mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-11-15 08:18:27 +00:00
08fdb7ea873d81cc4ddb024e04f75eca55324462
685
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 splitsec2
|
08fdb7ea87 |
fix(startup): the reconcile guard catches the same errors the rest of main.py does (#1540)
The start-up reconcile runs at import, before the coordinator starts, inside a try that named five exception types and left out `TypeError`. `main.py` already defines `_IMPORT_OPERATIONAL_ERRORS` for this shape and the other module-level guards use it, so this switches to it. An unexpected `TypeError` from the reconcile would otherwise fail the import of `shelfmark.main`, and the worker would fail to boot on every restart. I didn't use `except Exception` because BLE001 is on and nothing in main.py does. The test reloads main with the reconcile raising `TypeError`, and with `OSError` as the control (that one already passes on main). Full non-e2e suite passes, ruff and basedpyright are clean. Found in a Claude pass over 1.5.0. |
||
|
splitsec2
|
f560b31ee4 |
fix(db): wait up to 30 s for a busy writer instead of SQLite's 5 s default (#1539)
The users, download history and activity view-state databases open their connections with SQLite's default busy timeout of 5 seconds. A start-up migration, the restart reconcile, or any statement that overlaps a backup or a second process raised "database is locked" after 5 seconds, and the reconcile finished only part of its work. One shared `DB_BUSY_TIMEOUT_SECONDS` (30) in `core/utils.py`, used by all three. The test reads SQLite's `busy_timeout` pragma back from each connection, so it doesn't need a real lock fight. I left `UserDB.initialize()` without a guard on purpose. With 30 seconds the wait covers a backup, and swallowing a schema failure there would hide a worker that can't run. Found in a Claude pass over 1.5.0. |
||
|
splitsec2
|
2d9491e063 |
docs(settings): say that the per-source limit replaces Max Concurrent Downloads (#1542)
With Max Concurrent Downloads Per Source above 0 the download pool is sized per source and a task is admitted when its own source is below the limit. Max Concurrent Downloads isn't read at all in that mode, so 3 per source across 3 busy sources runs 9 at once. Neither description said so. The per-source text now says it replaces the global limit and what the total can be, and the global one says it isn't used while the per-source limit is set. Text only, no behaviour change. I changed the two rows in `docs/environment-variables.md` by hand. Running `scripts/generate_env_docs.py` on main today also drops the `SHELFMARK_API_KEY_READONLY` entries and changes the slskd anchor, so the file looks hand-edited since it was last generated, and I didn't want to fold that into this. The two rows match what the generator produces for them. Found in a Claude pass over 1.5.0. |
||
|
splitsec2
|
e27fed1d40 |
fix(queue): a late progress update no longer reopens a finished task (#1538)
#1429 made the first terminal status win, but the guard only refused terminal to terminal changes. A worker's poll that reports DOWNLOADING after a cancel still overwrote CANCELLED (the poll loop calls the status callback before it waits on the cancel flag), and the COMPLETE or ERROR that followed was then accepted as a first terminal status, so the terminal hook ran a second time. This refuses any status change away from a terminal status. `add()` and `enqueue_existing()` reset the status themselves, so retries are unaffected. The new test cancels a downloading task, sends DOWNLOADING and then COMPLETE, and expects CANCELLED and one hook call. It fails on main and passes here. Full non-e2e suite passes, ruff and basedpyright are clean. Found in a Claude pass over 1.5.0, same as my other small fixes from it. |
||
|
splitsec2
|
395c331b4a |
fix(search): give each provider its own slice of the search budget (#1537)
Fixes #1531. All Direct Download providers share the one search budget (`RELEASE_SEARCH_TIMEOUT`, 300s). Anna's Archive runs first, and when its bypass keeps failing the retries use up the whole budget. OceanofPDF then sees an expired deadline, skips its queries, and the search raises Anna's Archive's error even though OceanofPDF never got a turn. I didn't split the budget evenly, since the deadline module itself says a cold-start Anna's Archive solve can legitimately take 60 to 120s and a 150s or 37s slice would break setups that work today. Instead `search_deadline.unit_deadline(waiting=n)` opens a child deadline for one unit of work. It gets the parent's remaining time minus 30s for each unit still waiting, never less than 30s and never more than the parent has left. A single provider still gets everything, a fast provider's unused time rolls on to the next, and a stuck one stops at its own limit with the reserve intact. It's used in the provider loop in `DirectDownloadSource.search`, and in the source loop in `/api/releases` since it's the same shape and four lines. With several sources enabled the first one now gets 30s less per source behind it, which is still well above a cold solve for the usual two or three. Tests: a stuck first provider no longer starves the second (fails on main, passes here), a lone provider gets the full budget, and a child never outlives its parent. Two existing tests in `test_releases_api_budget.py` tripped the deadline in force from inside the source, which is now the child, so they use a short request budget instead. ruff, basedpyright on the changed files and the non-e2e suite are clean. OceanofPDF is inactive on my own instance (no mirror URL set), so I haven't reproduced this live. It's verified by reading the code and by the tests. I had Claude do the pass on this one. |
||
|
splitsec2
|
8e425da527 |
refactor: one default and one reader for the Supported Book Formats list (#1532)
The default for Supported Book Formats (`epub, mobi, azw3, fb2, djvu, cbz, cbr`) was written out in five places: the settings registry, `postprocess/policy.py`, `irc/parser.py`, Prowlarr's `source.py` (added in #1490) and slskd's `source.py` (added in #1428). Both of those two arrived in 1.5.0, and both are mine, so this is cleaning up after myself as much as anything. The setting was also read three different ways. Post-processing split on commas only. slskd split on commas and spaces and stripped a leading dot. IRC split on commas and kept the dot. Prowlarr split on commas and kept `""` as a format when the value was an empty string. So `.epub` or `epub mobi` worked in one source and not another. This puts `DEFAULT_EBOOK_FORMATS` and `normalize_format_list` in `core/utils.py` next to `AUDIOBOOK_FORMATS`, and the registry, post-processing, IRC, Prowlarr and slskd all use them. I took the most lenient reading of the three (comma or space split, leading dot dropped, empties ignored, default when nothing is left), so no existing config gets stricter. I put the reader in `core/utils.py` and not in `policy.py` because the release sources can't import `policy` without pulling in the whole post-processing package. A config with a sensible list reads exactly as before. The only differences are for malformed values: an emptied setting or an empty string now falls back to the default in every place, where IRC used to filter everything out and Prowlarr treated `""` as a format. The audiobook default is a separate story and I left it alone: the registry and slskd default to every processable audiobook format plus the archives, while post-processing and IRC fall back to `m4b, mp3`. They only differ when the setting is unset or emptied, but they do differ, and I'd rather ask which one you want than pick one here. Ruff, basedpyright on the changed files and the backend suite pass (4400 passed, e2e not run). New tests cover the reader and the two fallbacks. |
||
  Amalkrishna A SandCaliBrain
|
a11a63a29e |
feat(notifications): add {User}/{Email} placeholders to per-user routes (#1499)
Closes #1130. Per-user notification route URLs can now use `{Email}` and `{User}`, filled in from each user's account at send time, the same way `{User}` already works in destination paths. One default route like `mailtos://user:pass@smtp.example.com?to={Email}` now reaches every user at their own address, with no per-user setup. - Values are URL-encoded (`alice+books@example.com` keeps its `+`); placeholders are case-insensitive. - A route that needs a value the user doesn't have (e.g. no email on file) is skipped for that user; other routes still send. - The user lookup only runs when a route contains a placeholder. - The personal "Test notification" button expands the placeholders too, so testing a `{Email}` route works. - Added to the routes setting help, `docs/users-and-requests.md`, and tests. @calibrain ready for review. --------- Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
 dependabot[bot]
|
182e80f894 |
build(deps): bump publicsuffixlist from 1.1.0.20261017 to 1.1.0.20261018 (#1527)
Bumps [publicsuffixlist](https://github.com/ko-zu/psl) from 1.1.0.20261017 to 1.1.0.20261018. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/ko-zu/psl/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
c5af6b9ae6 |
ci(jules): review the whole PR diff, not just the latest push (#1529)
jules-pr-reviewer v0.0.2 reviewed only before...head on synchronize. After "Update branch" merged main into fork PRs, that range was main's commits, so of their own changes. v0.0.3 of the calibrain fork always reviews the PR's full diff. Also correct the fork workflow comment: jules-forks has no required reviewers by design, so runs don't wait for approval. |
||
 
|
c43da4537d |
fix(network): apply HTTP proxy to Open Library and Prowlarr requests (#1526)
Fixes #1524 Open Library metadata searches and Prowlarr API calls used `get_ssl_verify` but never `get_proxies`, so the HTTP proxy set in Settings → Network was not applied to their HTTPS requests. Both now pass the configured proxies. Relying on `requests`' `trust_env` with only `HTTP_PROXY` set leaves the same gap for `https://` destinations. Verification (Linux, `uv run --frozen pytest`): - New tests `tests/metadata/test_openlibrary_proxy.py` and `tests/prowlarr/test_api_proxy.py`: 4 passed. With the source change reverted they fail (2 failed, 2 errors). - `tests/metadata` + `tests/prowlarr`: 949 passed, 42 skipped. - The full suite in my environment showed 61 failures and 26 errors outside these areas. I did not compare them against `main`, so I'm not claiming the full suite is green here; CI will show it. - `ruff check` and `ruff format --check` on the changed files pass. Prepared with AI assistance; reviewed and tested by me before submitting. Co-authored-by: dbdefault <246079841+dbdefault@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
CaliBrain
|
9d5bcf0c58 |
ci(jules): review fork PRs through a gated pull_request_target workflow (#1528)
Fork PRs get no secrets under pull_request and Dependabot runs get only Dependabot secrets, so JULES_API_KEY was empty and every such run failed at config. The same-repo workflow now skips them, and a new pull_request_target workflow reviews fork PRs behind maintainer approval on the jules-forks environment, without checking out PR code. Both use calibrain's fork of jules-pr-reviewer, since upstream refuses pull_request_target. |
||
|
CaliBrain
|
d887942630 |
fix(search): name the proxy when a gateway cuts a search off (#1522)
A reverse proxy whose read timeout is shorter than the release search budget (nginx defaults to 60s) answers a slow search with its own 504 page. describeSearchFailure found no server message there and fell back to "Unable to reach download source. Network may be restricted or mirrors blocked.", which sent users off changing mirrors (discussion #1520). - 504 and Cloudflare's 524 now say the proxy stopped waiting and that its read timeout should be at least the release search timeout. - A 502/503 with a non-JSON body keeps fetchJSON's "Server unavailable" wording instead of the mirrors line. - docs: the root-path nginx example sets proxy_read_timeout and proxy_send_timeout like the subpath ones, and a new troubleshooting section covers searches that time out behind a proxy. |
||
 
|
eab8f7bc9a |
Add Advanced Jules PR Reviewer action (#1523)
This PR adds the Advanced Jules PR Reviewer workflow to automatically review PRs. It is configured to run on forks automatically as requested by setting `skip_forks: false`. JULES_API_KEY and GITHUB_TOKEN are mapped correctly as per documentation. --- *PR created automatically by Jules for task [10601196597817548410](https://jules.google.com/task/10601196597817548410) started by @calibrain* Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com> Co-authored-by: calibrain <191882101+calibrain@users.noreply.github.com> |
||
|
CaliBrain
|
1aa9846f22 |
fix(download): trust a pinned AA mirror and repair the full e2e profile (#1518)
The destination guard from the oceanofpdf/SSRF fix (
v1.5.0
|
||
 DBVamsiandCaliBrain
|
2fa0ad27f3 |
Fix [BUG] Search "Options" move out of the way when you try to click them (#1468)
Fixes #1301. ## What changed ## Summary **Root Cause (Issue #1301):** The SearchBar component uses a `useDismiss` hook that closes the main search menu on `mousedown` events occurring outside of `selectorRef` and `controlsPanelRef`. However, the AdvancedFilters panel (opened via the "Options" button) is rendered as a sibling component outside of `controlsPanelRef`. When clicking on dropdown options inside AdvancedFilters, the `mousedown` event bubbles up to the document, triggering `useDismiss` and collapsing the main menu. **Fix:** Added `onMouseDown={(e) => e.stopPropagation()}` to the `settingsForm` div in `AdvancedFilters.tsx`. This prevents the `mousedown` event from bubbling up to the document level, so the `useDismiss` hook in SearchBar never sees the event and the main menu stays open. **Test:** Created `tests/frontend/test_search_menu_dismiss.py` with 3 tests: 1. `test_advanced_filters_prevents_mousedown_bubbling` - Verifies the fix is in place 2. `test_advanced_filters_container_has_onmousedown` - Verifies the handler is on the correct element 3. `test_searchbar_uses_usedismiss_for_menu_closing` - Documents the existing dismissal behavior **Verification:** - Tests pass with the fix: ✓ - Tests fail without the fix: ✓ (2 tests fail as expected) - Existing tests still pass: ✓ (215 tests in config/) ## How it was verified - test(s) added/changed: `tests/frontend/test_search_menu_dismiss.py` - on the original code the new test fails (exit 1) - with the fix it passes (exit 0) - full test suite with the fix: exit 1, no new failures vs. baseline (exit 1) (153.7s) This was worked on in conjunction with AI tools. Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
 Desislav LesovandCaliBrain
|
fc8a5b9230 |
fix(prowlarr): hide results whose title extension is not a supported format (#1490)
Closes #1481 ## Problem Plain (non-enriched) indexers such as Zamunda, Knaben or LimeTorrents return titles like `Иван Вазов - Под игото.doc`. They show next to the epubs. Picking one downloads the file, then post-processing discards it because `doc` is not in `SUPPORTED_FORMATS`. ## Change - `_unsupported_title_extension()` reads a trailing file extension from the release title. When it is a known file format that is not in Supported Book Formats, the result is hidden. - Kept: titles with no extension, `[EPUB]`-style tags, dotted titles like `Jane.Eyre.by.Bronte` (only known file extensions count), archives (`zip`, `rar`, `7z`), and audiobook searches. - New Prowlarr setting `PROWLARR_HIDE_UNSUPPORTED_FORMATS` ("Hide results in formats you did not enable"), default on. - One info log line per search with the hidden count; a debug line per hidden title. - `docs/environment-variables.md`: added only the new setting's rows. Running `scripts/generate_env_docs.py` on current `main` also changes unrelated lines (`SHELFMARK_API_KEY_READONLY`, the slskd anchor), so I left those alone. ## Tests - New `TestHideUnsupportedFormats` in `tests/prowlarr/test_source.py`: the extension helper (parametrised), audiobook bypass, comma-separated config, and a full `search()` with the setting on and off. - `tests/prowlarr`: 784 passed. Ruff lint/format, vulture and basedpyright on the changed files are clean. - Full suite on macOS: the same 84 bypass/entrypoint failures as on `main` (browser extra and Linux permissions), none new. I ran an earlier version of this as a local patch on v1.4.0 against a real Prowlarr + Zamunda setup: the `.doc` row is gone and epubs stay. Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
CaliBrain
|
d42494c696 |
fix(tor): survive container restarts and run Tor as debian-tor (#1517)
With USING_TOR=true, any restart that reuses the container (docker
restart, a Docker daemon restart, a host reboot) put it in a restart
loop. Only recreating the container ended it.
