worked on Python 3.14+. Upgrade to <a href="https://github.com/seleniumbase/SeleniumBase/releases/tag/v4.52.3">https://github.com/seleniumbase/SeleniumBase/releases/tag/v4.52.3</a> for the fix.</p> <h2>What's Changed</h2> <ul> <li>MCP Server Support by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4470">seleniumbase/SeleniumBase#4470</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.52.1...v4.52.2">https://github.com/seleniumbase/SeleniumBase/compare/v4.52.1...v4.52.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a28aa518e34c859d3a3f90daf03c1aa926940931"><code>a28aa51</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4470">#4470</a> from seleniumbase/mcp-server-support</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7b245c033dc47e356fdaa99b5db7ebf965329bfe"><code>7b245c0</code></a> Update ReadMe files</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/1e5ac8dd110ecb96add400a45f009735be5e8683"><code>1e5ac8d</code></a> Version 4.52.2</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/422bb2fc11bd6ef58758c0eff1456f033a94db1f"><code>422bb2f</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f030eae7b492f41d1c74c731e775f21b853afbdf"><code>f030eae</code></a> Add configuration for using the new MCP server</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/bb495cb23e405ab9a523068cdb64b48f487f22c5"><code>bb495cb</code></a> Update <code>.dockerignore</code></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/168500f45b547c914539057f76e3cd31e0121461"><code>168500f</code></a> Update <code>.gitignore</code></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/32fac6becaabbb288be42e98d6528108bdb05e73"><code>32fac6b</code></a> Update <code>setup.cfg</code> files</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ac7e449fbbc8a6e9347e65e4ced8176ba1655112"><code>ac7e449</code></a> Add <code>.mcp.json</code> to the root folder</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4014476e288d004a8de38eca582631c9c653fa22"><code>4014476</code></a> Add a SeleniumBase MCP server</li> <li>See full diff in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.52.1...v4.52.2">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 Lance Marks
|
f441b85da2 |
feat(packs): inspect multi-book releases and file each book separately (#1270)
## Multi-book packs: inspect a release before download and file each book separately Closes #576 ### Problem One queued release is always treated as one book. When a torrent is actually a whole series (`Series/Book 1 - Title/…`, or a flat folder of `Series 1.0 - Title.m4b` files), post-processing walks the whole tree, flattens every file into one list and renames them `Title - 01…10` under the searched book's `{Author}/{Title}`. Audiobookshelf then sees a single 10-file "book" and the user has to re-file everything by hand. ### What this does Most releases expose their file list *before* anything is downloaded, so the split is decided up front and approved by the user, then the download is fire-and-forget: 1. **Inspect** – clicking a release's download button now calls `POST /api/releases/inspect` first. A new optional `DownloadHandler.list_files(release_data)` hook returns the release's files without downloading: - **AudiobookBay** reads the torrent file table off the detail page it already fetches (the page is now cached for 120 s, so inspect + download cost ABB one request). - **Prowlarr** parses `info.files` from the `.torrent` it already fetches (the existing 120 s torrent-fetch cache is reused). Magnet-only and usenet releases report "can't inspect". - Other sources default to `None`. 2. **Review** – if the plan contains more than one book, the Find Releases modal swaps the list for a review panel: one row per book with editable title / series position / year, expandable file lists, non-book sidecars (`.txt`, covers) shown as ignored, a "Treat as a single book" switch, and **Download N books**. Single-book releases queue immediately, exactly as before. 3. **File** – the approved plan travels with the task (`DownloadTask.book_plan`, retry-safe) and post-processing files each book through the existing transfer code, one book at a time (`dataclasses.replace(task, title=…, series_position=…, year=…)`), so organize/rename templates, part numbering (now scoped per book), hardlinks, torrent copy-preserve and usenet handling are unchanged. Status reads `Complete (N books, M files)`. 4. **Fallback** – when a release can't be inspected the user gets a toast, and a small "Multi-book pack" toggle in the modal header forces a heuristic split (subfolder = book, or one book per file when the file names carry series positions). Planning lives in `shelfmark/download/postprocess/packs.py` and is shared by the inspect endpoint and post-processing, so what the user approved is what gets filed. The name parser strips `Book 3 -`, `03 -`, `1.0 -`, `3.`, `[03]`, `#3`, a leading series name, labels like "An Expanse Novella -", repeated titles (`Gods of Risk 2.5 - Gods of Risk`) and a trailing `(Year)`; author and series name come from the book that was searched, and the searched book's own series position is never applied to its siblings. ### Files - `shelfmark/download/postprocess/packs.py` (new) – `PackFile/PackBook/PackPlan`, `plan_pack`, `parse_pack_book_name`, `group_files_into_books`, `match_plan_to_files` - `shelfmark/core/release_inspect_routes.py` (new) – `POST /api/releases/inspect` - `shelfmark/release_sources/__init__.py` – `DownloadHandler.list_files` hook - `shelfmark/release_sources/audiobookbay/{scraper,handler}.py` – detail-page cache, `extract_file_list`, `list_files` - `shelfmark/release_sources/prowlarr/handler.py`, `download/clients/torrent_utils.py` – `extract_file_list_from_torrent`, `list_files` - `shelfmark/core/models.py`, `download/orchestrator.py` – `multi_book` / `book_plan` fields, queue + retry serialization - `shelfmark/download/postprocess/transfer.py`, `pipeline.py`, `outputs/folder.py` – per-book transfer branch and status message - `src/frontend`: `components/PackReviewPanel.tsx` (new), `ReleaseModal.tsx`, `App.tsx`, `services/api.ts`, `types/index.ts`, `utils/releasePayload.ts` (payload builder moved out of `App.tsx`), `utils/packReview.ts` - `docs/dev/release-sources-plugin-guide.md` – documents the `list_files` hook ### Out of scope (follow-ups) - Listing files from an NZB (Shelfmark already fetches the bytes; `<file subject>` names are noisy) - Inspecting magnet links via qBittorrent's files API after a paused add - BookLore / email outputs (they ignore `book_plan`; noted in code) - The combined ebook + audiobook flow ### Testing **Automated** (`make checks`, `make python-test`, `make frontend-test` all green; the only failures on my machine are the pre-existing `tests/config/test_entrypoint_permissions.py` cases, which need bash ≥ 4 and fail identically on `main` under macOS bash 3.2): - `tests/download/test_packs.py` – name parsing (markers, series name, novella labels, repeated titles, bare numeric titles like `1984`), nested / flat / mixed / deeper-nested packs, single wrapping folder not treated as a pack, plan-to-disk matching with basename fallback - `tests/core/test_processing_packs.py` – full `post_process_download` runs on a real temp filesystem: approved plan files each book under its own `{Author}/{Title}`, heuristic split of a nested pack, searched book's series position does not leak, multi-file book inside a pack keeps `- 01/- 02` per book, hardlinked torrent pack leaves the seeding tree intact, no pack fields ⇒ behaviour unchanged, single group degrades to the searched title, status message - `tests/core/test_release_inspect_routes.py` – plan response, not-inspectable, handler errors never 500, unknown source / missing `source_id` ⇒ 400, login required - `tests/audiobookbay/test_file_list.py` – file-table scraping from real ABB markup (multi-file and single-file pages), handler host validation, one page fetch shared by magnet + file list - `tests/prowlarr/test_torrent_file_list.py` – multi-file / single-file `.torrent` parsing, handler behaviour for torrent URL vs magnet vs usenet vs cache miss - `tests/download/test_orchestrator_pack_fields.py` – queue-time parsing and retry round-trip - Frontend: `releasePayload.test.ts`, `packReview.test.ts` (vitest) **Manual, on a real deployment** (arm64 image built from this branch, run as a side container next to production with the same qBittorrent / Audiobookshelf setup, `FILE_ORGANIZATION_AUDIOBOOK=organize`, hardlinks on): - AudiobookBay "The Expanse Complete 2.0" (7.87 GB, 36 files): clicking download opened the review panel in ~1 s showing **18 books · 18 files · 18 files ignored** (the `.txt` sidecars), with series positions 0.1–9.5 and years parsed from the file names; novella labels stripped ("The Churn", "The Butcher of Anderson Station"). Editing a title in the panel works. Confirming queued one task; the magnet resolved from the cached page in ~30 ms; after the download the task reported `Complete (18 books, 18 files)`, 18 hardlinks landed as `audiobooks/James S. A. Corey/<Title>/<Title>.m4b`, the torrent kept seeding, and Audiobookshelf scanned each folder as its own book (title, author, embedded chapters). - A second pack ("Expanse [01 - 9.5]", `Title N - Title` naming) was inspected to verify the repeated-title rule and the Back button, without downloading. - Single-book releases still queue immediately with no extra UI. |
||
  zab1996andRyan
|
02b7e9d958 |
feat(newznab): support multiple named indexers (#1271)
## Summary - add a named Newznab indexer table with per-indexer URL and API key settings - search every configured indexer and retain the originating indexer name on each result - namespace cached release IDs across connections and isolate individual indexer failures - preserve the legacy single-indexer settings as a fallback - support masked API-key cells and trusted SABnzbd prefetching for named indexers ## Validation - 121 Newznab and SABnzbd backend tests passed on Python 3.14 - Ruff passed for all changed Python files - frontend TypeScript and strict lint checks passed - all 134 frontend unit tests passed - frontend formatting check passed ## Compatibility Existing `NEWZNAB_URL` and `NEWZNAB_API_KEY` configurations continue to work whenever `NEWZNAB_INDEXERS` is empty. Co-authored-by: Ryan <zab1996@users.noreply.github.com> |
||
|
CaliBrain
|
ff06a1a581 |
fix(search): follow-ups to per-user book languages (#1267)
Review follow-ups to #1255, all in the code that PR touched. Drop the dead user_id from the Prowlarr retry path. ProwlarrSource.search never reads plan.languages, and _refresh_release builds a synthetic book with no titles_by_language, so the title variants came out identical with and without it. It also should not language-filter: it re-finds one exact release by its guid. Pin the tab move in tests. BOOK_LANGUAGE moved from the General tab to Search Mode with no migration, which only works because both tabs persist into the same settings.json. Nothing asserted that, so splitting the files later would silently reset every install to ["en"]. Covers the stored value, a fresh install, and ENV precedence. Stop the UI inventing a default language. An empty BOOK_LANGUAGE is a deliberate "no default filter" that the backend preserves, but the two frontend call sites replaced it with the first supported language, so the filter said English where the server filtered nothing. resolveDefaultLanguageCodes now falls back only when the value is absent. Keep the normalized value for every validated search key. validate_user_settings gated the write-back on a hand-maintained subset of the keys the search validator recognises, so METADATA_PROVIDER_COMBINED, SHOW_COMBINED_SELECTOR and FORCE_COMBINED_SEARCH were validated and then stored raw -- a padded provider name was accepted and persisted with its padding. Reuse the validator's own key set instead. Skip blank language entries rather than rejecting them, so "" and "en," mean the same as [] and ["en"] instead of erroring on an unnamed language. Extract resolveListOverride for the list-override detection that was copy-pasted between the two user-settings sections, and mention languages in the Search Preferences section description. |
||
 
|
463ef49ac3 |
feat(search): let each user pick their own default book languages (#1255)
## Why `BOOK_LANGUAGE` is a per-reader property, not a per-instance one. On a shared install one household member searches in German while another wants English and German — today whoever changes the setting changes it for everyone, and the only escape is re-picking languages in the filter on every single search. The per-user override machinery already carries `SEARCH_MODE`, the metadata providers and the default release sources, so the language default mostly had to opt into it. ## What changed **The field.** `BOOK_LANGUAGE` becomes `user_overridable` and moves from the **General** tab to **Search Mode**, next to the other user-overridable search defaults (per [review](https://github.com/calibrain/shelfmark/pull/1255#issuecomment-5391189094) — the first version had the Search section span two tabs, this one doesn't). Admins set it per user in the user editor, users set it in **My Account → Search Preferences**, and the Search Mode tab carries the usual "N users override this" summary. **No migration for the move.** `general` and `search_mode` both persist into `settings.json`, and a field's value is resolved through `load_config_file(tab)` for the tab it's declared on — so an install that already stores `BOOK_LANGUAGE` keeps its value. Checked against a `settings.json` written while the field still lived on General: the stored value resolves unchanged, a fresh install still gets `["en"]`, and `BOOK_LANGUAGE` in the environment still overrides both. **The two places the default is read.** - `/api/config` seeds the frontend's language filter, so it now resolves `BOOK_LANGUAGE` for the session user. - `build_release_search_plan` falls back to the default whenever a request carries no language filter — which is exactly what the filter's "Default" option sends. It takes an optional `user_id`, passed by `/api/releases` from the session and by the Prowlarr retry path from `task.user_id`, so a retry re-searches in the languages of whoever queued the download. **Validation.** Overrides go through `normalize_language()`, so `"German"`, `"ger"` and `"de"` all store as `de`, and an unknown language is rejected with a message naming it instead of being silently searched for. An empty list stays an empty list (a deliberate "no default filter"), `null` clears the override as everywhere else, and ENV still wins: with `BOOK_LANGUAGE` set in the environment the field reports `fromEnv` and overrides are ignored. **Scope.** Only the language default becomes overridable. The two format lists left behind under "Default Search Filters" stay admin-only — they describe what the library and its post-processing accept, not what a reader wants to read. There's a test pinning that. ## Verification - 2681 unit tests pass (2670 before, 11 added) - `ruff check`, `ruff format`, `basedpyright` over backend and tests, and `vulture` all clean; frontend lint, format, typecheck and 126 unit tests clean - `docs/environment-variables.md` regenerated via `scripts/generate_env_docs.py` (the `BOOK_LANGUAGE` row follows the field into the Search Mode section) - Manually against a two-user instance with builtin auth (first round, before the tab move): with user A on German and user B on English+German, `/api/config` returns each reader their own `default_language` and an unfiltered `/api/releases` plans the matching languages; an admin can set and read the same override for another user; clearing it falls back to the global value; a stray `"klingon"` is rejected; and `BOOK_LANGUAGE` in the environment overrides both users with the field marked `fromEnv` - After the tab move I re-ran the suites above plus the stored-value/fresh-install/ENV check described under "No migration for the move"; the behaviour it exercises is what the move could have broken Co-authored-by: Claude Opus 5 <noreply@anthropic.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
CaliBrain