Tor appends to /var/log/tor/notices.log, and the file survives the
restart. tor.sh waited for Tor by grepping that log for "Bootstrapped
100%", so the previous boot's line passed at once, before Tor had
connected to anything. The NAT rules then went live, Tor could not
finish bootstrapping behind them, the connectivity check could not
resolve check.torproject.org, and the next boot found the same stale
line. tor.sh now moves the previous log to notices.log.prev before it
starts Tor, so the wait and the watchdog only see this boot's output.
Tor could not finish behind the NAT rules because it ran as root. The
rules exempt only debian-tor's traffic from the transparent redirect, so
every relay connection Tor opened after they went live was redirected
into its own TransPort: the log shows dozens of TLS handshakes dying.
This also meant a Tor that lost its guard could never reconnect, on any
kernel. torrc now has `User debian-tor` and `DataDirectory
/var/lib/tor`. Tor still binds DNSPort 53 as root, then drops. It opens
its log after dropping and refuses to start if it cannot, so tor.sh
hands the fresh log to debian-tor first.
The check also failed without a word. `RESULT=$(curl -s ...)` under
`set -e` ended tor.sh with curl's exit status, so the only trace was
ExitCode=6 (could not resolve host) in `docker inspect`. A reply that
was not the expected JSON did the same through grep. The check now:
- retries twice, 10s apart, since a fresh circuit can fail its first
lookup;
- logs each failure with curl's exit status and error;
- says when it gives up and prints the last Tor log lines;
- still stops the container when traffic does not go through Tor.
- Reproduced on the v1.4.0 image (tor.sh is unchanged since then): after
one `docker restart` the container restarted 9 times in 150s, each
boot ending at "Verifying Tor connectivity...".
- With the new tor.sh mounted into the same image, the container went
through 2 restarts in a row. Each boot verified Tor and reached
gunicorn within 15-21s, and the restart policy never had to step in.
Tor runs as debian-tor and its logs belong to it.
- Restarting Tor (`supervisorctl restart tor`) once the NAT rules were
live, so it had to open new relay connections: as debian-tor it
bootstrapped again in 4s and traffic still went through Tor. As root
it had not bootstrapped after 120s, 1775 TLS handshakes had died, and
curl could not resolve check.torproject.org (exit 6).
- A SIGHUP, which the rotation monitor sends every 5 minutes, keeps
DNSPort 53 working after the drop to debian-tor.
- 9 new tests in tests/config/test_tor_script_rules.py. 8 of them fail
on the old tor.sh; the 9th checks that traffic outside Tor still stops
the container. Three need `grep -P` and skip on macOS, so I also ran
the file in the Debian image: 23 passed.
- The `make python-checks` tools pass (ruff check and format,
basedpyright on the app and tests, vulture). The non-e2e suite
passes: 4366 tests on
|
||
  amura11andClaude Sonnet 5.5
|
ceb23dda7c |
feat(clients): separate audiobook download directory for torrent clients (#1500)
## Summary Related to #1048 (covers the "separate book and audiobook locations" request, not per-category routing). Every download client already had a separate audiobook label/category, but the four torrent clients only had a single save directory, so books and audiobooks ended up mixed in the client's download folder. Each torrent client (qBittorrent, Transmission, Deluge, rTorrent) gets an opt-in **Separate Book and Audiobook Directories** toggle (`<CLIENT>_SEPARATE_DOWNLOAD_DIRS`, default off): - **Off (default):** unchanged. The single `<CLIENT>_DOWNLOAD_DIR` is used for everything, so existing setups behave exactly as before. - **On:** `<CLIENT>_DOWNLOAD_DIR_BOOK` and `<CLIENT>_DOWNLOAD_DIR_AUDIOBOOK` replace the shared field. A directory left empty means the client's own default; it never falls back to the shared directory or another Shelfmark setting. The content type was already passed to each client's `add_download`, so a small shared helper (`resolve_download_dir`) does the selection. Usenet clients are unchanged: their save location comes from the category configured in the client, and a separate audiobook category is already sent. ## Screenshots Default Setting <img width="817" height="271" alt="Screenshot 2026-10-20 at 14-54-26 Shelfmark" src="https://github.com/user-attachments/assets/29941f83-9034-4ea5-bcb2-8e91ce77e63a" /> Separate Locations <img width="817" height="425" alt="Screenshot 2026-10-20 at 14-54-58 Shelfmark" src="https://github.com/user-attachments/assets/772b7194-a072-4945-bac5-b6959550fd75" /> ## Not included Routing to many folders by document type (the main request in #1048) still only exists for Direct download via Content-Type Routing. Extending it to torrent and usenet sources needs a decision on what to route by. ## Testing - `pytest tests --ignore=tests/e2e` passes (3561 passed); ruff clean. The `tests/e2e/platform` suite needs a running cluster and was not run. - New unit tests for the helper (including no fallback to the shared directory) and a qBittorrent add test covering book vs audiobook directories. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> |
||
|
splitsec2
|
86943f5a77 |
chore: drop three unused imports that fail Python Quality (#1514)
Python Quality is failing on new PRs because of three unused imports on main (it did on #1513): `ipaddress` in `core/image_cache.py`, `threading` in `core/notifications.py` and `email.utils.parseaddr` in `download/orchestrator.py`. The code that used them changed in the last round of merges and the imports stayed behind. This is `ruff check --fix --select F401` on those three files and nothing else. Ruff, basedpyright and tests/core plus tests/download pass. |
||
|
splitsec2
|
621d14e1a9 |
fix(activity): put dismiss-many back together after the #1507 and #1508 merges (#1513)
#1507 and #1508 touch the same handler, and the merged result is wrong in two places. `effective_existing` is read before it is assigned, so a Clear Completed batch with any download in it answers 500. The ownership branches also lost their `continue`, so another user's item is no longer answered like a missing one (what #1507 added) and falls through to the rest of the checks. This puts #1507's ownership handling back and keeps #1508's skip of an item that is no longer finished. The tests that came with both already cover it: 12 of them fail on main right now and pass with this change. Ruff, basedpyright and tests/core pass (1880 passed). I flagged in #1508 that whichever of the two landed second needed a rebase, and I should have rebased mine after #1507 merged instead of leaving it for the merge. Sorry for the extra one. |
||
|
dependabot[bot]
|
c3608dd3c9 |
build(deps): bump publicsuffixlist from 1.1.0.20261010 to 1.1.0.20261017 (#1509)
Bumps [publicsuffixlist](https://github.com/ko-zu/psl) from 1.1.0.20261010 to 1.1.0.20261017. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/ko-zu/psl/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
splitsec2andCaliBrain
|
f837506017 |
Merge commit from fork
A signed-in user picks the release fields of POST /api/releases/download, and a record id with the "oceanofpdf:" prefix reached the provider without handles() or is_enabled(). The provider then fetched source_url, POSTed to the form action found on that page and fetched the meta-refresh target, with no check on any of them. The provider now refuses to run when it is switched off, and the book page, the form action and every POST redirect hop must be on the configured mirror (same scheme, host and port). The signed file link may sit on another host but must be http(s). network.ensure_public_destination refuses a host that resolves to a loopback, private, link-local or otherwise non-global address (IPv4-mapped IPv6 judged by its IPv4 address). Hosts the operator configured as mirrors and names that do not resolve pass as before. html_get_page and download_url call it on their first URL and check each redirect hop through a response hook. The image cache uses the shared address check too. Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
splitsec2andCaliBrain
|
cb72ce807c |
Merge commit from fork
A user could set any value for their own overridable settings through
PUT /api/users/me. DESTINATION and DESTINATION_AUDIOBOOK accepted any
string, so a download (including one an admin fulfilled for that user)
could be written to any directory the container can reach, and
get_destination created it on demand.
A user's own destination must now resolve inside the global one (with
{User} expanded on both sides). Absolute paths outside it and any ".."
segment are rejected at save time, and get_destination applies the same
check when the path is used, so a stored or hand-written value outside
the global destination is ignored with a warning and the global
destination is used instead. A relative value is taken relative to the
global destination.
Other self-service values are checked as well: select fields must use
one of their options, EMAIL_RECIPIENT must be a plain address (the same
check the orchestrator and the downloads tab use, now shared from
request_helpers), and Grimmory library and path ids must be non-negative
integers. Admin saves on a user's behalf are unchanged.
The self-service 400 response now carries a message line so the reason
reaches the user in the toast.