|
a5595cf9f1 | Change test for fake extension that wont work (#1266) | ||
 jakesterpdxandClaude Fable 5
|
9bcf595111 |
feat(prowlarr): warn when an indexer declares a format Shelfmark can't process (#1265)
## Problem Companion to #1264, but general rather than mp4-specific. MyAnonamouse titles carry a structured `[LANG / FORMATS]` bracket that `_extract_mam_formats` parses. When every token in it is something Shelfmark doesn't know — e.g. `The Martian by Andy Weir [ENG / MP4]` — the release is rendered with **no format chip at all**, just the generic headphones/book icon with an "Audiobook" tooltip. To a user that looks like an ordinary result. It downloads fine and then fails post-processing with *"No book files found in download"*. The backend already *had* the signal (a format token it couldn't map); it just threw it away. ## Change **Backend** (`shelfmark/release_sources/prowlarr/source.py`) - `_split_mam_formats(raw_title) -> (recognized, unrecognized)` replaces the body of `_extract_mam_formats`, which is kept as a thin wrapper returning `recognized` so nothing else changes. - Releases gain `extra["unrecognized_formats"]` (list, or `None` when empty / when format detection is off). **Frontend** - `getUnrecognizedReleaseFormats(release)` in `utils/releaseFormats.ts` (normalised + deduped, same shape as `getReleaseFormats`). - `ReleaseCell` `format_content_type`: when there is **no** recognised format but the indexer named one, render an amber `MP4 Unsupported` badge (compact view: amber `MP4`) with tooltip *"Unsupported format (MP4) - Shelfmark cannot process this release"*. When a recognised format exists the existing badge is untouched, even if extra unknown tokens were present. Only the chip changes — the download button still works, so a user can still grab and hand-process the files if they want to. Happy to disable the button instead if you'd prefer. ## Tests - `tests/prowlarr/test_source.py`: `TestSplitMamFormats` (recognised / unrecognised / mixed / no bracket / wrapper compat) and `TestUnrecognizedFormatOnRelease` (lands in `extra`, empty when recognised, absent without format detection). - `src/frontend/src/tests/releaseFormats.test.ts`: 3 cases for the new helper. - `ruff check` clean; `pytest tests/prowlarr -m "not integration"` 511 passed; `tsc --noEmit`, `oxlint --deny warnings`, `vitest` all clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
jakesterpdxandClaude Fable 5
|
65e2e3be20 |
feat(audiobook): recognise .mp4 as an audiobook format (#1264)
## Problem Some trackers — MyAnonamouse in particular — distribute AAC audiobooks as per-chapter `.mp4` files. That's the same ISO-BMFF container as `.m4a`/`.m4b`, just with the generic extension (`ftyp isom`, audio-only). Today those releases: 1. show up in Prowlarr search results with **no format chip** — only the generic "Audiobook" icon, because no format could be inferred; 2. download successfully; then 3. fail post-processing with **"No book files found in download"**, because `.mp4` isn't in `AUDIOBOOK_FORMATS` (`shelfmark/core/utils.py`). Real example: MAM #627978, *The Martian* (Andy Weir, 2020 edition) — 142 files `0001 … 0142 Andy Weir (2020) The Martian.mp4` + `cover.jpg`, 305 MB. Every file is a valid AAC-in-MP4 chapter. Adding `mp4` to `SUPPORTED_AUDIOBOOK_FORMATS` in `settings.json` doesn't help since the hard-coded tuple is what post-processing scans against. ## Change - Add `"mp4"` to `AUDIOBOOK_FORMATS` (single source of truth — settings UI, Prowlarr parsing, IRC parser, archive extraction and post-download scan all derive from it), with a comment explaining why. - Add `".mp4"` to the two hand-maintained debrid `_BOOK_EXTENSIONS` lists (AllDebrid / Real-Debrid) so file selection matches. - Slot `mp4` into the IRC `AUDIOBOOK_FORMAT_PRIORITY` table right after `m4a` (same container family). - Update the documented default in `docs/environment-variables.md`. - New regression test `test_audiobook_multifile_mp4_chapters_are_book_files` modelled on the existing multi-file usenet test. ### Note for existing installs The legacy-default migration only widens configs that still hold the old `m4b,mp3` list, so users on the current widened default won't pick up `mp4` automatically — they'll need to tick it in Settings → Audiobook formats. New installs get it by default. Happy to extend the migration if you'd rather it be automatic. ## Testing - `ruff check` / `ruff format --check`: clean - `pytest tests/core tests/config tests/irc tests/prowlarr tests/download -m "not integration and not e2e"`: 2296 passed, new test + `test_audiobook_format_consistency.py` all green. The 10 failures in `test_entrypoint_permissions.py` / `test_orchestrator_stall.py` reproduce identically on untouched `main` on macOS and are unrelated. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
CaliBrain
|
ddc26f01b6 |
fix(download): escalating per-host cooldown on HTTP 429 (#1263)
Anna's Archive 429-throttles the source IP after repeated automated requests. The bypasser could clear the DDoS-Guard challenge but not the 429, so each retry re-solved, re-spawned Chrome, and rotated mirrors that share the same IP - a costly loop that never converged. Add a process-global, per-host cooldown that escalates 2 -> 5 -> 10 -> 15 -> 30 minutes each time a host 429s again after its window elapsed, resetting after a long clear gap. Mirror selection skips cooling hosts and the bypasser refuses to solve one, so a throttled host fails fast instead of storming the solver. |
||
|
CaliBrain
|
89104ae80f |
fix(search): let manual search switch media type under forced combined search (#1262)
Manual search browses release sources directly, one media type at a time, so the combined (both) flow never applied to it — yet FORCE_COMBINED_SEARCH locked the content-type selector onto both, pinning manual search to ebook sources with no way to reach audiobook sources (no Audiobay tab). Treat a manual search target as combined-exempt in the search bar: present a plain, switchable Books/Audiobooks selector (unlocked, no combined toggle), even when combined search is forced on for metadata targets. Metadata search behavior is unchanged. Fixes #1256v1.3.12 |
||
|
dependabot[bot]
|
1e45add4d5 |
build(deps-dev): bump knip from 6.32.1 to 6.32.2 in /src/frontend in the npm-deps group (#1246)
Bumps the npm-deps group in /src/frontend with 1 update: [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip). Updates `knip` from 6.32.1 to 6.32.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpro-nl/knip/releases">knip's releases</a>.</em></p> <blockquote> <h2>Release 6.32.2</h2> <ul> <li>Support <code>oxfmt.config.mts</code> (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1933">#1933</a>) (795900191dc75eec8d1e717b866bf57e1e2912cc) - thanks <a href="https://github.com/joealden"><code>@joealden</code></a>!</li> <li>Support <code>oxlint.config.mts</code> (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1934">#1934</a>) (531e2dc7c1d8bf31babea0068c34391182ec2d50) - thanks <a href="https://github.com/joealden"><code>@joealden</code></a>!</li> <li>Fix Supported <code>lint-staged</code> Configs (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1935">#1935</a>) (f9c755e414ed10baa4d01af8ddac6d04cb8d5617) - thanks <a href="https://github.com/joealden"><code>@joealden</code></a>!</li> <li>Update dependencies (95f7c529f918dd9e1a84f92c68d064738977b825)</li> <li>Update sentry snapshot (ea7929fcbd6b323c8bdd9252ac57017feeb29ecf)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpro-nl/knip/commit/196a11a4e0cb5208c0dc8382a54341d5630af631"><code>196a11a</code></a> Release knip@6.32.2</li> <li><a href="https://github.com/webpro-nl/knip/commit/95f7c529f918dd9e1a84f92c68d064738977b825"><code>95f7c52</code></a> Update dependencies</li> <li><a href="https://github.com/webpro-nl/knip/commit/f9c755e414ed10baa4d01af8ddac6d04cb8d5617"><code>f9c755e</code></a> Fix Supported <code>lint-staged</code> Configs (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1935">#1935</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/531e2dc7c1d8bf31babea0068c34391182ec2d50"><code>531e2dc</code></a> Support <code>oxlint.config.mts</code> (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1934">#1934</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/795900191dc75eec8d1e717b866bf57e1e2912cc"><code>7959001</code></a> Support <code>oxfmt.config.mts</code> (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1933">#1933</a>)</li> <li>See full diff in <a href="https://github.com/webpro-nl/knip/commits/knip@6.32.2/packages/knip">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
cb3f6fee82 |
build(deps): bump astral-sh/uv from 0.11.3 to 0.12.5 in the docker-base-image-digests group (#1247)
Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.11.3 to 0.12.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.5</h2> <h2>Release Notes</h2> <p>Released on 2026-08-14.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.21, 3.11.16, and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21138">#21138</a>)</li> <li>Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (<a href="https://redirect.github.com/astral-sh/uv/pull/21134">#21134</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21130">#21130</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Allow <code>--index</code> and <code>--default-index</code> to select configured package indexes by name with the <code>index-by-name</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/17455">#17455</a>)</li> <li>Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (<a href="https://redirect.github.com/astral-sh/uv/pull/21131">#21131</a>)</li> <li>Fall back to logical file sizes when using <code>cache-physical-space</code> on filesystems that do not support physical-space accounting (<a href="https://redirect.github.com/astral-sh/uv/pull/21133">#21133</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Resolve relative package index paths in PEP 723 scripts against the script directory (<a href="https://redirect.github.com/astral-sh/uv/pull/21097">#21097</a>)</li> </ul> <h2>Install uv 0.12.5</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.ps1 | iex" </code></pre> <h2>Download uv 0.12.5</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-unknown-linux-gnu.tar.gz">uv-i686-unknown-linux-gnu.tar.gz</a></td> <td>x86 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-powerpc64le-unknown-linux-gnu.tar.gz">uv-powerpc64le-unknown-linux-gnu.tar.gz</a></td> <td>PPC64LE Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.5</h2> <p>Released on 2026-08-14.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.21, 3.11.16, and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21138">#21138</a>)</li> <li>Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (<a href="https://redirect.github.com/astral-sh/uv/pull/21134">#21134</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21130">#21130</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Allow <code>--index</code> and <code>--default-index</code> to select configured package indexes by name with the <code>index-by-name</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/17455">#17455</a>)</li> <li>Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (<a href="https://redirect.github.com/astral-sh/uv/pull/21131">#21131</a>)</li> <li>Fall back to logical file sizes when using <code>cache-physical-space</code> on filesystems that do not support physical-space accounting (<a href="https://redirect.github.com/astral-sh/uv/pull/21133">#21133</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Resolve relative package index paths in PEP 723 scripts against the script directory (<a href="https://redirect.github.com/astral-sh/uv/pull/21097">#21097</a>)</li> </ul> <h2>0.12.4</h2> <p>Released on 2026-08-13.</p> <h3>Enhancements</h3> <ul> <li>Prefer post-quantum key exchange and enable opt-in TLS diagnostics (<a href="https://redirect.github.com/astral-sh/uv/pull/21054">#21054</a>)</li> <li>Accept whitespace before versions in noncompliant wildcard comparisons such as <code>Requires-Python: >= 3.5.*</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21012">#21012</a>)</li> <li>Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (<a href="https://redirect.github.com/astral-sh/uv/pull/20944">#20944</a>)</li> <li>Omit source-span carets from diagnostics for empty PEP 508 requirements (<a href="https://redirect.github.com/astral-sh/uv/pull/21094">#21094</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Add <code>uv check --no-install-project</code> and respect <code>UV_NO_INSTALL_PROJECT</code> to install dependencies without building or installing the project (<a href="https://redirect.github.com/astral-sh/uv/pull/21085">#21085</a>)</li> <li>Make the ty subprocess invoked by <code>uv check</code> honor uv's color and progress settings, including quiet mode (<a href="https://redirect.github.com/astral-sh/uv/pull/21086">#21086</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (<a href="https://redirect.github.com/astral-sh/uv/pull/20804">#20804</a>)</li> <li>Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (<a href="https://redirect.github.com/astral-sh/uv/pull/21041">#21041</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Use windowed <code>pythonw.exe</code> launchers for virtual environments created from managed Python minor-version links (<a href="https://redirect.github.com/astral-sh/uv/pull/19235">#19235</a>)</li> <li>Allow <code>uv lock</code> to proceed when <code>.venv</code> is an unusable project environment (<a href="https://redirect.github.com/astral-sh/uv/pull/21068">#21068</a>)</li> <li>Respect <code>fork-strategy</code> when ordering forks created from <code>environments</code> or existing lockfile <code>resolution-markers</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21000">#21000</a>)</li> <li>Preserve consecutive wildcard Python minor-version exclusions such as <code>!=3.11.*, !=3.12.*</code> in <code>uv.lock</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21045">#21045</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/210d1f6785e95a8c8c0d53e284408c9be1134700"><code>210d1f6</code></a> Bump version to 0.12.5 (<a href="https://redirect.github.com/astral-sh/uv/issues/21140">#21140</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/802a9162a1153ddee799a0080c80a38d96009d91"><code>802a916</code></a> Sync latest Python releases: 3.10.21, 3.11.16, 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/issues/21138">#21138</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a6904bbdabd3c6ac42b1051896ff597c8bd1895a"><code>a6904bb</code></a> Order equal-priority Python installations by key (<a href="https://redirect.github.com/astral-sh/uv/issues/21134">#21134</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/728a70d25c0889d9aaa53776256c3a843eea67a6"><code>728a70d</code></a> Improve automated fixes for related bug manifestations (<a href="https://redirect.github.com/astral-sh/uv/issues/21102">#21102</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/b82b0383fc3471227aa864f18d2c1c8efac8b9f1"><code>b82b038</code></a> Include hashes in cyclonedx exports (<a href="https://redirect.github.com/astral-sh/uv/issues/21131">#21131</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/8011778d41f2c96fb0b856fb3cbcb4ec8d28cb63"><code>8011778</code></a> Simplify editable requirement errors and hints (<a href="https://redirect.github.com/astral-sh/uv/issues/21130">#21130</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/dca33f5e6799f2aefee52729732a839a3b358740"><code>dca33f5</code></a> Fall back to logical cache accounting on unsupported filesystems (<a href="https://redirect.github.com/astral-sh/uv/issues/21133">#21133</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3a76e496e36783371a6d91a8f4834478964d36ca"><code>3a76e49</code></a> Get rid of <code>Lock::with_manifest</code>, make <code>Lock::from_resolution</code> take the manif...</li> <li><a href="https://github.com/astral-sh/uv/commit/7e6caa45f62a0506fea1b8ecfa0558e5d62d520c"><code>7e6caa4</code></a> Support referencing indexes by name via <code>--index</code> and <code>--default-index</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/17455">#17455</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/298dda41bff49bbd0a2f397e1662ab09b9cd148e"><code>298dda4</code></a> Fix relative indexes in PEP 723 scripts (<a href="https://redirect.github.com/astral-sh/uv/issues/21097">#21097</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.11.3...0.12.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