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
|
||
|
CaliBrain
|
c269230ef3 |
fix: review regressions in metadata, notifications, activity redaction, search options and genDebug (#1510)
- **Open Library (#1451): keep the work unless the search matched a translation.** Open Library shows an English edition whenever one matches the query. So "Mistborn" returned the 2023 "Mistborn" reissue (2023) instead of "The Final Empire" (2001), and "Children of Dune" returned "Children of Dune (Dune Chronicles, Book 3)" (1987). The matched edition's title, ISBNs, cover, language and year now win only when the edition is in another language and the query doesn't name the work's own title. Checked against live Open Library: "Children of Dune" and "Mistborn" give the v1.4.0 results again, and "Der Weg der Könige" and "Kinder des Nebels" still return the German editions. - **Google Books (#1434): the ISBN cache decorator is back on `search_by_isbn`.** It had moved to the new `search_paginated`. Failed searches were cached as empty pages, and ISBN lookups lost their cache. - **Notifications: Test notification shows the plugin's failure reason again.** Apprise 2 delivers on its own worker threads, even for a single service when that service has a deadline. `_AppriseLogCapture` filtered records by thread id and dropped all of them, so the UI only said "json: delivery failed". Apprise runs those workers in a copy of the caller's context, so the capture now filters on a context variable. That still keeps concurrent dispatches apart. `AppriseAsset(async_mode=False)` would not fix this, because the sequential path also uses the worker pool when a service has a deadline. - **Activity: `activity_update` no longer sends the raw task id to non-admins.** The owner's `user_<id>` room got the raw task id. For a request-linked download that id can hold a private tracker's passkey. It now goes through `viewer_download_id`, the same mapping `/api/status` and `download_progress` use. The admins room still gets the raw id. - **SearchBar (#1476): Escape and an outside click close the homepage's inline options panel again,** as they did in v1.4.0. - **genDebug.sh: packages are listed through `importlib.metadata`,** since #1404 removed pip from the image. The script also now redacts: - `PROWLARR_MAM_ID` - `user:pass@` credentials in URLs (proxies), in both the environment and the config files - notification route URLs, which carry their service's token (Telegram, Discord and others) - `make python-checks`, `make python-test`, `make frontend-checks` and `make frontend-test` pass on top of current `main`. - New tests cover: - Open Library edition selection - Google Books caching - log capture against a real Apprise 2 delivery to a local server that answers 500, plus a concurrent dispatch on another thread - the `activity_update` payload sent to each room - genDebug redaction and the package listing Each one fails on the old code. - I checked the SearchBar fix in the running app, because the frontend has no DOM test setup: Escape closes the panel, an outside click closes it, and a click inside keeps it open. - I ran the genDebug redaction under GNU sed (Debian image) and BSD sed. The package listing ran in the pip-less image. |
||
|
CaliBrain
|
a00f3d28bf |
fix(slskd): refuse unsafe peer paths, keep queued downloads alive, report search outages (#1512)
Fixes four defects in the Soulseek (slskd) A peer names its own files, and Shelfmark works out where slskd stored one from the last folder and the file name. `remote_directory_name` returned the whole directory when its last segment was empty. So `../../../etc//passwd.epub` or `/abs/path//book.epub` resolved outside the downloads folder, and Shelfmark imported whatever was there. For a multi-file release it moved those files into staging (`STAGE_MOVE`). - New `safe_remote_segments` refuses a name with an empty, `.` or `..` segment (which covers absolute and UNC paths), a NUL, or a drive anywhere but a Windows share root (`C:\Books\…`, which never reaches a local path). - Search (`iter_peer_files`, so `build_releases`) drops such files. - `download` refuses them before anything is queued, in both modes. The spec arrives with the queued release payload, so search filtering alone is not enough. - `local_path_for` also refuses a path that resolves outside the root (`resolve()` + `is_relative_to`), for example through a symlinked folder. `_poll`, used when isolation is off and as the fallback for slskd < 0.26, never asked for an activity grace. A file "Queued, Remotely" sent the same status and progress on every poll, so the orchestrator cancelled it after 300s and `SLSKD_QUEUE_TIMEOUT_MINUTES` never applied. It now requests, renews and releases the grace the same way isolated mode does. `search` caught every exception per query, so slskd being down or rejecting the API key showed as "no releases". When no query gets an answer it now raises `SourceUnavailableError`, as Prowlarr does, and the error reaches the user. One failed query among answered ones is still not an outage. A retry reuses the task's folder, and slskd renames a new file when one is already there. Files from a failed attempt therefore meant `_folder_complete`'s exact count could never match again. Now: - a failed or cancelled attempt removes its folder; - a new attempt removes any finished files an earlier one left (for example after a restart) before it queues the batch. `tests/slskd/conftest.py` stubbed `flask_socketio` whenever it had not been imported yet, even though it is installed. Running `pytest tests/slskd tests/` therefore broke the Flask app tests in the same worker (285 errors, also on |
||
|
CaliBrain
|
49aeec97cd |
fix(download): stop deleting user data and losing completed downloads (#1511)
Fixes six defects. Each one breaks downloads or deletes user data, and each has a regression test that fails on |
||
|
splitsec2andCaliBrain
|
520b6b16d0 |
fix(activity): Clear Completed leaves out an item that is no longer finished instead of failing the batch (#1508)
Clear Completed can fail outright with "Only terminal requests can be dismissed". `dismiss-many` answers 409 and dismisses nothing when any one request or download in the batch is not terminal. The list a user clears from can be older than the server, so a request that was reopened or retried since, or a download that started again, takes the whole batch down with it. The earlier fix for pending requests (#1438) filters on the client, which only helps when the list is current. `dismiss-many` now skips such an item and carries on with the rest. The response adds `skipped_item_keys` when something was left out, and `count` is what was actually dismissed. A single `dismiss` of a non-terminal item still answers 409. I hit it with a request whose download had completed while the request itself was still pending, but any reopen between the list and the click does it. This touches the same handler as #1507, so whichever lands second needs a small rebase. Tests: a batch with a finished and a reopened request dismisses the finished one and reports the other, and a batch with a finished and a running download does the same. Ruff, basedpyright and the backend suite pass (3933 passed, e2e excluded). Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
splitsec2
|
61c7ad3c62 |
Merge commit from fork
* fix(torrent): check each redirect hop when fetching a torrent file The torrent file fetch followed redirects by hand without looking at where a hop pointed, so a download link could make the server request a loopback, link-local or LAN address. Each hop (the initial URL and every redirect Location) must now be http or https and resolve only to global addresses. The configured Prowlarr/Newznab origin is exempt, as it usually lives on the LAN. The API key still only goes to that origin. * fix(socketio): only accept websocket handshakes from the app's own origin The Socket.IO server allowed every origin. It now uses the same-origin check python-engineio applies by default (Host, or X-Forwarded-Proto and X-Forwarded-Host behind a proxy). SOCKETIO_ALLOWED_ORIGINS takes a comma separated list of extra origins for proxies that change Host without forwarding it. * fix(custom-script): do not pass a file name that starts with a dash as the first argument In relative path mode the script got the organized file's relative path as its first argument, which many scripts read as an option when the name starts with a dash. Such a name is now passed with a ./ prefix. Absolute mode is unchanged. |
||
|
splitsec2
|
8ec9db49da |
Merge commit from fork
The request line sent to the book bot comes from the request-supplied source_id and was written to the socket as-is, so a line break in it sent extra IRC commands as the operator's nick. IRCClient._send, the single writer, now raises IRCError on any control character (CTCP 0x01 excepted), the download handler rejects such a request line with a clear error before connecting, and search refuses a query that contains one. |
||
|
splitsec2
|
6f65d6e20a |
Merge commit from fork
A release format such as /../../x was appended to the staging file name unchanged, so the direct-download and libgen handlers could write to, and on cancel unlink, a path outside TMP_DIR. Normalise the format to a plain extension at queue time and in build_filename, reject path-like source ids for the sources that use them as file names, and make both handlers resolve the staging path and refuse anything that is not a direct child of TMP_DIR. |
||
|
splitsec2
|
89663e32f6 |
Merge commit from fork
A user's personal notification routes were sent to any Apprise URL, from the server. Through the test endpoint or a saved route a signed-in user could make the server POST to loopback, link-local and LAN hosts, choosing the path and, with Apprise's + and : parameters, extra headers and body fields. User routes are now limited to the hosted services that talk to a fixed vendor host (discord, slack, tgram, pover, pbul) and to ntfy and gotify, whose host must resolve only to public addresses (checked on the host urlsplit reads and on the host Apprise reads, including IPv4-mapped and numeric forms). The check runs when a route is tested, when an event is queued and again when it is sent. Admin routes are unchanged. |
||
|
splitsec2
|
d34b200414 |
fix(activity): answer another user's item like a missing one, and skip foreign history rows (#1507)
Two small fixes in `activity_routes.py`. **Another user's item answers like a missing one.** Dismissing a task or request id answered 404 when it didn't exist and 403 when it belonged to someone else, so a user could test whether an arbitrary id exists. A non-admin now gets the same 404 for both. In dismiss-many a foreign key is reported with the missing ones and the rest carry on, and the owner is still written to the log. Admins are unchanged. **A foreign row in someone's viewer state no longer gives a 500.** If a non-admin's viewer state referenced another user's download or request row, building history raised a `RuntimeError`. The row is now skipped with a warning. Not changed: history still raises when a row that viewer state points to has been deleted. That is a different case, and I didn't want to widen this. Tests: the existing forbidden test now expects the 404 and the log context, and four new ones cover a foreign download and a foreign request answering like a missing one (including dismiss-many), an admin still dismissing a foreign row, and history skipping foreign rows. Ruff, basedpyright and the backend suite pass. |
||
|
splitsec2andCaliBrain
|
8fd477bf50 |
fix(releases): apply the request policy to release listing, not only to download (#1506)
The request policy is applied when a user downloads (`/api/releases/download`) or requests (`/api/requests`), but not when they list releases. A user whose mode is `request_book` or `blocked` can still search releases and list a torrent's files through the shared Prowlarr and qBittorrent credentials. Only the UI hides the list. This applies the same gate to `/api/releases`, `/api/releases/inspect` and the release-source records route, with the same codes as the download route (`policy_blocked`, `policy_requires_request`, `required_mode`). - `blocked` and `request_book` are refused. `request_release` is allowed, because that mode lists releases so the user can pick one. The UI opens the request dialog directly under `request_book` and never calls `/api/releases` there. - `/api/releases` resolves the mode per source for the content type. A refused source is dropped from the search, so a user blocked on Prowlarr no longer reaches Prowlarr even when other sources are allowed. It answers 403 only when no source is left, or when the one source asked for is refused. - The records route doesn't know the content type before it fetches, so it refuses only when every content type the source supports is refused. - Admins, auth mode `none` and an instance with requests off bypass the gate, as they do on the download route. A user whose default is `blocked` now gets a 403 toast in the release modal, where they used to get a list of "Unavailable" rows. I made no frontend change. Tests (14, new file) cover each route for blocked, request_book, request_release, an admin, and auth mode none, the per-source drop, and the records route. Ruff, basedpyright and the backend suite pass. Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
splitsec2
|
b05bbc8c58 |
fix(covers): key the cover cache by the image URL, not the caller-supplied id (#1505)
`/api/covers/<id>?url=...` cached the fetched image under the id in the path, and the caller chooses that id. A request with another book's id and a different URL put its image in that book's cache entry, and every user then got it. The key is now derived on the server from the image URL (a hash of it), and the id in the path stays only so links keep their shape. The SSRF checks and `fetch_and_cache` are unchanged, and `transform_cover_url` links already carry the URL, so they keep working. The URL is decoded first now, so a missing one is a 404 and bad encoding a 400, both before any fetch. I made the key the URL alone, not URL plus id. Either stops the overwrite, and the URL alone lets one image be shared when the same cover appears under two ids (the viewer redaction rewrites ids and still hits the cache). Entries cached under the old keys are not read any more, since there is no telling which were overwritten. They age out of the LRU and the cache warms once after the upgrade. Tests: a request with another id can't replace the legitimate image, in either order; the normal miss then hit; the same URL under two ids hits; no URL gives 404; bad encoding gives 400 without a fetch; and a unit test for the key. Ruff, basedpyright and the backend suite pass. |
||
|
splitsec2
|
71cd030484 |
Merge commit from fork
GET /api/users/me/edit-context served every user-overridable key with the admin's global value in globalValues and effective, so any user could read the global destination paths, the admin's EMAIL_RECIPIENT, the Booklore library and path ids and the global USER_NOTIFICATION_ROUTES table, whose Apprise URLs embed tokens. build_user_preferences_payload gains a for_self_service mode that replaces a global value with None unless the user set the key themselves or the field is a checkbox, number, select or multi-select switch the form needs to lay itself out (BOOKLORE_LIBRARY_ID and BOOKLORE_PATH_ID are masked despite being selects). The self-service route uses it; the admin routes keep full data. |
||
|
splitsec2
|
386fdb313c |
Merge commit from fork
GET /api/debug returns a bundle with application logs, process listings and environment names, and GET /api/restart exits the process. Both are registered only when DEBUG is on, but any logged-in user could call them. Add an admin_required decorator built on login_required and use it for both routes. Non-admin sessions get 403 "Admin access required"; authentication mode "none" keeps working as before. |
||
|
splitsec2
|
7da4669cc1 |
feat(prowlarr): hide ebook results above a maximum size (#1504)
Closes #844. A new Prowlarr setting, Maximum Ebook Size (MB). Ebook results above it are hidden from the release list. The default is 0, which shows everything as it does today. This is the idea from the issue. The filetype check suggested in the comments is a different change (#1490 has one for Prowlarr), and it doesn't catch a TV series or a software bundle that ships as a plain archive, which is what a size limit does. - A result with no reported size is always shown. - A result exactly at the limit is shown. - Audiobook searches are never limited, since they are big by nature. - A non-numeric value counts as no limit. The filter runs on the raw Prowlarr result before it is turned into a release, so a hidden result never reaches the sort or the release cache. Tests cover no limit, zero, over the limit, exactly at it, no size, audiobook searches and a bad value. Ruff, basedpyright and the backend suite pass. I added the entry to `docs/environment-variables.md` by hand because running the generator also changes unrelated parts of that file. |
||
|
splitsec2
|
f2269aa201 |
feat(audiobookbay): seed time and ratio settings (#1503)
Closes #1037. Two new AudiobookBay settings, Seed Time (minutes) and Seed Ratio. Both default to 0, which leaves the torrent client's own limit as it is today, so nothing changes until someone sets them. They go to the client with the magnet the same way the Prowlarr seed preferences do (`DownloadRequest.seeding_time_limit` and `ratio_limit`), so they apply with the clients that already take per-torrent limits there: qBittorrent, Transmission and Deluge. A retry that reuses the saved magnet carries them too. A value that isn't a positive number (text, negative, NaN, inf) is ignored and the client's limit stays. Tests cover reading both settings (unset, zero, each on its own, text values, bad values) and that both the fresh and the cached-magnet request carry them. Ruff, basedpyright and the backend suite pass. I haven't tried it against a live client, since the client side is the code Prowlarr already uses. I added the two entries to `docs/environment-variables.md` by hand. Running `scripts/generate_env_docs.py` here also changes unrelated parts of that file (the Soulseek table of contents link and the `SHELFMARK_API_KEY_READONLY` entry), so I left those alone. |
||
|
splitsec2andCaliBrain
|
77b80eb31a |
fix(metadata): only an admin may use the provider's own account, its lists and shelves (#1501)
Refs #981. Hardcover is signed in as one account, the instance owner's, and every logged-in user shares it. A non-admin can see the owner's lists and shelves in the List filter, browse one by asking for it, and add or remove books and change read status from search results, which is what #981 describes. Now only an admin may. With authentication set to none the one user keeps everything. - `GET` targets and the batch lookup return no options for a non-admin, so the buttons don't show and the account isn't asked. - `PUT` targets answers 403. - The List filter (`hardcover_list`) has no options for a non-admin, and a request that asks for it has the field dropped before the search. Providers name these fields in `account_search_fields`, and Hardcover lists `hardcover_list`. - Public things are unchanged: author, title and series suggestions, and a pasted list URL in the search box. That pasted URL is the one gap I know of. It resolves any list the account can see, so a user who knows the slug of one of the owner's private lists could still open it. Closing it means the provider has to know who is asking, which is a bigger change than this one, so I left it. Not included from the issue: a toggle for letting users view lists and limiting which lists they see. I kept this to the admin-only part so it stays small, and I can do the toggle as a follow-up if you want it. Tests cover the routes as an admin, a user and with no authentication (targets read, batch and write, list options, a crafted list search, and public fields still passing). Ruff, basedpyright and the backend suite pass. Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
splitsec2andCaliBrain
|
82c8c91c8b |
refactor(clients): read the stall window with a type check instead of a pyright ignore (#1498)
The only `pyright: ignore[reportArgumentType]` in `shelfmark/` is one I added in #1426, and I was being lazy when I did. I hit the same error on another PR and replaced the ignore there with a real check, so this does the same for the original. `_stall_window_seconds` reads the setting as an `object`. It now narrows to int, float or str before calling `float()`, and a bad string falls back to the default as before. A non-numeric value of another type (None, a list) falls back to the default too, which used to happen through a `TypeError`. No behaviour change. The existing range test still passes and I added `None` and a list to it. basedpyright is at 0 errors, ruff is clean and the backend suite passes. Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
splitsec2
|
e83bab9337 |
feat(clients): give up on a torrent with no seeders (#1494)
A torrent with no seeds won't finish. It runs on the pieces its few
peers hold and then sits still, and nothing says so until the stall
timer ends it. The card only reads "downloading". I run AudiobookBay
releases, which show no seed count in the listing, so the client is the
only place to find out.