0dc13c1ca4 |
build(deps): bump the gh-actions group with 5 updates (#1248)
Bumps the gh-actions group with 5 updates: | Package | From | To | | --- | --- | --- | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.2.0` | `4.3.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `9.0.0` | `10.0.1` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.6` | `4.37.7` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.6` | `4.37.7` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.6` | `4.37.7` | Updates `docker/setup-buildx-action` from 4.2.0 to 4.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's releases</a>.</em></p> <blockquote> <h2>v4.3.0</h2> <ul> <li>Bump <code>@docker/actions-toolkit</code> from 0.92.0 to 0.95.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/595">docker/setup-buildx-action#595</a></li> <li>Bump brace-expansion from 1.1.13 to 1.1.18 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/600">docker/setup-buildx-action#600</a></li> <li>Bump js-yaml from 5.2.0 to 5.3.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/585">docker/setup-buildx-action#585</a></li> <li>Bump postcss from 8.5.10 to 8.5.25 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/598">docker/setup-buildx-action#598</a></li> <li>Bump undici from 6.27.0 to 6.28.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/601">docker/setup-buildx-action#601</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0">https://github.com/docker/setup-buildx-action/compare/v4.2.0...v4.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/setup-buildx-action/commit/37fe631027851001ddb9b187196cc803df7f5f0e"><code>37fe631</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/595">#595</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/b5c4f91922681cc7c58d15ab7838986951f09d19"><code>b5c4f91</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/3e93b637c6430ba8fa896fad44d3aa6821899d63"><code>3e93b63</code></a> build(deps): bump <code>@docker/actions-toolkit</code> from 0.92.0 to 0.95.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/e527031b32c86649307d5d492506855f90470604"><code>e527031</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/600">#600</a> from docker/dependabot/npm_and_yarn/brace-expansion-1...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/c68814b33cb66f1f7538e546190d410ae557a640"><code>c68814b</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/3f891b01bd5012a434f582800366972569aa1886"><code>3f891b0</code></a> build(deps): bump brace-expansion from 1.1.13 to 1.1.18</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/787db26fcde8ddcabd49a81472318028f7113962"><code>787db26</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/585">#585</a> from docker/dependabot/npm_and_yarn/js-yaml-5.2.1</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/f7793687c711790ca336bd4934f1b1bf5f778e17"><code>f779368</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/7d5e60413489a33d28077e11d71c668580cfaf8d"><code>7d5e604</code></a> build(deps): bump js-yaml from 5.2.0 to 5.3.0</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/292c2fb3837a12d3ac2d1e47bbc5c00712bad939"><code>292c2fb</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/590">#590</a> from docker/dependabot/github_actions/actions/setup-n...</li> <li>Additional commits viewable in <a href="https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...37fe631027851001ddb9b187196cc803df7f5f0e">compare view</a></li> </ul> </details> <br /> Updates `astral-sh/setup-uv` from 9.0.0 to 10.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.0.1 🌈 Tolerate transient manifest timeouts</h2> <h2>Changes</h2> <p>Thank you <a href="https://github.com/arguile"><code>@arguile</code></a>- for making this action more resilient.</p> <h2>🐛 Bug fixes</h2> <ul> <li>Tolerate transient manifest timeouts <a href="https://github.com/arguile"><code>@arguile</code></a>- (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.12.4 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.0.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> </ul> <h2>v10.0.0 🌈 Disable automatic caching for sensitive events and new QOL features</h2> <h2>Changes</h2> <p>Another breaking release, directly after v9.0.0 but we think the added security justifies that.</p> <h3>Extra security by default</h3> <p>If you use the default <code>enable-cache: auto</code> this will now <strong>DISABLE THE CACHE</strong> to protect against cache poisoning for the following events:</p> <ul> <li><code>pull_request_target</code></li> <li><code>workflow_run</code></li> <li><code>release</code></li> </ul> <p>You can read the full reasoning in <a href="https://redirect.github.com/astral-sh/setup-uv/issues/984">astral-sh/setup-uv#984</a></p> <h3><code>version: latest-known</code></h3> <pre lang="yaml"><code>- name: Install the latest version of uv known to setup-uv uses: astral-sh/setup-uv@v10.0.0 with: version: "latest-known" </code></pre> <p>This will now install the latest version with a checksum that is known by this action. The <a href="https://github.com/astral-sh/setup-uv/blob/4f6036f71cec78afb113b323f220c9185d983c12/src/download/checksum/known-checksums.ts">known <code>uv</code> checksums</a> are automatically updated but will take a release of this action to take effect. You won't be always using the latest & greatest but you will have an extra level of security.</p> <h3>Read python version from <code>.tool-versions</code></h3> <pre lang="yaml"><code>- name: Install uv based on the version defined in .tool-versions and also set python uses: astral-sh/setup-uv@v10.0.0 with: version-file: "pyproject.toml" </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/20cfd1bf945f4377ade1205e4dbc17946fc9a30d"><code>20cfd1b</code></a> chore: update known checksums for 0.12.4 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1017">#1017</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/d73a0cab66a532d7afa440d9df4a67ea9fe65a30"><code>d73a0ca</code></a> Tolerate transient manifest timeouts (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1016">#1016</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae3b92d1bdb308a10adfe7b8f408e5cc8c30f3f6"><code>ae3b92d</code></a> docs: update version references to v10.0.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1014">#1014</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d"><code>ae62891</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1013">#1013</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f9cdb47d487aee2be8925d1e57290177ad9e1ac2"><code>f9cdb47</code></a> Reject paths in .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1007">#1007</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/4f6036f71cec78afb113b323f220c9185d983c12"><code>4f6036f</code></a> Require pull requests for Dependabot rollups (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1005">#1005</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8d6402c9b71205b2d8d0b82de531d8fed8430182"><code>8d6402c</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1004">#1004</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/46f427bd47c794e99536b75ffaa9f27602425027"><code>46f427b</code></a> Read Python version from .tool-versions (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/996">#996</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8ed89c51143f65ea13eaba62db51dbb8ea52d0a3"><code>8ed89c5</code></a> ci: pin Alpine container image (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/995">#995</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8473c7fea42cdfd540f4b01317a17ac5f54126ae"><code>8473c7f</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/994">#994</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/c771a70e6277c0a99b617c7a806ffedaca235ff9...20cfd1bf945f4377ade1205e4dbc17946fc9a30d">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.6 to 4.37.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a> from github/update-v4.37.7-be7a3dbb8</li> <li><a href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a> Update changelog for v4.37.7</li> <li><a href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a> from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li> <li><a href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a> from github/mbg/thread-action-state-to-codeql</li> <li><a href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a> Bump the npm-minor group across 1 directory with 8 updates</li> <li><a href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a> Drop <code>logger</code> from <code>databaseInitCluster</code> in interface</li> <li><a href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a> from github/update-bundle/codeql-bundle-v2.26.3</li> <li><a href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a> Make <code>logger</code> available to <code>getCodeQLForCmd</code></li> <li><a href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a> from github/navntoft/bump-undici</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.37.6 to 4.37.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a> from github/update-v4.37.7-be7a3dbb8</li> <li><a href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a> Update changelog for v4.37.7</li> <li><a href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a> from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li> <li><a href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a> from github/mbg/thread-action-state-to-codeql</li> <li><a href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a> Bump the npm-minor group across 1 directory with 8 updates</li> <li><a href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a> Drop <code>logger</code> from <code>databaseInitCluster</code> in interface</li> <li><a href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a> from github/update-bundle/codeql-bundle-v2.26.3</li> <li><a href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a> Make <code>logger</code> available to <code>getCodeQLForCmd</code></li> <li><a href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a> from github/navntoft/bump-undici</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.6 to 4.37.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.7</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd"><code>ff2f1c6</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4093">#4093</a> from github/update-v4.37.7-be7a3dbb8</li> <li><a href="https://github.com/github/codeql-action/commit/951a133f96aa2114dd747e9e437305335d0bde16"><code>951a133</code></a> Update changelog for v4.37.7</li> <li><a href="https://github.com/github/codeql-action/commit/be7a3dbb8147b82cd6d27e0707105b36aa190fc1"><code>be7a3db</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4087">#4087</a> from github/dependabot/npm_and_yarn/npm-minor-0aa561...</li> <li><a href="https://github.com/github/codeql-action/commit/9310334b11405b305d9444edfa56cd86e2f1e4fe"><code>9310334</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4086">#4086</a> from github/mbg/thread-action-state-to-codeql</li> <li><a href="https://github.com/github/codeql-action/commit/b4d8a54218a8792de9af2f6f32e33af899ca5212"><code>b4d8a54</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/ab5db2519c3344f2fa61c711fa2d6ad135829200"><code>ab5db25</code></a> Bump the npm-minor group across 1 directory with 8 updates</li> <li><a href="https://github.com/github/codeql-action/commit/38055a3c3cf3979323eaf70fc6c73a8690250bde"><code>38055a3</code></a> Drop <code>logger</code> from <code>databaseInitCluster</code> in interface</li> <li><a href="https://github.com/github/codeql-action/commit/1f87aed5e66849f0c43ae147377cc77f2d98ac99"><code>1f87aed</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4085">#4085</a> from github/update-bundle/codeql-bundle-v2.26.3</li> <li><a href="https://github.com/github/codeql-action/commit/dc1b98ad1c2f13ccf9fc33fb82f32fc76f944253"><code>dc1b98a</code></a> Make <code>logger</code> available to <code>getCodeQLForCmd</code></li> <li><a href="https://github.com/github/codeql-action/commit/6f0220ee37121218af472efbde25f06907a4da4f"><code>6f0220e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4084">#4084</a> from github/navntoft/bump-undici</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/5595ccaf912efad79be6eef63a5619ff05969be3...ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
d1f8527089 |
build(deps): bump the python-deps group across 1 directory with 5 updates (#1260)