Two new settings, both off until you turn them on:
`TORRENT_NO_SEEDERS_WAIT` (minutes, 0 turns it off) and
`TORRENT_MIN_SEEDERS` (default 1).
- A torrent that has fewer seeds than the minimum for the whole wait,
while nothing is downloading, is removed from the client with its data
and the task ends as an error.
- A torrent with no seed at all for the wait is given up on even while
it still moves.
- A torrent that met the minimum and lost seeds down to one, but is
still moving, keeps going.
- The card shows the seed count beside the progress, with a countdown
while it waits ("0 seeds, giving up in 4m").
qBittorrent only, because it reports connected and tracker seed counts.
Other clients report none and are left to the stall timer, and an
unknown count is not read as zero. A torrent that was already in the
client when the download started is never removed, and a queued torrent
isn't judged.
Tests cover the wait and countdown, the clock restarting on progress,
the tracker count, a higher minimum, off by default, a client with no
counts, a preexisting torrent, a queued torrent, and the moving cases.
Ruff and the backend suite pass.
|
||
|
splitsec2
|
9ba5816b83 |
fix(requests): an older failed attempt no longer undoes a later delivery (#1493)
A request that was retried after a failure has two tasks in the status built from download history. `sync_delivery_states_from_queue_status` walks the status buckets in `QueueStatus` order and keeps the last one it sees for a request. Error comes after complete, so a request that was delivered by its retry is set back to error and, when no retry is left, reopened as pending. The next pass can then fetch the book again. When a request has more than one task, an attempt that is still running now decides its state, else a completed one, else the failure. Ties keep the old order, so a request with a single failed task still reopens as before. Tests: an earlier failure doesn't undo a later delivery, a running retry outranks an earlier failure, and a lone failure still reopens. It happened on my instance to a request whose first try failed and whose retry succeeded. Ruff and the backend suite pass. |
||
|
splitsec2
|
a1ac017487 |
feat(requests): let an admin reopen a rejected request (#1491)
Closes #1445, where you said you were open to it. A rejected request was final. `update_request` won't move a terminal status and the admin routes only fulfil or reject, so an admin who changed their mind had to ask the user to request the book again, and the user kept seeing the old rejected one. `POST /api/admin/requests/<id>/reopen` moves a rejected request back to pending and clears the review fields. What the user asked for (request level, release, note) is kept. It refuses anything that isn't rejected, and refuses when that user already has a pending request for the same book. Admins get a Reopen action on rejected cards in the activity sidebar and in History. A rejected request has usually been cleared from the list by the time anyone wants it back, so reopening also clears the dismissal, the way the failed-download reopen does. Without that the pending request stays hidden. Tests cover the service (state change, what is kept, the refusals, a non-string admin note) and the route, and the card model for the new action. Ruff, tsc, oxlint, vitest and the backend suite pass. It has been running on my instance since Oct 8. |
||
|
splitsec2
|
88cc734db2 |
fix(activity): a reused release follows the new request, and stale rows of a delivered request are closed (#1496)
Two things that go wrong when a second request picks a release a first request already used. A task id comes from the release, so the history row is reused. **The row stays with the first request.** Recording a download kept the first request's id, notes and state. On my instance a card for one book showed up under the request for a different book, with that request's note on it. Recording a download now moves the row to the request that queued it and restarts its queue time. A retry with no request keeps the request the row had. **Old rows of a delivered request show as failures forever.** The startup sweep leaves an old request-linked row alone so its retry stays, but one whose request already has its book (delivered, or another download of it finished) is now closed as "Superseded by a completed download" instead of showing as an interrupted failure for ever. Also in the first commit: History cards used the saved cover URL as it was, an external address the page's own-origin image policy blocks, while running downloads use the cover proxy. They use it too. The second commit is about restarts. After a restart nothing is in flight, but a request in downloading, resolving or locating whose row had moved to another request was stranded, because only queued was reopened. Those states are reopened too. Tests cover the row takeover and the retry case, the cover through the proxy (and a missing cover), the superseded cases (delivered request, another row finished, an undelivered request is left alone) and the in-flight states with no row. Ruff and the backend suite pass. |
||
|
splitsec2
|
06a67a7150 |
feat(download): a concurrency limit per source (#1495)
With one global limit, a few tasks that are only waiting hold every slot. A Soulseek download sitting in a peer's queue is the example I hit: three of those and a torrent that could start waits behind them. `MAX_CONCURRENT_DOWNLOADS_PER_SOURCE` (0 keeps the single global limit, which is the default). With it set, the coordinator starts a download only when its source is below the limit and passes over tasks of a full source without losing their place in the queue. `get_next` gets an optional filter for this, and a cancelled task is still dropped when one is given. The start-up stagger now applies only between downloads from the same source, and the pool is sized so every source can reach its limit. The second commit: qBittorrent keeps its own queue of torrents waiting for a free slot. The task polling one of those does no work, so it no longer counts against its source's limit and the next task of that source can start. The client does the pacing, as it does for its own queue. Tests cover the queue pass-over (order and priority kept, nothing eligible, cancelled tasks), the coordinator (a full source doesn't block the others, each source has its own limit, the global limit when unset) and the client-queue case. Ruff and the backend suite pass. |
||
|
splitsec2
|
e8297c94a9 |
fix(ui): the browser tab follows the search page title (#1492)
The tab title is always `Shelfmark`, even when `SEARCH_PAGE_TITLE` is set, so a renamed instance still shows the old name in tabs and bookmarks. This sets `document.title` from the config when it loads and falls back to `Shelfmark` when the setting is empty. Two lines in `App.tsx`, no new setting. No test for it, since nothing in the app tests `document.title` today. Tsc, oxlint and vitest pass. |
||
|
splitsec2
|
3b5afb1a04 |
Merge commit from fork
PUT /api/users/me set a new password from the password field alone, so a live session could replace the password and lock the owner out. A builtin user now has to send current_password with it, checked against the stored hash. A wrong or missing one is a 400, and counts toward the same lockout as a failed login (a locked account gets a 429 without being checked), so the endpoint cannot be used to guess the password. A password or current_password that is not a string is a 400. A password that was not a string raised a TypeError from len() and answered 500. The account form asks for the current password when a new one is typed. Profile and settings changes without a password are unchanged. |
||
|
CaliBrain
|
10710abd4e |
fix(download): send every file of a multi-file download to the browser (#1489)
Download to Browser only ever sent the first file of a multi-file release (audiobook chapters, packs): the folder output returned final_paths[0] and /api/localdownload served that one path. The folder output now keeps every final path on the in-memory task (download_paths), and /api/localdownload streams them as one uncompressed ZIP named after the book when there is more than one. The archive is never staged on disk or held in memory, and ZIP64 covers large audiobooks. History still stores only the first path, so a re-download from history after a dismiss or restart serves a single file, as before. Also brings every linter back to green on all files: - pre-commit: bump the ruff hook to v0.17.1 to match uv.lock; ruff-format the Python examples in docs/dev and skills - ruff: fix the remaining issues in skills/shelfmark/download_books.py; format base_handler.py - basedpyright: Optional and attrs errors in databazeknih.py - knip: drop 31 unused exports, reuse ColumnColorHint in colorMaps - oxfmt 0.72: styles.css - direct download: fix the "Welib, mirrors" typo and the test that still expected the pre-OceanofPDF message Fixes #1467 |
||
|
dependabot[bot]andCaliBrain
|
3025f120eb |
build(deps): bump the python-deps group across 1 directory with 10 updates (#1487)
Bumps the python-deps group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [flask-socketio](https://code.miguelgrinberg.com/miguelgrinberg/flask-socketio) | `5.6.1` | `5.7.0` | | [dnspython](https://github.com/rthalley/dnspython) | `2.8.0` | `2.9.0` | | [qbittorrent-api](https://github.com/rmartin16/qbittorrent-api) | `2026.8.1` | `2026.10.0` | | [authlib](https://github.com/authlib/authlib) | `1.8.0` | `1.9.1` | | [apprise](https://github.com/caronc/apprise) | `2.0.0` | `2.0.1` | | [publicsuffixlist](https://github.com/ko-zu/psl) | `1.0.2.20260925` | `1.1.0.20261010` | | [seleniumbase](https://github.com/seleniumbase/SeleniumBase) | `4.54.12` | `4.56.2` | | [basedpyright](https://github.com/detachhead/basedpyright) | `1.40.1` | `1.40.2` | | [prek](https://github.com/j178/prek) | `0.5.4` | `0.5.5` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.9` | `0.17.1` | Updates `flask-socketio` from 5.6.1 to 5.7.0 Updates `dnspython` from 2.8.0 to 2.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rthalley/dnspython/releases">dnspython's releases</a>.</em></p> <blockquote> <h2>dnspython 2.9.0</h2> <p>This release fixes a potential <a href="https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m">excessive CPU consumption</a> issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.</p> <p>See <a href="https://dnspython.readthedocs.io/en/stable/whatsnew.html">What's New</a> for details.</p> <p>The minimum supported version of Python is 3.11.</p> <p>My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.</p> <p>This release was published to PyPI using Trusted Publishing.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst">dnspython's changelog</a>.</em></p> <blockquote> <h2>2.9.0</h2> <ul> <li> <p>Decompression chain length is limited to 16. Prior to this change, a maliciously crafted DNS message could cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications which processed untrusted DNS wire form messages with dnspython could be degraded or DoS'd by the extra CPU use required.</p> <p>Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos for finding and reporting this issue.</p> <p>See <a href="https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m">https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m</a></p> </li> <li> <p>Httpx2 has replaced httpx for HTTPS TCP connections.</p> </li> <li> <p>The minimum supported Python version is now 3.11.</p> </li> <li> <p>DNSSEC now supports ML-DSA-44, a post-quantum signature algorithm.</p> </li> <li> <p>The NSEC3 Next Hashed Owner Name in presentation format is now decoded as base32hex (RFC 5155 Section 1.3, RFC 4648 Extended Hex Alphabet). The letters W, X, Y, and Z are not in that alphabet; they used to be accepted and silently decoded to a different owner name, so <code>to_text</code> of the result did not match the input. They are now rejected.</p> </li> <li> <p>The NID and L64 node/locator ids in presentation format are now rejected when a group contains anything other than hex digits. A sign or underscore, which <code>int()</code> silently accepts, produced a record whose text form did not parse back the same way (RFC 6742).</p> </li> <li> <p>Rdata of a known type in the generic <code>\#</code> syntax, such as an NS record in a zone file, no longer fails to parse when it contains a name under the origin. Its names are relativized as in the type's own text form.</p> </li> <li> <p>The SVCB and HTTPS <code>ech</code> parameter value must now be an ECHConfigList with a correct length prefix and at least 4 octets of content (RFC 9848, RFC 9849). The individual ECHConfig structures are not checked.</p> </li> <li> <p>SVCB and HTTPS SvcParamKeys in presentation format, including those listed in <code>mandatory</code>, must now be spelled as RFC 9460 requires: 1-63 lowercase letters, digits, or hyphens. Uppercase keys such as <code>ALPN</code> and keys with underscores such as <code>no_default_alpn</code> are rejected.</p> </li> <li> <p>SVCB and HTTPS presentation format parsing now follows the escaping rules of RFC 9460. SvcParamKeys may not contain escapes (e.g. <code>\097lpn=h2</code>), and in comma-separated values (<code>alpn</code>, <code>docpath</code>) only <code>\,</code> and <code>\\</code> are valid escapes after character-string decoding (e.g. <code>alpn="h2\\x"</code> is rejected).