Bumps the python-deps group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [gunicorn](https://github.com/benoitc/gunicorn) | `26.0.0` | `26.1.0` | | [apprise](https://github.com/caronc/apprise) | `1.12.0` | `1.13.0` | | [seleniumbase](https://github.com/seleniumbase/SeleniumBase) | `4.51.12` | `4.52.1` | | [prek](https://github.com/j178/prek) | `0.4.13` | `0.4.14` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.3` | `0.16.4` | Updates `gunicorn` from 26.0.0 to 26.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/benoitc/gunicorn/releases">gunicorn's releases</a>.</em></p> <blockquote> <h2>gunicorn 26.1.0</h2> <h3>New Features</h3> <ul> <li><strong>Glob patterns in <code>reload_extra_files</code></strong>: entries containing <code>*</code>, <code>?</code> or <code>[</code> are treated as patterns, so <code>ui/*/config.json</code> watches every view's config without listing them one by one. Patterns are re-expanded on every reload check rather than once at startup, so a file created later starts being watched without restarting gunicorn, and <code>**</code> recurses. A pattern matching nothing warns instead of failing, since with live expansion it may match later (<a href="https://redirect.github.com/benoitc/gunicorn/issues/1643">#1643</a>, <a href="https://redirect.github.com/benoitc/gunicorn/pull/3662">#3662</a>).</li> </ul> <h3>Security</h3> <ul> <li><strong>Dependency floors raised past known advisories</strong>: every declared floor was checked against the advisory database. <code>tornado</code>, <code>h2</code>, <code>setuptools</code> and <code>pymdown-extensions</code> permitted vulnerable versions and now require the first clean release; <code>pytest</code> and <code>httpx</code> were unpinned and now carry floors. The <code>tornado</code> example pinned <code>tornado<6</code>, which was both the source of several advisories and older than the <code>>=6.5.0</code> the tornado worker needs, so the example could not run as pinned.</li> </ul> <h3>Bug Fixes</h3> <ul> <li> <p><strong>SIGHUP did not reload the logger configuration</strong>: <code>Arbiter.reload()</code> re-read the configuration file but kept using the logger built at startup, calling only <code>reopen_files()</code> on its existing handlers. Changes to <code>logconfig</code>, <code>logconfig_dict</code>, <code>logconfig_json</code> and <code>loglevel</code> were ignored until a full restart, which in containers meant replacing the pod. The existing logger now re-runs its setup on reload, so new handlers, formats and levels take effect while the process identity and its listeners are preserved, and re-running the setup no longer stacks duplicate syslog handlers. An invalid log configuration on reload is not fatal either: the error is reported on stderr, the previous working configuration is restored and the master keeps running with it (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3353">#3353</a>).</p> </li> <li> <p><strong>Truncated chunked bodies accepted</strong>: RFC 9112 section 7.1.2 ends a chunked body with <code>0 CRLF CRLF</code>, the second CRLF being the mandatory empty trailer section. <code>ChunkedReader.parse_chunk_size()</code> swallowed the <code>NoMoreData</code> raised while scanning for it, so a body cut short right after the last chunk line was treated as complete instead of rejected. It now raises <code>ChunkMissingTerminator</code> (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3382">#3382</a>, <a href="https://redirect.github.com/benoitc/gunicorn/pull/3685">#3685</a>).</p> </li> <li> <p><strong><code>--spew</code> crashed on dynamically generated code</strong>: the trace hook indexed the 2-tuple returned by <code>inspect.getsourcelines()</code> by line number rather than indexing the list of lines, so a frame with no <code>__file__</code> raised <code>AttributeError: 'int' object has no attribute 'rstrip'</code> on line 1 and</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/benoitc/gunicorn/commit/71b59a75820dd4a762dc42a3280124168b4e44a8"><code>71b59a7</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3698">#3698</a> from benoitc/fix/docker-health-check-readerror</li> <li><a href="https://github.com/benoitc/gunicorn/commit/48287de8d8360825c85ac981ddfe9c80dba3b418"><code>48287de</code></a> test: catch every transport error in the docker health check</li> <li><a href="https://github.com/benoitc/gunicorn/commit/3110e8c37f716ca0ed63ca7f80c7c9ea0fbbdd50"><code>3110e8c</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3696">#3696</a> from benoitc/docs/roadmap</li> <li><a href="https://github.com/benoitc/gunicorn/commit/cc56c410b7103c1f2b877279f81cb3a14705315a"><code>cc56c41</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3693">#3693</a> from benoitc/release/26.1.0</li> <li><a href="https://github.com/benoitc/gunicorn/commit/5cf1f1651a40fa36afe13fde623e3437ca872463"><code>5cf1f16</code></a> docs: surface the roadmap on the site home page</li> <li><a href="https://github.com/benoitc/gunicorn/commit/7e35f72d135056c37da321becf22b19aeec06937"><code>7e35f72</code></a> docs: add FastCGI to the roadmap and point items at Ideas</li> <li><a href="https://github.com/benoitc/gunicorn/commit/18ddc586c9b9513b25e92c6ed6f818f66ff3abcd"><code>18ddc58</code></a> docs: drop the framework and reverse-proxy non-goals from the roadmap</li> <li><a href="https://github.com/benoitc/gunicorn/commit/1ecae56ebd096ee4f94d12c59a36f240ce348572"><code>1ecae56</code></a> docs: add a roadmap and make the chat easy to find</li> <li><a href="https://github.com/benoitc/gunicorn/commit/ca412e3f7134bd9f0e91851778ae6d8dd222cf41"><code>ca412e3</code></a> docs: sync the Latest changelog page with 26.1.0</li> <li><a href="https://github.com/benoitc/gunicorn/commit/640936fb29f7bdf5665d5b7f919783bb73e2f981"><code>640936f</code></a> docs: note the dependency security work in 26.1.0</li> <li>Additional commits viewable in <a href="https://github.com/benoitc/gunicorn/compare/26.0.0...26.1.0">compare view</a></li> </ul> </details> <br /> Updates `apprise` from 1.12.0 to 1.13.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/caronc/apprise/releases">apprise's releases</a>.</em></p> <blockquote> <h2>Release v1.13.0</h2> <h2>What's Changed</h2> <p>This update clears out our backlog of resolved bugs and introduces a few new services. While it’s a standard maintenance release, we want to give a massive shoutout to our community. The level of support we've received for this update is truly incredible; there were more commits/PRs from you than there were from me and that has never happend before 🙂 . Your contributions are deeply appreciated! Seriously!</p> <p><strong>Note:</strong> ⚠️ <strong>This will be the last version of Apprise v1.x</strong>. Future releases will be under Apprise v2.x. This means: Developers, <em>please</em> make sure you pin your <code>projects.toml</code> or <code>requirements.txt</code> to <code>apprise >=1.0.0, <2.0.0</code>. v2.x will be awesome, but it will introduce breaking changes your software may need to adapt to. I will still continue supporting the v1.x branch should security issues arise for at year or two, but eventually v2.x would be the way to go.</p> <h3>📣 New Notification Services:</h3> <ul> <li>Added Pinglet Support by <a href="https://github.com/TheGlenn88"><code>@TheGlenn88</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1680">caronc/apprise#1680</a></li> <li>Add Trigv notification support by <a href="https://github.com/hchouhan"><code>@hchouhan</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1671">caronc/apprise#1671</a></li> <li>Added Pingram (formerly NotificationApi) by <a href="https://github.com/lipusal"><code>@lipusal</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1665">caronc/apprise#1665</a></li> </ul> <h3>🐞 Bugfixes</h3> <ul> <li>Preserve x/y coordinate of 0 in dbus/glib url() (round-trip crash on x=0) by <a href="https://github.com/gaoflow"><code>@gaoflow</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1663">caronc/apprise#1663</a></li> <li>Allow RFC 3986 path characters that are safe to leave unencoded by <a href="https://github.com/Sanjays2402"><code>@Sanjays2402</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1673">caronc/apprise#1673</a></li> <li>small bugfix in splunk entity_id handling on url in <a href="https://redirect.github.com/caronc/apprise/pull/1688">caronc/apprise#1688</a></li> <li>Fix Microsoft Workflows CU-routed webhooks by <a href="https://github.com/Sanjays2402"><code>@Sanjays2402</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1676">caronc/apprise#1676</a></li> <li>Return None from parse_url() on malformed authority content (<a href="https://redirect.github.com/caronc/apprise/issues/1693">#1693</a>) by <a href="https://github.com/youdie006"><code>@youdie006</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1694">caronc/apprise#1694</a></li> <li>fix issue causing in memory email attachments to fail by <a href="https://github.com/kevinfeyrer"><code>@kevinfeyrer</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1696">caronc/apprise#1696</a></li> </ul> <h3>💡 Features</h3> <ul> <li>Improved handling matrix message splitting in <a href="https://redirect.github.com/caronc/apprise/pull/1687">caronc/apprise#1687</a></li> <li>feat(bark): add AES-GCM encryption by <a href="https://github.com/IceCodeNew"><code>@IceCodeNew</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1684">caronc/apprise#1684</a></li> <li>fix(docs): CLI file attachments feature by <a href="https://github.com/egvimo"><code>@egvimo</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1678">caronc/apprise#1678</a></li> <li>Support for Telegram rich message support in <a href="https://redirect.github.com/caronc/apprise/pull/1690">caronc/apprise#1690</a></li> </ul> <h3>❤️ Life-Cycle Support</h3> <ul> <li>Fix grammar and tiny errors in README.md by <a href="https://github.com/notrudyyy"><code>@notrudyyy</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1674">caronc/apprise#1674</a></li> <li>docs: quote pip extras install examples by <a href="https://github.com/nyxst4ck"><code>@nyxst4ck</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1679">caronc/apprise#1679</a></li> <li>Decomissioned legacy service NotificationApi by <a href="https://github.com/lipusal"><code>@lipusal</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1665">caronc/apprise#1665</a></li> <li>Fixed warnings emitted while running test suite in <a href="https://redirect.github.com/caronc/apprise/pull/1689">caronc/apprise#1689</a></li> <li>Proxy documentation added to man page in <a href="https://redirect.github.com/caronc/apprise/pull/1691">caronc/apprise#1691</a></li> <li>Updated github-action references to latest in <a href="https://redirect.github.com/caronc/apprise/pull/1692">caronc/apprise#1692</a></li> <li>Add Italian translation by <a href="https://github.com/albanobattistella"><code>@albanobattistella</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1670">caronc/apprise#1670</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/gaoflow"><code>@gaoflow</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1663">caronc/apprise#1663</a></li> <li><a href="https://github.com/TheGlenn88"><code>@TheGlenn88</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1680">caronc/apprise#1680</a></li> <li><a href="https://github.com/egvimo"><code>@egvimo</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1678">caronc/apprise#1678</a></li> <li><a href="https://github.com/nyxst4ck"><code>@nyxst4ck</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1679">caronc/apprise#1679</a></li> <li><a href="https://github.com/notrudyyy"><code>@notrudyyy</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1674">caronc/apprise#1674</a></li> <li><a href="https://github.com/hchouhan"><code>@hchouhan</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1671">caronc/apprise#1671</a></li> <li><a href="https://github.com/IceCodeNew"><code>@IceCodeNew</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1684">caronc/apprise#1684</a></li> <li><a href="https://github.com/Sanjays2402"><code>@Sanjays2402</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1673">caronc/apprise#1673</a></li> <li><a href="https://github.com/lipusal"><code>@lipusal</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1665">caronc/apprise#1665</a></li> <li><a href="https://github.com/albanobattistella"><code>@albanobattistella</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1670">caronc/apprise#1670</a></li> <li><a href="https://github.com/youdie006"><code>@youdie006</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1694">caronc/apprise#1694</a></li> <li><a href="https://github.com/kevinfeyrer"><code>@kevinfeyrer</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1696">caronc/apprise#1696</a></li> </ul> <h2>Installation</h2> <p>Apprise is available <a href="https://pypi.org/project/apprise/">on PyPI</a> through <em>pip</em>:</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/caronc/apprise/commit/cf17bc9ecd2686c62b548b4577b6e06839331a60"><code>cf17bc9</code></a> bumped version to v1.13.0</li> <li><a href="https://github.com/caronc/apprise/commit/c41f802190ff07a71edb98683c2094f04b5b9fc2"><code>c41f802</code></a> in-memory email attachments no longer fail (<a href="https://redirect.github.com/caronc/apprise/issues/1696">#1696</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/6ebddd3a19a9076d1c0feca410f5e61bf9c927f5"><code>6ebddd3</code></a> Return None from parse_url() on malformed authority content (<a href="https://redirect.github.com/caronc/apprise/issues/1694">#1694</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/6b8cb1364360c9af61190faa248d0ef4187daaa0"><code>6b8cb13</code></a> Add Italian translation (<a href="https://redirect.github.com/caronc/apprise/issues/1670">#1670</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/468d26f3b49c4de8dd21a44f1db99288c79247f6"><code>468d26f</code></a> Updated github-action plugins to latest supported versions (<a href="https://redirect.github.com/caronc/apprise/issues/1692">#1692</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/73c8512a5c518e4c601d6a32c53feabbc2a9e0fa"><code>73c8512</code></a> Support for Telegram rich message support (<a href="https://redirect.github.com/caronc/apprise/issues/1690">#1690</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/fac5056b8cb50d725f83744ff26636ded60f9f46"><code>fac5056</code></a> fixed issue causing time based xmpp tests to randomly fail</li> <li><a href="https://github.com/caronc/apprise/commit/2c48a87d1bfb5f5afa6a40775f6d3fb8fef2d2e4"><code>2c48a87</code></a> Proxy documentation added to man page (<a href="https://redirect.github.com/caronc/apprise/issues/1691">#1691</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/094073af543726a52f29672f31ca060f2f8e31b0"><code>094073a</code></a> relaxed and improved on unit-tests time restrictions</li> <li><a href="https://github.com/caronc/apprise/commit/cc2dffb3ccc6a6ee4cf0a6979c9881fe06b43b78"><code>cc2dffb</code></a> Fixed warnings emitted while running test suite (<a href="https://redirect.github.com/caronc/apprise/issues/1689">#1689</a>)</li> <li>Additional commits viewable in <a href="https://github.com/caronc/apprise/compare/v1.12.0...v1.13.0">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.51.12 to 4.52.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.52.1 - Fix timeout issue with executing scripts</h2> <h2>Fix timeout issue with executing scripts</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/e55bcc7a9f544cbb2ea9ad0c9d4fc358d36c055f">Fix timeout issue with executing scripts in Selenium Mode</a> --> (See the next commit where the fix was moved to a <code>finally</code> block)</li> <li><strong><a href="https://github.com/seleniumbase/SeleniumBase/commit/a5e37fd41813e92ed60cb7554781d5ba3aae6ef4">Improve the earlier commit that fixes the script timeout issue</a></strong> --> (A method that changed the default timeout wasn't resetting it back afterward) --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4467">seleniumbase/SeleniumBase#4467</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/37ace079c94bb9e08d4604387fbce13876ac00fb">Update examples</a> --> (Updates some examples after changes were made on the site being tested)</li> </ul> <h2>What's Changed</h2> <ul> <li>Fix timeout issue with executing scripts by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4468">seleniumbase/SeleniumBase#4468</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.52.0...v4.52.1">https://github.com/seleniumbase/SeleniumBase/compare/v4.52.0...v4.52.1</a></p> <h2>4.52.0 - CDP Mode: Patch 129</h2> <h2>CDP Mode: Patch 129</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/814c21ed7d0e94d459778b32db8be1fe7eb85ba5">Update CDP Mode</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a3f0b5715fdb2d42e8ca53a043c173555f0ce097">Improve output from driver downloads</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/17d723fb302ca7eb8a5604c05306a57688494499">Drop support for Python 3.9</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0b7cc37597bfdc1e008b6176a8cb793760da534a">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/99327cc58df60a9cce7cd0e50588e806d65e90c3">Add scraping examples</a></li> </ul> <h3>Resolutions:</h3> <ul> <li>This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4461">seleniumbase/SeleniumBase#4461</a></li> <li>This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4462">seleniumbase/SeleniumBase#4462</a></li> <li>This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4463">seleniumbase/SeleniumBase#4463</a></li> <li>This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4464">seleniumbase/SeleniumBase#4464</a></li> <li>This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4465">seleniumbase/SeleniumBase#4465</a></li> </ul> <h2>What's Changed</h2> <ul> <li>CDP Mode: Patch 129 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4466">seleniumbase/SeleniumBase#4466</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.51.12...v4.52.0">https://github.com/seleniumbase/SeleniumBase/compare/v4.51.12...v4.52.