</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rthalley/dnspython/commit/e790c8f20a67ad439c7aafef2321e161c6028eee"><code>e790c8f</code></a> add missing test file</li> <li><a href="https://github.com/rthalley/dnspython/commit/b72af6723fa0df2113522132363eeda99c9abaa6"><code>b72af67</code></a> CI release branch update</li> <li><a href="https://github.com/rthalley/dnspython/commit/bdd62fed595a80b65feac75d7c2e1e3b908c56e6"><code>bdd62fe</code></a> release prep</li> <li><a href="https://github.com/rthalley/dnspython/commit/bafc96391dc352832fb17cc7939782735b642fb8"><code>bafc963</code></a> Merge branch 'decompression-limit'</li> <li><a href="https://github.com/rthalley/dnspython/commit/c5fecf515b4fa3a12e882bf80da232c94134cf50"><code>c5fecf5</code></a> release tidying</li> <li><a href="https://github.com/rthalley/dnspython/commit/c7686f3ef513d0da121f57fe1899bf2a2997da35"><code>c7686f3</code></a> update dependencies</li> <li><a href="https://github.com/rthalley/dnspython/commit/3c855c8d8f8269eb672aef3679cd2e33db924c03"><code>3c855c8</code></a> more type lint</li> <li><a href="https://github.com/rthalley/dnspython/commit/52815c91bbd831f6cbe85ed7bba4d7b8e1c25400"><code>52815c9</code></a> type lint</li> <li><a href="https://github.com/rthalley/dnspython/commit/f563427fecd9c0c4ba60cf002f2f33a5c396dd2a"><code>f563427</code></a> lint</li> <li><a href="https://github.com/rthalley/dnspython/commit/b485e460c266540a1a09ca6d8d1d7b685b1d3023"><code>b485e46</code></a> Limit decompression to a chain length of at most 16 pointers.</li> <li>Additional commits viewable in <a href="https://github.com/rthalley/dnspython/compare/v2.8.0...v2.9.0">compare view</a></li> </ul> </details> <br /> Updates `qbittorrent-api` from 2026.8.1 to 2026.10.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rmartin16/qbittorrent-api/releases">qbittorrent-api's releases</a>.</em></p> <blockquote> <h2>release-2026.10.0</h2> <h2>What's Changed</h2> <h3>Features</h3> <ul> <li>feat: add Web API v2.16.0 endpoints (qBittorrent v5.3.0) by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/659">rmartin16/qbittorrent-api#659</a></li> <li>feat: add Web API v2.16.2 endpoints (qBittorrent v5.3.0beta1) by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/678">rmartin16/qbittorrent-api#678</a></li> <li>feat: support qBittorrent v5.2.4 and v5.3.0rc1 by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/686">rmartin16/qbittorrent-api#686</a></li> </ul> <h3>Chores</h3> <ul> <li>Bump pre-commit hook for mirrors-mypy from v2.3.0 to v2.3.1 by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/677">rmartin16/qbittorrent-api#677</a></li> <li>Bump the github-actions group with 2 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/674">rmartin16/qbittorrent-api#674</a></li> <li>Bump the uv group with 6 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/675">rmartin16/qbittorrent-api#675</a></li> <li>Bump pre-commit hook for ruff-pre-commit from v0.16.1 to v0.16.5 by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/676">rmartin16/qbittorrent-api#676</a></li> <li>Bump soupsieve from 2.8.4 to 2.9 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/679">rmartin16/qbittorrent-api#679</a></li> <li>Bump anyio from 4.13.0 to 4.14.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/680">rmartin16/qbittorrent-api#680</a></li> <li>Bump pre-commit hook for ruff-pre-commit from v0.16.5 to v0.16.9 by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/683">rmartin16/qbittorrent-api#683</a></li> <li>Bump the github-actions group with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/681">rmartin16/qbittorrent-api#681</a></li> <li>Bump the uv group with 5 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/682">rmartin16/qbittorrent-api#682</a></li> <li>build(deps): bump virtualenv from 21.4.2 to 21.7.13 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/685">rmartin16/qbittorrent-api#685</a></li> </ul> <h3>CI</h3> <ul> <li>refactor(tests): parametrize test_add_delete and fix dead assertions by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/662">rmartin16/qbittorrent-api#662</a></li> <li>refactor(tests): derive an endpoint catalog and test the API surface from it by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/663">rmartin16/qbittorrent-api#663</a></li> <li>docs(tests): explain how the test suite works by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/664">rmartin16/qbittorrent-api#664</a></li> <li>refactor(tests): stop testing each camelCase alias over the network by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/665">rmartin16/qbittorrent-api#665</a></li> <li>fix(tests): make webseed checks survive a busy qBittorrent by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/667">rmartin16/qbittorrent-api#667</a></li> <li>refactor(tests): extend the catalog to interface spellings by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/666">rmartin16/qbittorrent-api#666</a></li> <li>refactor(tests): remove the gate twins the catalog now covers by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/669">rmartin16/qbittorrent-api#669</a></li> <li>refactor(tests): catalog torrent objects and drop the last gate twins by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/670">rmartin16/qbittorrent-api#670</a></li> <li>refactor(tests): add eventually() and migrate test_search to it by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/671">rmartin16/qbittorrent-api#671</a></li> <li>refactor(tests): finish the eventually() migration and delete check() by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/672">rmartin16/qbittorrent-api#672</a></li> <li>test(tests): fail any test that leaves state behind in qBittorrent by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/673">rmartin16/qbittorrent-api#673</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rmartin16/qbittorrent-api/compare/v2026.8.1...v2026.10.0">https://github.com/rmartin16/qbittorrent-api/compare/v2026.8.1...v2026.10.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rmartin16/qbittorrent-api/blob/main/CHANGELOG.md">qbittorrent-api's changelog</a>.</em></p> <blockquote> <h3>v2026.10.0 (03 oct 2026)</h3> <ul> <li>Advertise support for qBittorrent v5.2.4 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/686">#686</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/6580e6caf21a2b3360645e7605e35c47106db833"><code>6580e6c</code></a> bump to v2026.10.0</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/59b64b0d7b451a5d1ef6b2a4136f4368e0a9fd1b"><code>59b64b0</code></a> feat: support qBittorrent v5.2.4 and v5.3.0rc1 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/686">#686</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/9016912a7c448cb85d19620301fcacd2023e310d"><code>9016912</code></a> build(deps): bump virtualenv from 21.4.2 to 21.7.13 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/685">#685</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/e37548189948ef2feff614c646b4e88f24a023ab"><code>e375481</code></a> Bump the uv group with 5 updates (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/682">#682</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/6a9f89e98a74a63c5fbadd39face86963af2e027"><code>6a9f89e</code></a> Bump the github-actions group with 3 updates (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/681">#681</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/b08a1c8d7cafba855cc3b8158add4f2f32014a1c"><code>b08a1c8</code></a> Bumped pre-commit hook for ruff-pre-commit from v0.16.5 to v0.16.9 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/683">#683</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/13fcfb9a6867f3889c180e173f7be1b2806de747"><code>13fcfb9</code></a> Bump anyio from 4.13.0 to 4.14.2 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/680">#680</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/ea53fb27df0bb3108868def3a453003d2b2ab97a"><code>ea53fb2</code></a> Bump soupsieve from 2.8.4 to 2.9 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/679">#679</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/9972fbb319c4570f1548c88faa7316d624cec8cc"><code>9972fbb</code></a> feat: add Web API v2.16.2 endpoints (qBittorrent v5.3.0beta1) (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/678">#678</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/9457fc5b45a6e49ded846887ffd202557c061e48"><code>9457fc5</code></a> Bumped pre-commit hook for ruff-pre-commit from v0.16.1 to v0.16.5 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/676">#676</a>)</li> <li>Additional commits viewable in <a href="https://github.com/rmartin16/qbittorrent-api/compare/v2026.8.1...v2026.10.0">compare view</a></li> </ul> </details> <br /> Updates `authlib` from 1.8.0 to 1.9.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/authlib/authlib/releases">authlib's releases</a>.</em></p> <blockquote> <h2>v1.9.1</h2> <p>Changelog: <a href="https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1">https://docs.authlib.org/en/stable/upgrades/changelog.html#changelog-1-9-1</a></p> <h2>What's Changed</h2> <ul> <li>Use scriv to handle the changelog by <a href="https://github.com/azmeuk"><code>@azmeuk</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/954">authlib/authlib#954</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.9.0...v1.9.1">https://github.com/authlib/authlib/compare/v1.9.0...v1.9.1</a></p> <h2>v1.9.0</h2> <h2>What's Changed</h2> <ul> <li>feat: add Identity Assertion JWT Authorization Grant (ID-JAG) by <a href="https://github.com/BinoyOza-okta"><code>@BinoyOza-okta</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/898">authlib/authlib#898</a></li> <li>Fix empty signatures validation in JWS JSON deserialization by <a href="https://github.com/loporto"><code>@loporto</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/938">authlib/authlib#938</a></li> <li>fix(jose): reject boolean values for NumericDate claims by <a href="https://github.com/cpruijsen"><code>@cpruijsen</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/942">authlib/authlib#942</a></li> <li>fix(client): avoid duplicated OAuth 1.0 parameters in signed requests by <a href="https://github.com/cpruijsen"><code>@cpruijsen</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/943">authlib/authlib#943</a></li> <li>OAuth2 token fetch crashes with JSONDecodeError instead of a catchable error on rate-limit responses by <a href="https://github.com/juneja-varun"><code>@juneja-varun</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/929">authlib/authlib#929</a></li> <li>docs: add i18n wrappers in conf.py and templates by <a href="https://github.com/hwhsu1231"><code>@hwhsu1231</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/901">authlib/authlib#901</a></li> <li>fix(oauth): enforce JOSE key, scope, and audience validation by <a href="https://github.com/lepture"><code>@lepture</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/945">authlib/authlib#945</a></li> <li>AsyncOpenIDMixin.parse_id_token: return None when id_token is absent, matching the sync client by <a href="https://github.com/ckarnell"><code>@ckarnell</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/924">authlib/authlib#924</a></li> <li>fix(oauth): enforce nonce and JAR request validation by <a href="https://github.com/lepture"><code>@lepture</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/949">authlib/authlib#949</a></li> <li>fix(oauth): require client authentication for ID-JAG grants by <a href="https://github.com/lepture"><code>@lepture</code></a> in <a href="https://redirect.github.com/authlib/authlib/pull/955">authlib/authlib#955</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/BinoyOza-okta"><code>@BinoyOza-okta</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/898">authlib/authlib#898</a></li> <li><a href="https://github.com/loporto"><code>@loporto</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/938">authlib/authlib#938</a></li> <li><a href="https://github.com/cpruijsen"><code>@cpruijsen</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/942">authlib/authlib#942</a></li> <li><a href="https://github.com/juneja-varun"><code>@juneja-varun</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/929">authlib/authlib#929</a></li> <li><a href="https://github.com/hwhsu1231"><code>@hwhsu1231</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/901">authlib/authlib#901</a></li> <li><a href="https://github.com/ckarnell"><code>@ckarnell</code></a> made their first contribution in <a href="https://redirect.github.com/authlib/authlib/pull/924">authlib/authlib#924</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/authlib/authlib/compare/v1.8.0...v1.9.0">https://github.com/authlib/authlib/compare/v1.8.0...v1.9.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/authlib/authlib/commit/46b94870d915ee77430da8fa2a358378d90b3a45"><code>46b9487</code></a> chore: release 1.9.1</li> <li><a href="https://github.com/authlib/authlib/commit/abb3f49dd97b086ade807942957ffdf4949d9f30"><code>abb3f49</code></a> docs: use the issuer identifier as ID-JAG audience and fix broken links</li> <li><a href="https://github.com/authlib/authlib/commit/1bd2a313492ce0a4d0571c150730907aa3fc91ff"><code>1bd2a31</code></a> Merge commit from fork</li> <li><a href="https://github.com/authlib/authlib/commit/311da11e41ae44fac570ac5224a45e0fec993939"><code>311da11</code></a> docs: more detailed PKCE instructions</li> <li><a href="https://github.com/authlib/authlib/commit/873f72c0345a6fc9b303b2e686bab29cab90f4ac"><code>873f72c</code></a> docs: rpinitiated instructions</li> <li><a href="https://github.com/authlib/authlib/commit/4ff30db442c70e29486e1982cb0ad37c037f5f4b"><code>4ff30db</code></a> Merge commit from fork</li> <li><a href="https://github.com/authlib/authlib/commit/9a86ff3e54e3c87d419d425c105f03fd84f3fe39"><code>9a86ff3</code></a> docs: rpinitiated sequence chart</li> <li><a href="https://github.com/authlib/authlib/commit/1c357571408cad6c9a3cc08ea6df96df5e4edaf7"><code>1c35757</code></a> docs: RFC 9101 sequence chart</li> <li><a href="https://github.com/authlib/authlib/commit/a755e2869f07710a5077784d04807bbe9bfd8026"><code>a755e28</code></a> docs: add a sequence diagram to the token introspection page</li> <li><a href="https://github.com/authlib/authlib/commit/1996c567ed325c5e328f3c00dc7452ff79a89bd2"><code>1996c56</code></a> docs: PKCE flow chart illustration</li> <li>Additional commits viewable in <a href="https://github.com/authlib/authlib/compare/v1.8.0...v1.9.1">compare view</a></li> </ul> </details> <br /> Updates `apprise` from 2.0.0 to 2.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/caronc/apprise/releases">apprise's releases</a>.</em></p> <blockquote> <h2>Apprise v2.0.1</h2> <h2>What's Changed</h2> <p>Since the release of v2.0.0 there were some issues raised that I feel were major enough to to warrant a small update release. The big one is the handlng of markdown text.</p> <p>I had merged a few enhancements too; so they're thrown in this mini release as well.</p> <h3>🐞 Bugfixes</h3> <ul> <li>Escape unmatched markup characters for Telegram Markdown v1 by <a href="https://github.com/SulimanAbdulrazzaq"><code>@SulimanAbdulrazzaq</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1751">caronc/apprise#1751</a></li> <li>fix(matrix): accept HTTP 202 Accepted status code for Matrix responses by <a href="https://github.com/szhu25"><code>@szhu25</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1754">caronc/apprise#1754</a></li> <li>fix(matrix): preserve title/body separation in rich notifications by <a href="https://github.com/coder6955"><code>@coder6955</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1756">caronc/apprise#1756</a></li> <li>fixed html issue with flock in <a href="https://redirect.github.com/caronc/apprise/pull/1757">caronc/apprise#1757</a></li> <li>v2 Format Conversion Regression in <a href="https://redirect.github.com/caronc/apprise/pull/1761">caronc/apprise#1761</a></li> </ul> <h3>💡 Features</h3> <ul> <li>Rewrite spush:// for the new Simplepush API with tasks, attachments, ... by <a href="https://github.com/tymm"><code>@tymm</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1759">caronc/apprise#1759</a></li> <li>feat: support Nextcloud Talk bot authentication by <a href="https://github.com/beemines"><code>@beemines</code></a> in <a href="https://redirect.github.com/caronc/apprise/pull/1758">caronc/apprise#1758</a></li> <li>Telegram photo and video album support in <a href="https://redirect.github.com/caronc/apprise/pull/1762">caronc/apprise#1762</a></li> </ul> <h3>❤️ Life-Cycle Support</h3> <ul> <li>BulkSMS reference updates user -> token, pass -> secret in <a href="https://redirect.github.com/caronc/apprise/pull/1766">caronc/apprise#1766</a></li> <li>Update LoC badge by <a href="https://github.com/github-actions"><code>@github-actions</code></a>[bot] in <a href="https://redirect.github.com/caronc/apprise/pull/1752">caronc/apprise#1752</a></li> <li>Run the test suite in parallel with pytest-xdist in <a href="https://redirect.github.com/caronc/apprise/pull/1763">caronc/apprise#1763</a></li> <li>Only load PyYAML when YAML configuration is used in <a href="https://redirect.github.com/caronc/apprise/pull/1765">caronc/apprise#1765</a></li> </ul> <h2>Installation</h2> <p>Apprise is available <a href="https://pypi.org/project/apprise/">on PyPI</a> through <em>pip</em>:</p> <pre lang="bash"><code># Install Apprise v2.0.1 from PyPI pip install apprise==2.0.1 </code></pre> <p>If you use <a href="https://docs.astral.sh/uv/">uv</a>:</p> <pre lang="bash"><code># Install the apprise command uv tool install apprise==2.0.1 </code></pre> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/szhu25"><code>@szhu25</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1754">caronc/apprise#1754</a></li> <li><a href="https://github.com/coder6955"><code>@coder6955</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1756">caronc/apprise#1756</a></li> <li><a href="https://github.com/tymm"><code>@tymm</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1759">caronc/apprise#1759</a></li> <li><a href="https://github.com/beemines"><code>@beemines</code></a> made their first contribution in <a href="https://redirect.github.com/caronc/apprise/pull/1758">caronc/apprise#1758</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/caronc/apprise/compare/v2.0.0...v2.0.1">https://github.com/caronc/apprise/compare/v2.0.0...v2.0.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/caronc/apprise/commit/81739e9a1187f986a09281b5d0c25c806e8152e0"><code>81739e9</code></a> bumped version to v2.0.1</li> <li><a href="https://github.com/caronc/apprise/commit/6f5802654f02fb0513db6d31ba1738c4be39750d"><code>6f58026</code></a> Only load PyYAML when YAML configuration is used (<a href="https://redirect.github.com/caronc/apprise/issues/1765">#1765</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/b7d5d31c9f5f482af8d316a00e344b059f148f6c"><code>b7d5d31</code></a> BulkSMS reference updates user -> token, pass -> secret (<a href="https://redirect.github.com/caronc/apprise/issues/1766">#1766</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/c6817afb1bf3449e4d2cbbe0c5c731accba1ea4c"><code>c6817af</code></a> Run the test suite in parallel with pytest-xdist (<a href="https://redirect.github.com/caronc/apprise/issues/1763">#1763</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/5203e93971bd03f13b3e930709399093aae88368"><code>5203e93</code></a> v2 Format Conversion Regression (<a href="https://redirect.github.com/caronc/apprise/issues/1761">#1761</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/fb472569430a06131e28b854ba87941ebb21b8b3"><code>fb47256</code></a> Telegram photo and video album support (<a href="https://redirect.github.com/caronc/apprise/issues/1762">#1762</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/57f05eeeabe1eba11571892b4a9a37698a39c7b8"><code>57f05ee</code></a> Support Nextcloud Talk bot authentication (<a href="https://redirect.github.com/caronc/apprise/issues/1758">#1758</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/fe93b0d6ff443ab6c30561b56ca56ff78ed3e3d3"><code>fe93b0d</code></a> Updates to spush:// for the new Simplepush API with tasks + attachments (<a href="https://redirect.github.com/caronc/apprise/issues/1759">#1759</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/bfbf6590ee9dc1f76a8e3f4e49fb9fba8d77ba9d"><code>bfbf659</code></a> fixed html issue with flock (<a href="https://redirect.github.com/caronc/apprise/issues/1757">#1757</a>)</li> <li><a href="https://github.com/caronc/apprise/commit/ab9e23fae137b6542b24d9106c21121f3f482b96"><code>ab9e23f</code></a> fix(matrix): preserve title/body separation in rich notifications (<a href="https://redirect.github.com/caronc/apprise/issues/1756">#1756</a>)</li> <li>Additional commits viewable in <a href="https://github.com/caronc/apprise/compare/v2.0.0...v2.0.1">compare view</a></li> </ul> </details> <br /> Updates `publicsuffixlist` from 1.0.2.20260925 to 1.1.0.20261010 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/ko-zu/psl/blob/master/CHANGES.md">publicsuffixlist's changelog</a>.</em></p> <blockquote> <h3>1.1.0 (2026-10-10)</h3> <p>This version drops support for Python 3.5, 3.6 and 3.7, and now requires Python 3.8 or later.</p> <p>Packaging has been migrated to PEP 621 metadata in <code>pyproject.toml</code> using hatchling, replacing <code>setup.py</code>, <code>setup.cfg</code> and <code>MANIFEST.in</code>. The version is now read from <code>publicsuffixlist.__version__</code>, and development dependencies are locked with uv.</p> <ul> <li>Add PEP 561 <code>py.typed</code> marker and complete type annotations for the public API, including <code>compat</code> and the update script.</li> <li>Add an <code>accept_unknown</code> keyword argument to <code>is_private()</code> and <code>is_public()</code>.</li> <li>Fix <code>subdomain()</code> to honor the per-call <code>accept_unknown</code> argument, and to return <code>None</code> for invalid domains instead of raising <code>TypeError</code>.</li> <li>Correct the <code>subdomain()</code> and <code>privateparts()</code> overload signatures.</li> <li>Handle a malformed <code>Last-Modified</code> response header in the update script.</li> <li>Run tests with uv on Python 3.8 and 3.14, and update CI actions.</li> </ul> <h3>1.0.2 (2024-07-13)</h3> <ul> <li>Use <a href="https://github.com/typing"><code>@typing</code></a>.overload to indicate str-to-str domain input/output. <a href="https://redirect.github.com/ko-zu/psl/issues/32">#32</a>.</li> <li>Address deprecation of ByteString in python 3.14.</li> </ul> <h3>1.0.1 (2024-06-22)</h3> <p>Fix internal logic where domain name passed as a tuple of bytes, that contains UTF-8 encoded non-ascii chars, unintentionally matched PSL. Fixes <a href="https://redirect.github.com/ko-zu/psl/issues/31">#31</a>.</p> <h3>1.0.0 (2024-06-20)</h3> <p>This version drops support for Python 2.x and 3.4.</p> <p>The internal logic has been slightly changed to address conflicting evaluation rules between the PSL wiki and the test data. As with versions before 1.0.0, this module assumes that wildcards have implicit public declarations on the wildcard root.</p> <p>With the minimum Python version changed to 3.5, type annotations have been added to exposed API methods to clarify expected input types. For example, psl.publicsuffix() now accepts <code>str</code> or <code>Tuple[bytes, ...]</code>.</p> <ul> <li>Add tuple of bytes style input</li> <li>Add keep_case keyword argument</li> <li>Accept trailing dot</li> <li>Migrate CI to GitHub Actions</li> </ul> <h3>0.10.0 (2023-04-29)</h3> <p>The last version works on Python 2.7</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/ko-zu/psl/commits">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.54.12 to 4.56.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.56.2 - Update decorators and dependencies</h2> <h2>Update decorators and dependencies</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/d3ab07e8434d417bd47f989dddfbe5de78c1e3a7">Update the print_runtime() decorator</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4527">seleniumbase/SeleniumBase#4527</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/68bb983dd81eec140e0531ec03edc7075ac314ec">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/59a9ef3a51c6489d2edad14be4947ca2df7e3f98">Update CDP Mode examples</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Update decorators and dependencies by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4528">seleniumbase/SeleniumBase#4528</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.56.1...v4.56.2">https://github.com/seleniumbase/SeleniumBase/compare/v4.56.1...v4.56.2</a></p> <h2>4.56.1 - Fix dependency issue caused by a yank</h2> <h2>Fix dependency issue caused by a yank</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/5b340211db401cce84b95ef58a937a3b88d9cd6d">Refresh Python dependencies</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4525">seleniumbase/SeleniumBase#4525</a></li> <li><a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4526/commits/98e5aa2b4eb30f1be74c7d827bdc45b86a97ce72">Refresh a Python dependency</a> --> Update a dependency that dropped a version of Python.