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/c71edd581a72bfe46a21c1099a39f2ef8af5aa04"><code>c71edd5</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4468">#4468</a> from seleniumbase/fix-timeout-issue-with-executing-s...</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a5e37fd41813e92ed60cb7554781d5ba3aae6ef4"><code>a5e37fd</code></a> Improve the earlier commit that fixes the script timeout issue</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/cd7b8945ca0298be0f7a8f6578ad4313107ed7c9"><code>cd7b894</code></a> Version 4.52.1</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/37ace079c94bb9e08d4604387fbce13876ac00fb"><code>37ace07</code></a> Update examples</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/e55bcc7a9f544cbb2ea9ad0c9d4fc358d36c055f"><code>e55bcc7</code></a> Fix timeout issue with executing scripts in Selenium mode</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b2207cb2ff3f0849de5ece7b9e81402983f857d5"><code>b2207cb</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4466">#4466</a> from seleniumbase/cdp-mode-patch-129</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0be0f562c918bef4c27ab19c5b3068a28aff8835"><code>0be0f56</code></a> Version 4.52.0</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/44e9d8564ce6afd764941219916e464174badac3"><code>44e9d85</code></a> Update the ReadMe</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/99327cc58df60a9cce7cd0e50588e806d65e90c3"><code>99327cc</code></a> Add scraping examples</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0b7cc37597bfdc1e008b6176a8cb793760da534a"><code>0b7cc37</code></a> Refresh Python dependencies</li> <li>Additional commits viewable in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.51.12...v4.52.1">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.4.13 to 0.4.14 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.4.14</h2> <h2>Release Notes</h2> <p>Released on 2026-08-17.</p> <h3>Enhancements</h3> <ul> <li>Support check-yaml unsafe mode (<a href="https://redirect.github.com/j178/prek/pull/2546">#2546</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reuse allocations in common filters (<a href="https://redirect.github.com/j178/prek/pull/2548">#2548</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Accept non-finite floats in check-yaml (<a href="https://redirect.github.com/j178/prek/pull/2545">#2545</a>)</li> <li>Allow comment-heavy YAML in check-yaml (<a href="https://redirect.github.com/j178/prek/pull/2554">#2554</a>)</li> <li>Sanitize captured terminal output before replay (<a href="https://redirect.github.com/j178/prek/pull/2552">#2552</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178"><code>@j178</code></a></li> </ul> <h2>Install prek 0.4.14</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.14/prek-installer.ps1 | iex" </code></pre> <h3>Install prebuilt binaries via Homebrew</h3> <pre lang="sh"><code>brew install prek </code></pre> <h2>Download prek 0.4.14</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.4.14/prek-aarch64-apple-darwin.tar.gz">prek-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.4.14/prek-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.4.14/prek-x86_64-apple-darwin.tar.gz">prek-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.4.14/prek-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.4.14/prek-aarch64-pc-windows-msvc.zip">prek-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://github.com/j178/prek/releases/download/v0.4.14/prek-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/master/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.4.14</h2> <p>Released on 2026-08-17.</p> <h3>Enhancements</h3> <ul> <li>Support check-yaml unsafe mode (<a href="https://redirect.github.com/j178/prek/pull/2546">#2546</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reuse allocations in common filters (<a href="https://redirect.github.com/j178/prek/pull/2548">#2548</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Accept non-finite floats in check-yaml (<a href="https://redirect.github.com/j178/prek/pull/2545">#2545</a>)</li> <li>Allow comment-heavy YAML in check-yaml (<a href="https://redirect.github.com/j178/prek/pull/2554">#2554</a>)</li> <li>Sanitize captured terminal output before replay (<a href="https://redirect.github.com/j178/prek/pull/2552">#2552</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178"><code>@j178</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/432eeb08a4d9fe760817ce8d3d75ed3ebf7d3943"><code>432eeb0</code></a> Bump version to 0.4.14 (<a href="https://redirect.github.com/j178/prek/issues/2571">#2571</a>)</li> <li><a href="https://github.com/j178/prek/commit/6b6d429319dabac1911b26ce6cb6f04bb814951a"><code>6b6d429</code></a> Update Rust crate ignore to v0.4.33 (<a href="https://redirect.github.com/j178/prek/issues/2564">#2564</a>)</li> <li><a href="https://github.com/j178/prek/commit/27d0cf8cb309f7b889d2b355254dc96957bbd60c"><code>27d0cf8</code></a> Update prek hooks (<a href="https://redirect.github.com/j178/prek/issues/2555">#2555</a>)</li> <li><a href="https://github.com/j178/prek/commit/aaf407bb098b624620eac3855e6818b3fa2c4ab0"><code>aaf407b</code></a> Update Rust crate aws-lc-rs to v1.18.0 (<a href="https://redirect.github.com/j178/prek/issues/2569">#2569</a>)</li> <li><a href="https://github.com/j178/prek/commit/3ddddfd494b87dc0ddee4e7694d1ead3ac4277b7"><code>3ddddfd</code></a> Update Rust crate xml to v1.4.0 (<a href="https://redirect.github.com/j178/prek/issues/2570">#2570</a>)</li> <li><a href="https://github.com/j178/prek/commit/fc90ec6c8a7b1519691b221bae5224064248a37d"><code>fc90ec6</code></a> Update Rust crate similar to v3.1.2 (<a href="https://redirect.github.com/j178/prek/issues/2567">#2567</a>)</li> <li><a href="https://github.com/j178/prek/commit/50e60d412350fcef8bc9e50755bd4ea357a45328"><code>50e60d4</code></a> Update Rust crate thiserror to v2.0.20 (<a href="https://redirect.github.com/j178/prek/issues/2568">#2568</a>)</li> <li><a href="https://github.com/j178/prek/commit/70a4c0635352987f55b995ecd768f1e8a2f9c9db"><code>70a4c06</code></a> Update Rust crate liblzma to v0.4.8 (<a href="https://redirect.github.com/j178/prek/issues/2565">#2565</a>)</li> <li><a href="https://github.com/j178/prek/commit/7b8dcaa4579449a9a656889398e7d380bd117b08"><code>7b8dcaa</code></a> Update Rust crate globset to v0.4.20 (<a href="https://redirect.github.com/j178/prek/issues/2563">#2563</a>)</li> <li><a href="https://github.com/j178/prek/commit/3e075d33a5584a8b0f467c39eac3833a8efd4da2"><code>3e075d3</code></a> Update Rust crate clap_complete to v4.6.9 (<a href="https://redirect.github.com/j178/prek/issues/2562">#2562</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.4.13...v0.4.14">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.3 to 0.16.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.4</h2> <h2>Release Notes</h2> <p>Released on 2026-08-20.</p> <h3>Preview features</h3> <ul> <li>[<code>flake8-use-pathlib</code>] Add autofix for <code>PTH116</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/26460">#26460</a>)</li> <li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to lists (<code>FURB131</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27711">#27711</a>)</li> <li>[<code>refurb</code>] Skip <code>FURB101</code> and <code>FURB103</code> when the <code>open</code> argument is a file descriptor (<a href="https://redirect.github.com/astral-sh/ruff/pull/27643">#27643</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not support <code>POPCNT</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27803">#27803</a>)</li> <li>[<code>pyflakes</code>] Emit semantic syntax errors in string type definitions as <code>F722</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27835">#27835</a>)</li> <li>[<code>pylint</code>] Allow <code>os._exit</code> imports in <code>import-private-name</code> (<code>PLC2701</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27738">#27738</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27766">#27766</a>)</li> <li>[<code>ruff</code>] Add <code>ctypes.LittleEndianStructure</code> and related types to existing exception (<code>RUF012</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27753">#27753</a>)</li> <li>[syntax-errors] Detect duplicate keyword arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/17804">#17804</a>)</li> <li>[syntax-errors] Detect parameters declared <code>nonlocal</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27628">#27628</a>)</li> </ul> <h3>Server</h3> <ul> <li>Offer display-only fixes and mark safe fixes preferred (<a href="https://redirect.github.com/astral-sh/ruff/pull/27807">#27807</a>)</li> <li>Support pull diagnostics for notebook cells (<a href="https://redirect.github.com/astral-sh/ruff/pull/27779">#27779</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add default indicator to rules table (<a href="https://redirect.github.com/astral-sh/ruff/pull/27724">#27724</a>)</li> <li>Fix broken link to Python docs (<a href="https://redirect.github.com/astral-sh/ruff/pull/27757">#27757</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Fix s390x stacker assembly in release builds (<a href="https://redirect.github.com/astral-sh/ruff/pull/27776">#27776</a>)</li> <li>Guarantee minimum stack size when parsing a module, standalone expression, and suites (<a href="https://redirect.github.com/astral-sh/ruff/pull/25464">#25464</a>)</li> <li>Reduce configuration deserialization code size (<a href="https://redirect.github.com/astral-sh/ruff/pull/27924">#27924</a>)</li> <li>Check packed AST index bounds (<a href="https://redirect.github.com/astral-sh/ruff/pull/27849">#27849</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AbhinavMir"><code>@AbhinavMir</code></a></li> <li><a href="https://github.com/eduardorittner"><code>@eduardorittner</code></a></li> <li><a href="https://github.com/royb3"><code>@royb3</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@MichaReiser</code></a></li> <li><a href="https://github.com/carljm"><code>@carljm</code></a></li> <li><a href="https://github.com/rosstitmarsh"><code>@rosstitmarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.4</h2> <p>Released on 2026-08-20.</p> <h3>Preview features</h3> <ul> <li>[<code>flake8-use-pathlib</code>] Add autofix for <code>PTH116</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/26460">#26460</a>)</li> <li>[<code>refurb</code>] Restrict <code>delete-full-slice</code> to lists (<code>FURB131</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27711">#27711</a>)</li> <li>[<code>refurb</code>] Skip <code>FURB101</code> and <code>FURB103</code> when the <code>open</code> argument is a file descriptor (<a href="https://redirect.github.com/astral-sh/ruff/pull/27643">#27643</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix <code>InvalidInstruction</code> on Windows CPUs that do not support <code>POPCNT</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27803">#27803</a>)</li> <li>[<code>pyflakes</code>] Emit semantic syntax errors in string type definitions as <code>F722</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27835">#27835</a>)</li> <li>[<code>pylint</code>] Allow <code>os._exit</code> imports in <code>import-private-name</code> (<code>PLC2701</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27738">#27738</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27766">#27766</a>)</li> <li>[<code>ruff</code>] Add <code>ctypes.LittleEndianStructure</code> and related types to existing exception (<code>RUF012</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27753">#27753</a>)</li> <li>[syntax-errors] Detect duplicate keyword arguments (<a href="https://redirect.github.com/astral-sh/ruff/pull/17804">#17804</a>)</li> <li>[syntax-errors] Detect parameters declared <code>nonlocal</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/27628">#27628</a>)</li> </ul> <h3>Server</h3> <ul> <li>Offer display-only fixes and mark safe fixes preferred (<a href="https://redirect.github.com/astral-sh/ruff/pull/27807">#27807</a>)</li> <li>Support pull diagnostics for notebook cells (<a href="https://redirect.github.com/astral-sh/ruff/pull/27779">#27779</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add default indicator to rules table (<a href="https://redirect.github.com/astral-sh/ruff/pull/27724">#27724</a>)</li> <li>Fix broken link to Python docs (<a href="https://redirect.github.com/astral-sh/ruff/pull/27757">#27757</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Fix s390x stacker assembly in release builds (<a href="https://redirect.github.com/astral-sh/ruff/pull/27776">#27776</a>)</li> <li>Guarantee minimum stack size when parsing a module, standalone expression, and suites (<a href="https://redirect.github.com/astral-sh/ruff/pull/25464">#25464</a>)</li> <li>Reduce configuration deserialization code size (<a href="https://redirect.github.com/astral-sh/ruff/pull/27924">#27924</a>)</li> <li>Check packed AST index bounds (<a href="https://redirect.github.com/astral-sh/ruff/pull/27849">#27849</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/AbhinavMir"><code>@AbhinavMir</code></a></li> <li><a href="https://github.com/eduardorittner"><code>@eduardorittner</code></a></li> <li><a href="https://github.com/royb3"><code>@royb3</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@MichaReiser</code></a></li> <li><a href="https://github.com/carljm"><code>@carljm</code></a></li> <li><a href="https://github.com/rosstitmarsh"><code>@rosstitmarsh</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/zaniebot"><code>@zaniebot</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/11c76bf48fdac06b2f240cba502eda96da4dce77"><code>11c76bf</code></a> Bump 0.16.4 (<a href="https://redirect.github.com/astral-sh/ruff/issues/27937">#27937</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d53c8c58662ca0576ddd502aa1a2979acf03832f"><code>d53c8c5</code></a> Isolate playground builds from deployment credentials (<a href="https://redirect.github.com/astral-sh/ruff/issues/27839">#27839</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/cab001e5dec22f55653021f1f7be449e47c7d81e"><code>cab001e</code></a> Disable uv preview for releases and pre-commit hooks (<a href="https://redirect.github.com/astral-sh/ruff/issues/27939">#27939</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/f8d575fedc97e75ea62c679d77afb14246afa88e"><code>f8d575f</code></a> [ty] Clarify writing guidance for human readers (<a href="https://redirect.github.com/astral-sh/ruff/issues/27912">#27912</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ca45faebb1750a213df19ed7f686ee5cf9277f93"><code>ca45fae</code></a> Set <code>--preview</code> and <code>--default-index</code> for the <code>uv-lock</code> hook (<a href="https://redirect.github.com/astral-sh/ruff/issues/27935">#27935</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/4827bf7cb449055e46fbfaf4b26e5125883a0569"><code>4827bf7</code></a> Export <code>UV_DEFAULT_INDEX</code> in <code>release.sh</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/27934">#27934</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d1087a4b9e03d253a88703f34e0869ee4b805456"><code>d1087a4</code></a> [ty] Handle assignment expressions in string annotations (<a href="https://redirect.github.com/astral-sh/ruff/issues/27921">#27921</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/680cce48b6d89ab5b1566e4b797bd4847d861815"><code>680cce4</code></a> [ty] Optimize inherited recursive protocol comparisons (<a href="https://redirect.github.com/astral-sh/ruff/issues/27922">#27922</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/974d3cbc04520c112843d6b92577844587402e04"><code>974d3cb</code></a> Upgrade ecosystem-analyzer and mypy_primer to the latest upstream pins (<a href="https://redirect.github.com/astral-sh/ruff/issues/27932">#27932</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/b169b402356d0676451f4a7bc6903da2644b31eb"><code>b169b40</code></a> Install cargo tools locked (<a href="https://redirect.github.com/astral-sh/ruff/issues/27929">#27929</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.3...0.16.4">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