</li> </ul> <h2>4.56.0 - Full Python 3.15 Support</h2> <h2>Full Python 3.15 Support</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/55b294c8263eef3ac03df107de289ed295ecdb2f">Refresh Python dependencies</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4523">seleniumbase/SeleniumBase#4523</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7d8ea74d25255c7195d56606b035fadb2d0b86ed">Update driver methods</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ce8281135cb717cc5a628651f88c6bfe1a58b179">Update versioning for the MCP server</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Full Python 3.15 Support by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4524">seleniumbase/SeleniumBase#4524</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.55.2...v4.56.0">https://github.com/seleniumbase/SeleniumBase/compare/v4.55.2...v4.56.0</a></p> <h2>4.55.2 - Refresh Dependencies and Examples</h2> <h2>Refresh Dependencies and Examples</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/de21ad5ebc8690d7d9f8a16d775a7fb36fd4545a">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/e22408ee9193189143d68088d18759c59b734fd7">Update CDP Mode examples</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/1ab5d04ade3c05807b2e75fc1e3acddbaab389d5">Update Stealthy Playwright Mode examples</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0adae72339390d9f24bd38c9633dffe415953a45">Update the ReadMe</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Refresh Dependencies and Examples by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4522">seleniumbase/SeleniumBase#4522</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.55.1...v4.55.2">https://github.com/seleniumbase/SeleniumBase/compare/v4.55.1...v4.55.2</a></p> <h2>4.55.1 - Fast Mode for CDP Mode</h2> <h2>Fast Mode for CDP Mode</h2> <ul> <li><a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4520/commits/f1613ea974f16631739d9301cd31dcef65dce32b">Add Fast Mode to CDP Mode</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4519">seleniumbase/SeleniumBase#4519</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/c4524941fea728ad45033ab4084bf55566e609c0"><code>c452494</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4528">#4528</a> from seleniumbase/decorators-and-dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/8738b091c4bc9ff6172b46264b7054f3e111d264"><code>8738b09</code></a> Version 4.56.2</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ed62dcb9eab24e60500f46cd3f9770454276603e"><code>ed62dcb</code></a> Update MCP server versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/59a9ef3a51c6489d2edad14be4947ca2df7e3f98"><code>59a9ef3</code></a> Update CDP Mode examples</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/68bb983dd81eec140e0531ec03edc7075ac314ec"><code>68bb983</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/d3ab07e8434d417bd47f989dddfbe5de78c1e3a7"><code>d3ab07e</code></a> Update the <code>print_runtime()</code> decorator</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/6c09b0b828fba8ce9a1c2a947f410b6943045593"><code>6c09b0b</code></a> Update ReadMe files</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ce0493bd99148f8c30a98525ef9c14a3b44977a5"><code>ce0493b</code></a> Update the ReadMe</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ac18d10f63c7bfb295c6aff7c138905581af09c3"><code>ac18d10</code></a> Update the UC Mode ReadMe</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/86de26f2d0f475e79b0e0a751f4286e60250e8ef"><code>86de26f</code></a> Refresh mkdocs dependencies</li> <li>Additional commits viewable in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.12...v4.56.2">compare view</a></li> </ul> </details> <br /> Updates `basedpyright` from 1.40.1 to 1.40.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/detachhead/basedpyright/releases">basedpyright's releases</a>.</em></p> <blockquote> <h2>v1.40.2 (pyright 1.1.414)</h2> <h2>What's Changed</h2> <ul> <li>Fix typeshed packaging for the <code>browser-basedpyright</code> npm package by <a href="https://github.com/BertalanD"><code>@BertalanD</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1890">DetachHead/basedpyright#1890</a></li> <li>generate builtin docstrings for python 3.15 by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1895">DetachHead/basedpyright#1895</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/DetachHead/basedpyright/compare/v1.40.1...v1.40.2">https://github.com/DetachHead/basedpyright/compare/v1.40.1...v1.40.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DetachHead/basedpyright/commit/344759687c2fff3bd0a7d6a83a9d1847f806b795"><code>3447596</code></a> asdf</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/9c403f159a9680775b34c6925e6fa33bc675323e"><code>9c403f1</code></a> retry vscode publish because vs marketplace was down</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/fa4b52d9428c0f355c95af2056cfd4edd4e6e5da"><code>fa4b52d</code></a> 1.40.2</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/3ca944f19614eabc8c610cee44cede8d3ea9fa0c"><code>3ca944f</code></a> pin python version to 3.15</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/1f4822c168019322a88d90aa0d09a2ae54e25215"><code>1f4822c</code></a> add python 3.15 builtin docstrings</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/77cfb2da66a34388fc940670895c9a963731ed25"><code>77cfb2d</code></a> bump python dependencies & pnpm (<a href="https://redirect.github.com/detachhead/basedpyright/issues/1877">#1877</a>)</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/a8a92cd35f7b1f683ebed3ad573c4aacefa79bc6"><code>a8a92cd</code></a> formatting</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/d55e86a451ec338a902140c51d48bdb21cfb1102"><code>d55e86a</code></a> Fix typeshed packaging for browser-basedpyright</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/c63390c33f0877ee27c085820e1a24ec41e7def2"><code>c63390c</code></a> delete dependabot config. too much of a pain in the ass to configure it to no...</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/278e99c2f2594187cc56cafba97a0265c3dfce67"><code>278e99c</code></a> delete weekly typechecker benchmark workflow</li> <li>Additional commits viewable in <a href="https://github.com/detachhead/basedpyright/compare/v1.40.1...v1.40.2">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.5.4 to 0.5.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.5.5</h2> <h2>Release Notes</h2> <p>Released on 2026-10-05.</p> <h3>Enhancements</h3> <ul> <li>Add Nushell completion generation (<a href="https://redirect.github.com/j178/prek/pull/2785">#2785</a>)</li> <li>Add <code>ppc64le</code> wheel and binary builds (<a href="https://redirect.github.com/j178/prek/pull/2809">#2809</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid JSON imports when querying Python interpreters (<a href="https://redirect.github.com/j178/prek/pull/2790">#2790</a>)</li> <li>Avoid duplicate diffs after hooks rewrite files (<a href="https://redirect.github.com/j178/prek/pull/2815">#2815</a>)</li> <li>Batch file reads in shebang checks (<a href="https://redirect.github.com/j178/prek/pull/2793">#2793</a>)</li> <li>Check cached hook environments concurrently (<a href="https://redirect.github.com/j178/prek/pull/2797">#2797</a>)</li> <li>Overlap Git discovery with worktree status checks (<a href="https://redirect.github.com/j178/prek/pull/2821">#2821</a>)</li> <li>Query staged additions only for case conflicts (<a href="https://redirect.github.com/j178/prek/pull/2802">#2802</a>)</li> <li>Reduce worker overhead in XML and pygrep checks (<a href="https://redirect.github.com/j178/prek/pull/2789">#2789</a>)</li> <li>Reuse Git worktree state during hook startup (<a href="https://redirect.github.com/j178/prek/pull/2787">#2787</a>)</li> <li>Reuse intent-to-add paths when saving unstaged changes (<a href="https://redirect.github.com/j178/prek/pull/2788">#2788</a>)</li> <li>Run Git queries concurrently for case-conflict checks (<a href="https://redirect.github.com/j178/prek/pull/2792">#2792</a>)</li> <li>Share Bun and Deno version queries across environments (<a href="https://redirect.github.com/j178/prek/pull/2795">#2795</a>)</li> <li>Share Lua runtime probes across hook environments (<a href="https://redirect.github.com/j178/prek/pull/2796">#2796</a>)</li> <li>Share Ruby version queries across hook environments (<a href="https://redirect.github.com/j178/prek/pull/2794">#2794</a>)</li> <li>Share mise version queries across hook environments (<a href="https://redirect.github.com/j178/prek/pull/2798">#2798</a>)</li> <li>Skip site initialization in Python interpreter probes (<a href="https://redirect.github.com/j178/prek/pull/2822">#2822</a>)</li> <li>Skip untracked files in destroyed symlink checks (<a href="https://redirect.github.com/j178/prek/pull/2799">#2799</a>)</li> <li>Skip unused file input for always-run hooks (<a href="https://redirect.github.com/j178/prek/pull/2813">#2813</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve staged and unstaged changes on conflicted stash restore (<a href="https://redirect.github.com/j178/prek/pull/2803">#2803</a>)</li> <li>Default missing <code>core.fileMode</code> in shebang checks (<a href="https://redirect.github.com/j178/prek/pull/2832">#2832</a>)</li> <li>Match protected branch patterns from the start (<a href="https://redirect.github.com/j178/prek/pull/2829">#2829</a>)</li> <li>Normalize explicit paths in shebang index checks (<a href="https://redirect.github.com/j178/prek/pull/2831">#2831</a>)</li> <li>Preserve empty <code>trailing-whitespace</code> character sets (<a href="https://redirect.github.com/j178/prek/pull/2830">#2830</a>)</li> <li>Reject empty files in <code>check-json</code> (<a href="https://redirect.github.com/j178/prek/pull/2826">#2826</a>)</li> <li>Reject trailing data in <code>check-json</code> (<a href="https://redirect.github.com/j178/prek/pull/2828">#2828</a>)</li> <li>Round up file sizes in <code>check-added-large-files</code> (<a href="https://redirect.github.com/j178/prek/pull/2827">#2827</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Redesign the prek badge and refresh logo details (<a href="https://redirect.github.com/j178/prek/pull/2818">#2818</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/imphil"><code>@imphil</code></a></li> <li><a href="https://github.com/j178"><code>@j178</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/master/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.5.5</h2> <p>Released on 2026-10-05.</p> <h3>Enhancements</h3> <ul> <li>Add Nushell completion generation (<a href="https://redirect.github.com/j178/prek/pull/2785">#2785</a>)</li> <li>Add <code>ppc64le</code> wheel and binary builds (<a href="https://redirect.github.com/j178/prek/pull/2809">#2809</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid JSON imports when querying Python interpreters (<a href="https://redirect.github.com/j178/prek/pull/2790">#2790</a>)</li> <li>Avoid duplicate diffs after hooks rewrite files (<a href="https://redirect.github.com/j178/prek/pull/2815">#2815</a>)</li> <li>Batch file reads in shebang checks (<a href="https://redirect.github.com/j178/prek/pull/2793">#2793</a>)</li> <li>Check cached hook environments concurrently (<a href="https://redirect.github.com/j178/prek/pull/2797">#2797</a>)</li> <li>Overlap Git discovery with worktree status checks (<a href="https://redirect.github.com/j178/prek/pull/2821">#2821</a>)</li> <li>Query staged additions only for case conflicts (<a href="https://redirect.github.com/j178/prek/pull/2802">#2802</a>)</li> <li>Reduce worker overhead in XML and pygrep checks (<a href="https://redirect.github.com/j178/prek/pull/2789">#2789</a>)</li> <li>Reuse Git worktree state during hook startup (<a href="https://redirect.github.com/j178/prek/pull/2787">#2787</a>)</li> <li>Reuse intent-to-add paths when saving unstaged changes (<a href="https://redirect.github.com/j178/prek/pull/2788">#2788</a>)</li> <li>Run Git queries concurrently for case-conflict checks (<a href="https://redirect.github.com/j178/prek/pull/2792">#2792</a>)</li> <li>Share Bun and Deno version queries across environments (<a href="https://redirect.github.com/j178/prek/pull/2795">#2795</a>)</li> <li>Share Lua runtime probes across hook environments (<a href="https://redirect.github.com/j178/prek/pull/2796">#2796</a>)</li> <li>Share Ruby version queries across hook environments (<a href="https://redirect.github.com/j178/prek/pull/2794">#2794</a>)</li> <li>Share mise version queries across hook environments (<a href="https://redirect.github.com/j178/prek/pull/2798">#2798</a>)</li> <li>Skip site initialization in Python interpreter probes (<a href="https://redirect.github.com/j178/prek/pull/2822">#2822</a>)</li> <li>Skip untracked files in destroyed symlink checks (<a href="https://redirect.github.com/j178/prek/pull/2799">#2799</a>)</li> <li>Skip unused file input for always-run hooks (<a href="https://redirect.github.com/j178/prek/pull/2813">#2813</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve staged and unstaged changes on conflicted stash restore (<a href="https://redirect.github.com/j178/prek/pull/2803">#2803</a>)</li> <li>Default missing <code>core.fileMode</code> in shebang checks (<a href="https://redirect.github.com/j178/prek/pull/2832">#2832</a>)</li> <li>Match protected branch patterns from the start (<a href="https://redirect.github.com/j178/prek/pull/2829">#2829</a>)</li> <li>Normalize explicit paths in shebang index checks (<a href="https://redirect.github.com/j178/prek/pull/2831">#2831</a>)</li> <li>Preserve empty <code>trailing-whitespace</code> character sets (<a href="https://redirect.github.com/j178/prek/pull/2830">#2830</a>)</li> <li>Reject empty files in <code>check-json</code> (<a href="https://redirect.github.com/j178/prek/pull/2826">#2826</a>)</li> <li>Reject trailing data in <code>check-json</code> (<a href="https://redirect.github.com/j178/prek/pull/2828">#2828</a>)</li> <li>Round up file sizes in <code>check-added-large-files</code> (<a href="https://redirect.github.com/j178/prek/pull/2827">#2827</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Redesign the prek badge and refresh logo details (<a href="https://redirect.github.com/j178/prek/pull/2818">#2818</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/imphil"><code>@imphil</code></a></li> <li><a href="https://github.com/j178"><code>@j178</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/77cca6719ea8e3d9cc7a973e2c9e7648f4b0381d"><code>77cca67</code></a> Bump version to 0.5.5 (<a href="https://redirect.github.com/j178/prek/issues/2839">#2839</a>)</li> <li><a href="https://github.com/j178/prek/commit/f4e26958292ae25403f40300050cf943e67132c3"><code>f4e2695</code></a> Update Rust crate jsonc-parser to 0.34.0 (<a