95e34670f7 |
fix/group archive extracted audiobooks (#1261)
- fix: group multi-file audiobooks that arrive as an archive - Surface the concrete reason when a direct-download fetch fails |
||
|
CaliBrain
|
7d56624ab6 |
fix: group multi-file audiobooks that arrive as an archive (#1254)
Follow-up to #1237. \`rename_and_group\` only grouped when the source root was a directory, so a multi-file audiobook delivered as a single archive fell through to the flat path: a \`Book.zip\` of twelve chapters landed loose in the destination root with its original chapter names — the layout #1181 is about. The \`is_dir()\` guard was there to keep \`Book.zip/\` from becoming the folder name, but skipping the file case gives up the grouping instead of naming it. A non-directory source can only produce several book files by having been extracted (\`collect_staged_files\` returns a single-element list for every other file shape), so the archive stem is the release name and the suffix is packaging: group under \`Book/\`. Also regenerates the env docs for the new option and gives it the same \"do not use with ingest folders\" caveat Rename and Organize carries, since both now create directories in the destination. Tested: reverting only the source fix makes both new tests fail and the \`rename\` control case pass, so grouping stays opt-in. Full non-e2e suite green (2653 passed). |
||
|
|
f4421ff189 |
fix: preserve multi-file audiobook folders (#1237)
Pass the effective source root from `process_folder_output` into `transfer_book_files`, and have the transfer layer select a sanitized child directory named after that source root when an audiobook has multiple files and its organization mode is `none` or `rename`. Create that grouping directory before applying the existing hardlink/copy/move logic so operation accounting, torrent seeding preservation, collision handling, cleanup, and custom-script final paths continue to use the established production path. Completed multi-file audiobook torrents arrive as a directory whose chapter filenames may not identify the book, but folder output currently sends every discovered chapter directly to the configured destination in `none` and `rename` modes. This flattens chapters from unrelated books together and causes directory-oriented consumers such as Audiobookshelf to interpret individual chapters as separate books. A multi-file audiobook torrent in the default `rename` mode copies or hardlinks all supported chapter files beneath `<destination>/<original torrent directory>/` with their original chapter filenames, and places no chapters directly in the destination root; A multi-file audiobook in `none` mode receives the same source-folder grouping without renaming its chapter files. Fixes #1181 --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
CaliBrain
|
e7007865a4 |
fix(prowlarr): stop turning indexer failures into empty results and 404s (#1251)
Two independent bugs, both from an indexer that Prowlarr proxies rather
than answers for itself: the search never reported that it had failed,
and the grab never resolved what it was handed.
Search. A Torznab search is Prowlarr proxying a live request out to the
tracker, so for a Cloudflare-fronted indexer it waits on FlareSolverr.
The client gave it the 30s budget sized for Prowlarr's own JSON
endpoints, then swallowed every failure -- the timeout, the 429 Prowlarr
returns once it has disabled an indexer, a parse error -- into the same
empty list that means "this indexer has nothing". A cold challenge
routinely runs past a minute, so the UI said "No releases found for this
book" while FlareSolverr was still solving. That empty list also drove
the auto-expand retry, which fires on "no results with the category
filter". A timeout satisfies it, so Shelfmark sent a second search to an
indexer still busy with the first -- two Chromes at once, enough to take
FlareSolverr's down on a small host.
torznab_search now raises ProwlarrSearchError, and an empty list
strictly
means the indexer answered with no matches. The source records which
indexer searches failed: one dead indexer no longer sinks the others,
auto-expand runs only when every indexer genuinely answered, and zero
results with at least one failure raises SourceUnavailableError, which
the releases endpoint already turns into a 503 carrying a real message.
Prowlarr being unreachable was the same lie by another route -- the
indexer list came back empty, leaving nothing to query -- and now says
so.
Indexer searches also get their own timeout, PROWLARR_INDEXER_TIMEOUT,
defaulting to 90s and clamped to 5-300. Prowlarr's status and indexer
list keep 30s so Test Connection stays responsive, and the connect
timeout is split out at 10s so an unreachable Prowlarr fails fast rather
than hanging for the whole read budget. The overall per-request search
budget now scales to twice the indexer timeout, capped at 240s, so
raising the setting is not undone by the cap one level up while staying
under the 300s gunicorn worker timeout.
Grab. Prowlarr hands out a proxy download URL, with no magnetUrl and no
infoHash, for any indexer that only publishes torrent files. The native
Real-Debrid client built its magnet as "if not
url.startswith('magnet:') and expected_hash", so with no hash to work
from it left the URL alone and POSTed it to /torrents/addMagnet as the
magnet field. Real-Debrid answered 404 and the grab died on a raw HTTP
error. AllDebrid carried the same line and the same bug.
Both now resolve the URL first, through the extract_torrent_info path
the
torrent clients have used since #1108: pass a magnet through untouched,
follow a redirect or a response body that turns out to be a magnet,
otherwise upload the fetched .torrent, and fall back to a magnet built
from the infoHash only when the fetch failed. The file is preferred over
a synthesized urn:btih: magnet because it carries the tracker list; a
bare hash leaves the service to find the swarm on DHT alone. Fetches are
shared with the rest of the add path through the torrent fetch cache, so
resolving costs at most one request. Real-Debrid takes the file on PUT
/torrents/addTorrent with the raw bytes as the request body, AllDebrid
on
POST /magnet/upload/file as multipart files[]. A URL that resolves to
neither form now raises before any request reaches the service, so the
user reads why instead of a 404. Neither debrid client had any test
coverage; both have some now.
Fixes #1249
Fixes #1250
|
||
|
CaliBrain
|
5b3df2a463 |
docs(hardcover): list the API key scopes Shelfmark needs (#1243)
Hardcover's August 2026 token system replaced blanket access with per-token scopes, and nothing in the docs said which ones Shelfmark actually uses. A key missing write:library or write:lists still passes Test Connection -- the reading-status and auto-remove-on-download calls just fail silently afterwards. Verified against a live hc_pat_ key: every scope in the table backs a query or mutation the provider really issues, and the omitted ones (journal, goals, reviews, prompts, notifications, account) are absent from the provider entirely. Refs #1240v1.3.11 |
||
|
CaliBrain
|
5247ec6124 |
fix(bypass): close the gaps a helper that outlives its request opened (#1244)
assumptions the code around it still made were written for a helper that was killed after every request. A bypass that hits the child's deadline is cancelled from the calling thread, which returns the moment the cancellation is scheduled - so the helper went on to serve the next request while the abandoned one was still closing its browser, on the same loop, sharing the DISPLAY globals and one process group. The deadline now lives inside the loop, where asyncio.wait_for() waits for the unwind before it raises, with the calling thread keeping a bounded backstop in case the cleanup wedges too. Both budgets are set so the child still answers before the parent gives up on it. The helper's cookie store survived the request as well, and the whole of it is exported back to the parent on every answer - so clearance the parent had purged for one host came back the next time some other host was solved, the dead-cookie resurrection _redirect_loop_handoff purges to avoid. The child starts each request from an empty store again; the parent already runs the cached-cookie check against a superset of it. DNS config is compared against what the helper is actually resolving through rather than skipped whenever the parent reports "auto", so a user flipping CUSTOM_DNS back to auto - which applies live - reaches a warm helper instead of leaving it on an abandoned DoH resolver. The 15s exit grace is now asked only of a helper that can still read its stdin. One dropped mid-bypass never returns to that read, so the grace could only end in the kill - while a user cancelling a download, and every bypass queued behind them on LOCKED, waited it out. Result files are cleaned on the timeout and cancellation paths too, staging file included, rather than only when the answer was read. |
||
|
CaliBrain
|
bd21ec1257 |
fix(audiobookbay): search the ASCII punctuation ABB actually stores (#1242)
WordPress texturizes punctuation on output only, so a post stored as "The Stranger's Wife" renders as "The Stranger’s Wife". ABB's search matches the stored value and ANDs its terms, so one typographic character in the query empties the entire result set rather than merely ranking worse. Book metadata and mobile keyboards both hand us those characters. Map curly quotes, dashes and ellipses to ASCII before a query goes out, and on both sides of the relevance comparison, since scraped titles carry the rendered forms. Release titles are still stored and displayed exactly as ABB renders them; only matching normalizes. Also percent-encode the search query properly. The hand-rolled encoder only escaped double quotes and spaces, so a bare "&" started a new query parameter and silently truncated the search: "detective dan riley books 1 & 2 weatherley" reached ABB as "detective dan riley books 1" and returned six confident-looking results without the requested book among them. "%" and "+" were mangled too. |
||
 helgehelge123andhelgehelge123
|
7b9c416df8 |
perf(bypass): keep the helper subprocess alive between bypasses (#1222)
Every protected request spawns a fresh helper subprocess, paying interpreter start and imports before any work begins. Measured inside the container, five consecutive runs of `python -c "import shelfmark.bypass.internal_bypasser"`: ``` 3.53s 3.45s 3.55s 3.54s 3.46s ``` A single search issues several protected requests, so that is paid several times over per search. ## What changed The helper now serves one JSON request per line of stdin until the parent closes the pipe, and an idle timer (`BYPASS_BROWSER_IDLE_TIMEOUT`, default 180s) shuts it down once searching stops. Answers still travel by result file, but the file is now written to a `.part` path and renamed into place — the parent treats the file's existence as the answer, so it must never observe a half-written one. stdout and stderr stay attached to the parent's, so helper logs keep appearing in `docker logs` exactly as before. Failure handling, since a warm helper is exposed to more of it than a per-request one ever was: | Situation | Handling | | --- | --- | | Helper died between requests | Detected via `poll()`, respawned | | Pipe broken at write time (`poll()` can miss this) | One retry on a fresh process; a fresh one failing there is a real failure | | Helper exits without writing a result | `RuntimeError` naming the exit code | | Wedged past the timeout, or cancelled mid-bypass | Helper killed, then `_cleanup_orphan_processes` because a killed helper never got to close Chrome | | Idle reaper racing an arriving request | Re-checks the deadline under the lock and re-arms instead of killing a helper that just did work | The DNS config now travels with every request rather than only at spawn: a warm helper outlives changes the parent makes to its provider. ## `BYPASS_REUSE_BROWSER`, off by default This parks the CDP driver between bypasses. A driver's websockets are bound to the loop that opened them and cannot outlive their process, so the persistent helper is what makes this possible at all — and the warm path runs on `_CDP_WORKER`'s long-lived loop rather than `asyncio.run` for the same reason. The mechanism works. With it on, the browser start disappears from the second request onward: 0.7s from `Reusing warm Chrome browser` to the first bypass attempt, against roughly 16s cold. **It still ships off, because a matched-pair test shows it is a net loss against DDoS-Guard.** Each round primed with one cold bypass, waited 10s, then measured a second — identical timing in both arms, only the browser strategy differing, order balanced (fresh, warm, warm, fresh) so drift over the session cannot masquerade as an effect: | Arm | Measured request | | --- | --- | | fresh browser | 42.8s, 40.6s | | warm browser | 57.1s, 59.6s | Spread within each arm is 2.2s and 2.5s, against 16.7s between them. Reuse removes the ~15s browser start and then gives back roughly twice that in solving: a returning browser draws a harder challenge. Where the cold browser is through on the second bypass method, the warm one fails the first three and only `_bypass_method_humanlike` gets it, at ~30s for that method alone. Worth separating from a second effect I ran into while measuring: five back-to-back searches slow from ~32s to 51–98s with reuse **disabled** as well, so DDoS-Guard escalates on request rate independently of any of this. That is why the pairs above are timed identically rather than simply run in sequence. It is the larger of the two effects, but not something this project can patch around. Reuse is left available rather than dropped because Cloudflare sites may not respond the same way, and because the two concerns are independent: the helper start is pure overhead and always worth removing, the browser is not. ## Verification - 2559 unit tests pass (2542 before, 17 added in `tests/bypass/test_warm_browser.py`) - `ruff check`, `ruff format`, `basedpyright` over backend and tests, and `vulture` all clean - `docs/environment-variables.md` regenerated via `scripts/generate_env_docs.py` - Live against Anna's Archive on a warm helper: searches return their usual ~760KB and 667 results, the app's own search warm-up completes with 50 results, and the container is left with no orphan chrome/Xvfb/ffmpeg processes Happy to drop the `BYPASS_REUSE_BROWSER` half entirely if you would rather not carry a default-off path — the helper persistence stands on its own. Co-authored-by: helgehelge123 <helge.neumann@zollsoft.de> |
||
|
CaliBrain
|
646b531669 |
fix(hardcover): accept the short hc_pat_ keys Hardcover issues now (#1241)
Hardcover replaced its ~500 char JWTs with short opaque personal access
tokens ("hc_pat_..."), and the connection test rejected anything under
100 chars before a request ever left Shelfmark, so every newly created
key failed with "API key seems too short".
The length floor now applies only to keys without the hc_pat_ prefix; a
prefixed key goes straight to Hardcover, which is the authority on
whether it is valid. Also strip a pasted "bearer " prefix regardless of
casing -- Hardcover's docs tell users to paste the token into an
"authorization" header, so the prefix rides along on the copy, and the
old case-sensitive removeprefix() sent it through as part of the token.
The API key field now names the expected shape.
Note that Hardcover's PAT path currently answers every hc_pat_ token
with a 500, a fabricated one included, while non-PAT tokens still get a
clean 401. So a new key cannot connect yet regardless of this change --
that failure is server-side and not something this code can reach.
Refs #1240
|
||
|
dependabot[bot]
|
eafb965662 |
build(deps): bump qbittorrent-api from 2026.8.0 to 2026.8.1 in the python-deps group (#1236)
Bumps the python-deps group with 1 update: [qbittorrent-api](https://github.com/rmartin16/qbittorrent-api). Updates `qbittorrent-api` from 2026.8.0 to 2026.8.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rmartin16/qbittorrent-api/releases">qbittorrent-api's releases</a>.</em></p> <blockquote> <h2>release-2026.8.1</h2> <h2>What's Changed</h2> <h3>Features</h3> <ul> <li>feat: add missing <code>torrents/add</code> and <code>torrents/reannounce</code> parameters by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/656">rmartin16/qbittorrent-api#656</a></li> <li>feat: add endpoints shipped in qBittorrent v5.2.x by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/658">rmartin16/qbittorrent-api#658</a></li> </ul> <h3>Fixes</h3> <ul> <li>fix: accept and forward <code>**kwargs</code> on all API methods by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/655">rmartin16/qbittorrent-api#655</a></li> <li>fix: send <code>seedMode</code> for <code>is_skip_checking</code> on Web API v2.16.0 by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/654">rmartin16/qbittorrent-api#654</a></li> <li>docs: correct version annotations by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/657">rmartin16/qbittorrent-api#657</a></li> </ul> <h3>Chores</h3> <ul> <li>Bump cryptography from 48.0.1 to 50.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/652">rmartin16/qbittorrent-api#652</a></li> <li>retire codeql by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/660">rmartin16/qbittorrent-api#660</a></li> <li>remove xfail for previous python 3.15 issue by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/638">rmartin16/qbittorrent-api#638</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rmartin16/qbittorrent-api/compare/v2026.8.0...v2026.8.1">https://github.com/rmartin16/qbittorrent-api/compare/v2026.8.0...v2026.8.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rmartin16/qbittorrent-api/blob/main/CHANGELOG.md">qbittorrent-api's changelog</a>.</em></p> <blockquote> <h3>v2026.8.1 (16 aug 2026)</h3> <ul> <li>Add support for <code>app/rotateAPIKey</code> and <code>app/deleteAPIKey</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add support for <code>torrents/SSLParameters</code> and <code>torrents/setSSLParameters</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add support for <code>torrents/fetchMetadata</code>, <code>torrents/parseMetadata</code>, and <code>torrents/saveMetadata</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add support for <code>torrents/pieceAvailability</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add support for <code>clientdata/load</code> and <code>clientdata/store</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add <code>file_priorities</code> and <code>downloader</code> for <code>torrents/add</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/656">#656</a>)</li> <li>Add <code>urls</code> for <code>torrents/reannounce</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/656">#656</a>)</li> <li>Fix <code>is_skip_checking</code> for <code>torrents/add</code> being ignored by qBittorrent v5.3.0 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/654">#654</a>)</li> <li>Fix missing <code>**kwargs</code> for several endpoints (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/655">#655</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/97e5f577df0bcfd4a7986c79e8d21e88ae8e64d0"><code>97e5f57</code></a> bump to v2026.8.1 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/661">#661</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/39e05d109dbb427b1e75a33fc96903ee22e3abd3"><code>39e05d1</code></a> remove xfail for previous python 3.15 issue (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/638">#638</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/0c067fdd356b3c2da0cdfbc1501c3badeb697e22"><code>0c067fd</code></a> feat: add endpoints shipped in qBittorrent v5.2.x (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/64f65eacb62d33b54449ef413047779f6d766022"><code>64f65ea</code></a> fix: send seedMode for is_skip_checking on Web API v2.16.0 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/654">#654</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/f302ac473a66d3943878bf8491080f3ab800264e"><code>f302ac4</code></a> docs: correct version annotations (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/657">#657</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/cd9650277f572d26b1c2c09ff8e86a9917cfe435"><code>cd96502</code></a> feat: add missing torrents/add and torrents/reannounce parameters (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/656">#656</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/7ed08865b11e6f57c7ef0395e8d929c8842de340"><code>7ed0886</code></a> fix: accept and forward **kwargs on all API methods (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/655">#655</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/0b293e28356e74b3aead64ac3fd1e02e85d5de87"><code>0b293e2</code></a> retire codeql (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/660">#660</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/fd276e2d918c31d78528acc280fbbd36b354cf88"><code>fd276e2</code></a> Bump cryptography from 48.0.1 to 50.0.0 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/652">#652</a>)</li> <li>See full diff in <a href="https://github.com/rmartin16/qbittorrent-api/compare/v2026.8.0...v2026.8.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
7193036626 |
fix(rtorrent): apply the audiobook label to audiobook downloads (#1239)
add_download() picks self._audiobook_label from a content_type kwarg, but the only call site never passed one, so is_audiobook was always False and every download got RTORRENT_LABEL. category does not fill the gap: _get_category_for_task() returns None for rTorrent, which has no category concept, leaving content_type as its only audiobook signal. Pass task.content_type through from base_handler, and match it with the shared is_audiobook() helper instead of == "audiobook". normalize_content_type() treats "book (audiobook)" as an audiobook, so the exact-string check would have mislabeled that value even once it arrived. The existing rTorrent tests passed content_type straight to the client, which is why nothing caught the missing wiring; the new handler test covers the call site itself. Post-processing was never affected: destination.py reads task.content_type directly, so files already landed in DESTINATION_AUDIOBOOK correctly. Fixes #1235 |
||
|
CaliBrain
|
12d554a92f |
fix(download): hand a 503 carrying a challenge to the bypasser (#1238)
503 is in RETRYABLE_CODES, and the bypasser is only ever reached from the 403 branch and the AA redirect-loop rescues. Once Z-Library re-serves its DDoS-Guard interstitial with the same cookie the #1188 handshake already echoed back, the request has nothing left to try and spends every attempt on the same wall. Gate the handoff on the response body rather than the status, so a genuine overloaded-origin 503 keeps its retry path, and on allow_bypasser_fallback, so best-effort fetches still fail fast. The challenge indicators move out of internal_bypasser into shelfmark/bypass/challenge.py so http.py can use them without importing SeleniumBase, which is lazily imported precisely because it is optional. Refs #1233 |
||
|
CaliBrain
|
fae6140c6a |
fix(bypass): scope browser cleanup to the calling session (#1232)
The orphan sweep ran a container-wide 'pkill -9 -f chrome|chromium|Xvfb|ffmpeg', so it also matched browsers another bypass was still driving. Scope it by process group: kill only our own group and groups whose leader has died. Spawn the helper with start_new_session so its browser tree is identifiable, tear the whole group down after every run (a timed-out helper used to leak its Chrome and Xvfb), and have an orphaned helper take its browser down with it. Fixes #1231.v1.3.10 |
||
|
dependabot[bot]
|
63133097e4 |
build(deps): update httpx[http2] requirement from >=0.27 to >=0.28.1 (#1227)
Updates the requirements on [httpx[http2]](https://github.com/encode/httpx) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/encode/httpx/releases">httpx[http2]'s releases</a>.</em></p> <blockquote> <h2>Version 0.28.1</h2> <h2>0.28.1 (6th December, 2024)</h2> <ul> <li>Fix SSL case where <code>verify=False</code> together with client side certificates.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/encode/httpx/blob/master/CHANGELOG.md">httpx[http2]'s changelog</a>.</em></p> <blockquote> <h2>0.28.1 (6th December, 2024)</h2> <ul> <li>Fix SSL case where <code>verify=False</code> together with client side certificates.</li> </ul> <h2>0.28.0 (28th November, 2024)</h2> <p>Be aware that the default <em>JSON request bodies now use a more compact representation</em>. This is generally considered a prefered style, tho may require updates to test suites.</p> <p>The 0.28 release includes a limited set of deprecations...</p> <p><strong>Deprecations</strong>:</p> <p>We are working towards a simplified SSL configuration API.</p> <p><em>For users of the standard <code>verify=True</code> or <code>verify=False</code> cases, or <code>verify=<ssl_context></code> case this should require no changes. The following cases have been deprecated...</em></p> <ul> <li>The <code>verify</code> argument as a string argument is now deprecated and will raise warnings.</li> <li>The <code>cert</code> argument is now deprecated and will raise warnings.</li> </ul> <p>Our revised <a href="https://github.com/encode/httpx/blob/master/docs/advanced/ssl.md">SSL documentation</a> covers how to implement the same behaviour with a more constrained API.</p> <p><strong>The following changes are also included</strong>:</p> <ul> <li>The deprecated <code>proxies</code> argument has now been removed.</li> <li>The deprecated <code>app</code> argument has now been removed.</li> <li>JSON request bodies use a compact representation. (<a href="https://redirect.github.com/encode/httpx/issues/3363">#3363</a>)</li> <li>Review URL percent escape sets, based on WHATWG spec. (<a href="https://redirect.github.com/encode/httpx/issues/3371">#3371</a>, <a href="https://redirect.github.com/encode/httpx/issues/3373">#3373</a>)</li> <li>Ensure <code>certifi</code> and <code>httpcore</code> are only imported if required. (<a href="https://redirect.github.com/encode/httpx/issues/3377">#3377</a>)</li> <li>Treat <code>socks5h</code> as a valid proxy scheme. (<a href="https://redirect.github.com/encode/httpx/issues/3178">#3178</a>)</li> <li>Cleanup <code>Request()</code> method signature in line with <code>client.request()</code> and <code>httpx.request()</code>. (<a href="https://redirect.github.com/encode/httpx/issues/3378">#3378</a>)</li> <li>Bugfix: When passing <code>params={}</code>, always strictly update rather than merge with an existing querystring. (<a href="https://redirect.github.com/encode/httpx/issues/3364">#3364</a>)</li> </ul> <h2>0.27.2 (27th August, 2024)</h2> <h3>Fixed</h3> <ul> <li>Reintroduced supposedly-private <code>URLTypes</code> shortcut. (<a href="https://redirect.github.com/encode/httpx/issues/2673">#2673</a>)</li> </ul> <h2>0.27.1 (27th August, 2024)</h2> <h3>Added</h3> <ul> <li>Support for <code>zstd</code> content decoding using the python <code>zstandard</code> package is added. Installable using <code>httpx[zstd]</code>. (<a href="https://redirect.github.com/encode/httpx/issues/3139">#3139</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Improved error messaging for <code>InvalidURL</code> exceptions. (<a href="https://redirect.github.com/encode/httpx/issues/3250">#3250</a>)</li> <li>Fix <code>app</code> type signature in <code>ASGITransport</code>. (<a href="https://redirect.github.com/encode/httpx/issues/3109">#3109</a>)</li> </ul> <h2>0.27.0 (21st February, 2024)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/encode/httpx/commit/26d48e0634e6ee9cdc0533996db289ce4b430177"><code>26d48e0</code></a> Version 0.28.1 (<a href="https://redirect.github.com/encode/httpx/issues/3445">#3445</a>)</li> <li><a href="https://github.com/encode/httpx/commit/89599a9541af14bcf906fc4ed58ccbdf403802ba"><code>89599a9</code></a> Fix <code>verify=False</code>, <code>cert=...</code> case. (<a href="https://redirect.github.com/encode/httpx/issues/3442">#3442</a>)</li> <li><a href="https://github.com/encode/httpx/commit/8ecb86f0d74ffc52d4663214fae9526bee89358d"><code>8ecb86f</code></a> Add test for request params behavior changes (<a href="https://redirect.github.com/encode/httpx/issues/3364">#3364</a>) (<a href="https://redirect.github.com/encode/httpx/issues/3440">#3440</a>)</li> <li><a href="https://github.com/encode/httpx/commit/0cb7e5a2e736628e2f506d259fcf0d48cd2bde82"><code>0cb7e5a</code></a> Bump the python-packages group with 11 updates (<a href="https://redirect.github.com/encode/httpx/issues/3434">#3434</a>)</li> <li><a href="https://github.com/encode/httpx/commit/15e21e9ea3cad4f06e22a7e704aabefdf43d2e29"><code>15e21e9</code></a> Updating deprecated docstring Client() class (<a href="https://redirect.github.com/encode/httpx/issues/3426">#3426</a>)</li> <li><a href="https://github.com/encode/httpx/commit/80960fa31918d7663c3f4c3ad61661cf0e80628f"><code>80960fa</code></a> Version 0.28.0. (<a href="https://redirect.github.com/encode/httpx/issues/3419">#3419</a>)</li> <li><a href="https://github.com/encode/httpx/commit/a33c87852b8a0dddc65e5f739af1e0a6fca4b91f"><code>a33c878</code></a> Fix <code>extensions</code> type annotation. (<a href="https://redirect.github.com/encode/httpx/issues/3380">#3380</a>)</li> <li><a href="https://github.com/encode/httpx/commit/ce7e14da27abba6574be9b3ea7cd5990556a9343"><code>ce7e14d</code></a> Error on verify as str. (<a href="https://redirect.github.com/encode/httpx/issues/3418">#3418</a>)</li> <li><a href="https://github.com/encode/httpx/commit/47f4a96ffaaaa07dca1614409549b5d7a6e7af49"><code>47f4a96</code></a> Handle empty zstd responses (<a href="https://redirect.github.com/encode/httpx/issues/3412">#3412</a>)</li> <li><a href="https://github.com/encode/httpx/commit/189fc4bcbe5f314128775dec66a616ac9a31ad48"><code>189fc4b</code></a> Update CHANGELOG.md, fix typo(s) (<a href="https://redirect.github.com/encode/httpx/issues/3406">#3406</a>)</li> <li>Additional commits viewable in <a href="https://github.com/encode/httpx/compare/0.27.0...0.28.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
82aeee387e |
build(deps-dev): bump the python-deps group with 2 updates (#1226)
Bumps the python-deps group with 2 updates: [basedpyright](https://github.com/detachhead/basedpyright) and [ruff](https://github.com/astral-sh/ruff). Updates `basedpyright` from 1.39.9 to 1.39.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/detachhead/basedpyright/releases">basedpyright's releases</a>.</em></p> <blockquote> <h2>v1.39.10 (pyright 1.1.412)</h2> <h2>What's Changed</h2> <ul> <li>add <code>allowedUntypedLibraries</code> and <code>failOnWarnings</code> to <code>pyrightconfig.schema.json</code> by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1851">DetachHead/basedpyright#1851</a></li> <li>Update pycharm setup instructions by <a href="https://github.com/charliecloudberry"><code>@charliecloudberry</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1862">DetachHead/basedpyright#1862</a></li> <li>Merge 1.1.412 by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1869">DetachHead/basedpyright#1869</a></li> <li>fix redundant <code>workspace/configuration</code> request by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1847">DetachHead/basedpyright#1847</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/vmphase"><code>@vmphase</code></a> made their first contribution in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1866">DetachHead/basedpyright#1866</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/DetachHead/basedpyright/compare/v1.39.9...v1.39.10">https://github.com/DetachHead/basedpyright/compare/v1.39.9...v1.39.10</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DetachHead/basedpyright/commit/6d830bac284253dc6587d35eb026a9a30aee7771"><code>6d830ba</code></a> 1.39.10</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/a34496c27eb0805e4ac39976361526c92d6b3f59"><code>a34496c</code></a> fix redundant <code>workspace/configuration</code> request</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/b3074fe4dfa981a1928aebc4d9694ae4e5c03fc9"><code>b3074fe</code></a> fix links in tsp docs</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/979a3fc4d9a86c018a11aeebf17822c468b71ab2"><code>979a3fc</code></a> add <code>nodejs-wheel</code> back as a dev dependency</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/285225059bae1e3d41b7ff198d8f1d3e07b7141a"><code>2852250</code></a> ignore <code>mypy_primer/build</code> in bpr</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/5c4427f639c26a4917747ebd5d133ca425e807cc"><code>5c4427f</code></a> baseline type errors from new upstream python file</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/ae420b5e0cbcad508d93f603282c5e2614d58182"><code>ae420b5</code></a> try to fix primer</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/0e5c88e47a8ee57ab73b37702a72997976706405"><code>0e5c88e</code></a> fixes from merge</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/78adf4f989315b4821d30c3b79f0a0aa3732bb07"><code>78adf4f</code></a> don't support TSP</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/eff463de301edaf268c816a2be618de4c40b6b62"><code>eff463d</code></a> Merge tag '1.1.412' into merge-1.1.412</li> <li>Additional commits viewable in <a href="https://github.com/detachhead/basedpyright/compare/v1.39.9...v1.39.10">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.2 to 0.16.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.3</h2> <h2>Release Notes</h2> <p>Released on 2026-08-13.</p> <h3>Preview features</h3> <ul> <li>[<code>pylint</code>] Fix false negatives on negative numbers (<code>PLR6104</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li> <li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with <code>while True</code> (<code>UP048</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bandit</code>] Also check keyword arguments (<code>S602</code>, <code>S603</code>, <code>S607</code>, <code>S609</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li> <li>[<code>pylint</code>] Allow <code>continue</code> in <code>finally</code> on Python 3.8 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li> <li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with bools (<a href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li> <li>[<code>pylint</code>] Fix false positives and negatives with <code>%b</code> format character (<code>PLE1300</code>, <code>PLE1307</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li> <li>[<code>pylint</code>] Improve handling of concatenated strings (<code>PLE1300</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>numpy</code>] Make <code>np.chararray</code> autofix backwards-compatible (<code>NPY201</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Enable PGO for Linux x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li> <li>Enable PGO for Linux ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li> <li>Enable PGO for Windows x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li> <li>Enable PGO for macOS ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li> <li>Reduce <code>Expr</code> size to 64 bytes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Hyperlink rule codes in <code>ruff check --statistics</code> output (<a href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code> (<code>RUF006</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Use mimalloc v3 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/Andrej730"><code>@Andrej730</code></a></li> <li><a href="https://github.com/alonfaraj"><code>@alonfaraj</code></a></li> <li><a href="https://github.com/romero-deshaw"><code>@romero-deshaw</code></a></li> <li><a href="https://github.com/Avasam"><code>@Avasam</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.3</h2> <p>Released on 2026-08-13.</p> <h3>Preview features</h3> <ul> <li>[<code>pylint</code>] Fix false negatives on negative numbers (<code>PLR6104</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li> <li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with <code>while True</code> (<code>UP048</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bandit</code>] Also check keyword arguments (<code>S602</code>, <code>S603</code>, <code>S607</code>, <code>S609</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li> <li>[<code>pylint</code>] Allow <code>continue</code> in <code>finally</code> on Python 3.8 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li> <li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with bools (<a href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li> <li>[<code>pylint</code>] Fix false positives and negatives with <code>%b</code> format character (<code>PLE1300</code>, <code>PLE1307</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li> <li>[<code>pylint</code>] Improve handling of concatenated strings (<code>PLE1300</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>numpy</code>] Make <code>np.chararray</code> autofix backwards-compatible (<code>NPY201</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Enable PGO for Linux x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li> <li>Enable PGO for Linux ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li> <li>Enable PGO for Windows x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li> <li>Enable PGO for macOS ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li> <li>Reduce <code>Expr</code> size to 64 bytes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Hyperlink rule codes in <code>ruff check --statistics</code> output (<a href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code> (<code>RUF006</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Use mimalloc v3 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/Andrej730"><code>@Andrej730</code></a></li> <li><a href="https://github.com/alonfaraj"><code>@alonfaraj</code></a></li> <li><a href="https://github.com/romero-deshaw"><code>@romero-deshaw</code></a></li> <li><a href="https://github.com/Avasam"><code>@Avasam</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/chirizxc"><code>@chirizxc</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/b0e47022cfce4f3594aa26d15ea792681430b6f6"><code>b0e4702</code></a> Bump 0.16.3 (<a href="https://redirect.github.com/astral-sh/ruff/issues/27723">#27723</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ecdd401fdbc5b0b22e18759c8bd25cda452e8b32"><code>ecdd401</code></a> [ty] Separate script and uv modules from project metadata (<a href="https://redirect.github.com/astral-sh/ruff/issues/27720">#27720</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/126352467217bebfa4cb86fd3c4d20820322d9e3"><code>1263524</code></a> [ty] Simplify display implementations with std::fmt::from_fn (<a href="https://redirect.github.com/astral-sh/ruff/issues/27718">#27718</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/59196baedf23c9876d1fcf1fa2ae78f80d306f94"><code>59196ba</code></a> [ty] Unify polarity-aware relation construction (<a href="https://redirect.github.com/astral-sh/ruff/issues/27707">#27707</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/b8c5e73abe5b15a74fb066e474d30397d1421cfe"><code>b8c5e73</code></a> [ty] Disable CodSpeed cycle estimation for instrumented benchmarks (<a href="https://redirect.github.com/astral-sh/ruff/issues/27706">#27706</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/2b0d21094e2a55491bff60c07fd6f8803876cae5"><code>2b0d210</code></a> [ty] Centralize matched argument relations (<a href="https://redirect.github.com/astral-sh/ruff/issues/27705">#27705</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/a9130f3381fe137626d22288c0d45f996541ca7e"><code>a9130f3</code></a> [<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with <code>while True</code> (<code>while-one</code>, `...</li> <li><a href="https://github.com/astral-sh/ruff/commit/c64c7d6dad1e0a4966ce578b2c03af1e8e7673e1"><code>c64c7d6</code></a> [ty] Model try exception flow with operation checkpoints (<a href="https://redirect.github.com/astral-sh/ruff/issues/27471">#27471</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/9dea5ef180b3de748b5fe45787056716f235d11a"><code>9dea5ef</code></a> [ty] Avoid deriving sequents for typevars with concrete bounds (<a href="https://redirect.github.com/astral-sh/ruff/issues/27587">#27587</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/9798e88de673ec73051980ebd9aeb681161f3c27"><code>9798e88</code></a> [ty] Preserve enum exhaustiveness with custom <em>missing</em> methods (<a href="https://redirect.github.com/astral-sh/ruff/issues/27700">#27700</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.2...0.16.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
4cd1091d16 |
fix(hardcover): send the field count Hardcover's Book search requires (#1224)
Advanced title search, advanced title+author search, and the title typeahead returned zero results every time, and the sort fallback added in #1183 blamed the sort value for it. Hardcover turns the `fields` search parameter into Typesense's `query_by` but keeps `num_typos` and `query_by_weights` as fixed-length presets per query_type. For query_type=Book the preset expects exactly five fields, so a shorter list is not searched loosely - the whole search is rejected with a null results body. Confirmed against the live API: 1, 2, 3, 4 and 6 fields are all rejected, only 5 works, and weights must match one-for-one when sent. Every Book-type list we sent was the wrong length - the title typeahead and advanced title search sent 2, title+author sent 3. - Send BOOK_SEARCH_FIELDS (the full five) for every narrowed Book search and express the intent through weights instead. Weights only bias ranking - a field weighted 0 still matches - so a title search now ranks titles first rather than restricting to them. That is the closest behaviour Hardcover still allows, and there is no client-side filter to restore the old precision. - Pin the field and weight counts in tests, since the failure mode is a silent zero results rather than an error. The sort fallback from #1183 also misread these rejections: - Select the `error` field on every search and log Hardcover's own explanation. The reason is only ever in that sibling field, so a rejection surfaced as "returned no result body" with nothing to act on. Reading it is what made the field-count rule findable. - Drop `sort` entirely on the retry instead of sending an empty string. An empty sort is a value like any other and can be rejected too. - Arm the 900s sticky window only after the sortless retry succeeds. It was armed before the retry and never rolled back, so one rejected typeahead disabled sorting process-wide for 15 minutes whatever the actual cause. Verified against the live Hardcover API: advanced title search 0 -> 84 results, title+author 0 -> 139, title typeahead 0 -> 84 with the exact title top. 2566 unit tests pass; ruff, basedpyright and vulture clean. Refs #1183. The sort_by regression #1183 was written for is gone from Hardcover's side - every sort value it rejected, including the one in the report, is accepted again today. Two plain-search rejections in that report (fields=None) remain unexplained: they could not be reproduced under any per_page, page depth, sort value or query shape, and are most likely transient upstream. They now self-report the reason if they recur. |