href="https://redirect.github.com/j178/prek/issues/2838">#2838</a>)</li> <li><a href="https://github.com/j178/prek/commit/399e9d1158fa0377073ddd9db49e01e4b8fba49b"><code>399e9d1</code></a> Update GitHub Actions (<a href="https://redirect.github.com/j178/prek/issues/2837">#2837</a>)</li> <li><a href="https://github.com/j178/prek/commit/19e77d12b34f51c2d296eeeed3cc470c31372c1a"><code>19e77d1</code></a> Update prek hooks (<a href="https://redirect.github.com/j178/prek/issues/2771">#2771</a>)</li> <li><a href="https://github.com/j178/prek/commit/e261e0cce1aac6625960397cf513254e2e72bdf1"><code>e261e0c</code></a> Update dependency uv to v0.12.19 (<a href="https://redirect.github.com/j178/prek/issues/2835">#2835</a>)</li> <li><a href="https://github.com/j178/prek/commit/bc53e2ce2041d70d1c19c9063cbc1b1c570b2422"><code>bc53e2c</code></a> Update Rust crate thiserror to v2.0.21 (<a href="https://redirect.github.com/j178/prek/issues/2836">#2836</a>)</li> <li><a href="https://github.com/j178/prek/commit/4a981d25ecd2b6f43aa0c3525d589428c5a0de29"><code>4a981d2</code></a> Default missing core.fileMode in shebang checks (<a href="https://redirect.github.com/j178/prek/issues/2832">#2832</a>)</li> <li><a href="https://github.com/j178/prek/commit/e0310220a5d428d2fb49878c538a61458a0ed62f"><code>e031022</code></a> Preserve empty trailing-whitespace character sets (<a href="https://redirect.github.com/j178/prek/issues/2830">#2830</a>)</li> <li><a href="https://github.com/j178/prek/commit/0b1871acd9164b566e6e9c10aff0123a68e0352c"><code>0b1871a</code></a> Normalize explicit paths in shebang index checks (<a href="https://redirect.github.com/j178/prek/issues/2831">#2831</a>)</li> <li><a href="https://github.com/j178/prek/commit/9d4aedefcc3c152e87954b19d847df7f4662db06"><code>9d4aede</code></a> Match protected branch patterns from the start (<a href="https://redirect.github.com/j178/prek/issues/2829">#2829</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.5.4...v0.5.5">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.9 to 0.17.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.17.1</h2> <h2>Release Notes</h2> <p>Released on 2026-10-15.</p> <h3>Preview features</h3> <ul> <li>[<code>pycodestyle</code>] Don't treat <code>None</code>, <code>True</code>, or <code>False</code> as keywords (<code>E271</code>-<code>E274</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29322">#29322</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix dedent with multiple leading comments (<a href="https://redirect.github.com/astral-sh/ruff/pull/29382">#29382</a>)</li> <li>[<code>flake8-pyi</code>] Detect legacy positional-only parameters in <code>__new__</code> methods (<code>PYI063</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28502">#28502</a>)</li> <li>[<code>flake8-pyi</code>] Fix false positives on quoted annotations (<code>PYI036</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29274">#29274</a>)</li> <li>[<code>perflint</code>] Avoid invalid comprehension suggestions (<code>PERF401</code>, <code>PERF403</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29366">#29366</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Treat more <code>collections</code> and <code>weakref</code> containers as mutable (<a href="https://redirect.github.com/astral-sh/ruff/pull/29213">#29213</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>flake8-import-conventions</code>] Update default and example <code>aliases</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/29333">#29333</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/fixfon"><code>@fixfon</code></a></li> <li><a href="https://github.com/mmaxjr"><code>@mmaxjr</code></a></li> <li><a href="https://github.com/joshuavetos"><code>@joshuavetos</code></a></li> <li><a href="https://github.com/nekomario28"><code>@nekomario28</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/shan3520"><code>@shan3520</code></a></li> </ul> <h2>Install ruff 0.17.1</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex" </code></pre> <h2>Download ruff 0.17.1</h2> <p>| File | Platform | Checksum |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.17.1</h2> <p>Released on 2026-10-15.</p> <h3>Preview features</h3> <ul> <li>[<code>pycodestyle</code>] Don't treat <code>None</code>, <code>True</code>, or <code>False</code> as keywords (<code>E271</code>-<code>E274</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29322">#29322</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix dedent with multiple leading comments (<a href="https://redirect.github.com/astral-sh/ruff/pull/29382">#29382</a>)</li> <li>[<code>flake8-pyi</code>] Detect legacy positional-only parameters in <code>__new__</code> methods (<code>PYI063</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28502">#28502</a>)</li> <li>[<code>flake8-pyi</code>] Fix false positives on quoted annotations (<code>PYI036</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29274">#29274</a>)</li> <li>[<code>perflint</code>] Avoid invalid comprehension suggestions (<code>PERF401</code>, <code>PERF403</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/29366">#29366</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Treat more <code>collections</code> and <code>weakref</code> containers as mutable (<a href="https://redirect.github.com/astral-sh/ruff/pull/29213">#29213</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>flake8-import-conventions</code>] Update default and example <code>aliases</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/29333">#29333</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/fixfon"><code>@fixfon</code></a></li> <li><a href="https://github.com/mmaxjr"><code>@mmaxjr</code></a></li> <li><a href="https://github.com/joshuavetos"><code>@joshuavetos</code></a></li> <li><a href="https://github.com/nekomario28"><code>@nekomario28</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> <li><a href="https://github.com/shan3520"><code>@shan3520</code></a></li> </ul> <h2>0.17.0</h2> <p>Released on 2026-10-09.</p> <p>The executables in our macOS and Windows release archives and <code>ruff</code> wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.</p> <h3>Breaking changes</h3> <ul> <li> <p>Update the default and latest Python versions for 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28792">#28792</a>)</p> <p>Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through <a href="https://docs.astral.sh/ruff/settings/#target-version"><code>target-version</code></a> or <a href="https://docs.astral.sh/ruff/configuration/#inferring-the-python-version"><code>requires-python</code></a>. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/4683270c69cbdaf6ad64d3f983fc458d5a43b41f"><code>4683270</code></a> Bump version to 0.17.1 (<a href="https://redirect.github.com/astral-sh/ruff/issues/29420">#29420</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/3514027edb659bbc3c787d355be9d130e5587f15"><code>3514027</code></a> [ty] Update typing conformance suite pin (<a href="https://redirect.github.com/astral-sh/ruff/issues/29417">#29417</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/829455624d78f2e89669e4b4b14af2b96abdb1ae"><code>8294556</code></a> Update referenced PR security-review workflow (<a href="https://redirect.github.com/astral-sh/ruff/issues/29237">#29237</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d1e1b1f69b511df4385f64b510eeec4da01c1a0e"><code>d1e1b1f</code></a> [ty] Preserve recursive aliases when rebuilding intersections (<a href="https://redirect.github.com/astral-sh/ruff/issues/29057">#29057</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/93526150df078af7dd8fc4226cdcc469539d2001"><code>9352615</code></a> [<code>perflint</code>] Avoid invalid comprehension suggestions (<code>PERF401</code>, <code>PERF403</code>) (...</li> <li><a href="https://github.com/astral-sh/ruff/commit/83a3afc3156d73ae4296f3fa74ede28e4c72bfcd"><code>83a3afc</code></a> Fix dedent with multiple leading comments (<a href="https://redirect.github.com/astral-sh/ruff/issues/29382">#29382</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/b42a8734410230f4529151782cae951b99bed858"><code>b42a873</code></a> [ty] Clarify object attribute write-contract rationale (<a href="https://redirect.github.com/astral-sh/ruff/issues/29384">#29384</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/d01678ebf594c97a7767d4372061c1f80ae5b5bb"><code>d01678e</code></a> [ty] Clarify object attribute write-contract rationale (<a href="https://redirect.github.com/astral-sh/ruff/issues/29384">#29384</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/355b42a7719d8a555e3ee50c89848b42d8a11eb5"><code>355b42a</code></a> [ty] Avoid writable override contracts from object (<a href="https://redirect.github.com/astral-sh/ruff/issues/29373">#29373</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/e26e6d2a54ac2c5e1f5b1945042de3ff3885bf8e"><code>e26e6d2</code></a> [ty] Collect intersection inference through constraint relations (<a href="https://redirect.github.com/astral-sh/ruff/issues/28677">#28677</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.9...0.17.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
 
|
c8d66db22e |
feat(direct_download): add OceanofPDF as a standalone search and download provider (#1485)
Closes #1149 ## What this adds OceanofPDF as a second Direct Download provider, alongside Anna's Archive. Unlike Z-Library, LibGen and Welib, which only download files Anna's Archive found, OceanofPDF searches and downloads on its own. It works with or without an AA mirror configured; with both, one search queries both and the results are merged. It plugs into the provider registry from #1337, so search, record routing and the download handler need no changes. **Search:** WordPress `/?s=` search, "title author" first, then the bare title if that finds nothing. One release per advertised format (`[PDF] [EPUB]`), with title, author and cover. Shelfmark's supported-format filter applies as usual. **Download** follows the site's three hops: 1. The book page has one POST form per format, targeting `Fetching_Resource.php`. 2. That returns an interstitial whose `<meta http-equiv="refresh">` points at a signed, expiring file URL. 3. The file URL serves the book. Pages go through `html_get_page` and its Cloudflare bypass. The form POST replays the clearance the bypasser stored, and re-solves once if challenged. Bypassers only replay GETs, so it can't be handed over directly. **Settings:** - `OCEANOFPDF_MIRROR_URLS` under Mirrors. Only the first URL is used. - An OceanofPDF toggle under Download Sources → Slow downloads. It's locked until a mirror is set and while the Cloudflare bypass is off. Its position in the list doesn't matter, and its description says so. - A saved list from before this change has no OceanofPDF entry. The settings page shows a missing option as off, so the provider treats it as off too, keeping the page and the behaviour in agreement. New installs default to on. ## Fixes found along the way - **`challenge_marker` rejected real pages behind Cloudflare** (separate commit, `fix(bypass)`). Cloudflare's bot-detection script injects `/cdn-cgi/challenge-platform/scripts/jsd/main.js` into every page it serves, after load. Bypassers return the rendered page, so a successful FlareSolverr solve of any page under 64 KB came back carrying `/cdn-cgi/challenge-platform` and was rejected as unsolved. The detector now ignores that one script path. Real challenge pages load from `/cdn-cgi/challenge-platform/h/…` and keep their other markers, so they are still caught. This also affects any other Cloudflare-fronted host, not just OceanofPDF. Happy to split it into its own PR if you prefer. - **Brotli on a plain `requests` call.** Copying `DOWNLOAD_HEADERS` into the form POST offered `br`. Cloudflare then answered in Brotli, which `requests` can't decode without the optional `brotli` package. The POST now leaves `Accept-Encoding` to `requests`. If a response still has no file link, its status, encoding, title and challenge marker are logged. ## Testing - **New tests:** 41 in `tests/direct_download/test_oceanofpdf.py` and 4 in `tests/bypass/test_cloudflare_beacon.py`. They cover search parsing, format and language filtering, form selection, the interstitial, the download flow (including a challenged POST, an HTML stub served as the file, and cancellation), the toggle, and registry wiring. Fixtures mirror the live site's markup. - **Existing tests:** `tests/direct_download`, `tests/bypass`, `tests/config`, `tests/core` and `tests/download` show no new failures against `main`. Some tests in those folders can't run on Windows; those fail identically on both. - **Lint:** `ruff check` and `ruff format --check` are clean on every changed file. - **Live:** verified end to end on a v1.4.0 Docker deployment behind FlareSolverr (external bypasser), with only an OceanofPDF mirror configured: search, then the book page, the form POST and the completed download. ## Known limits - OceanofPDF doesn't label languages, so its results always pass a language filter. - PDFs only appear when `pdf` is in the supported formats. - Each query reads the first results page only (roughly 7–10 books). - Downloaded files carry OceanofPDF's own tags/watermark, as noted in #1149. They aren't stripped. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Adam Stone <196691089+ast0ne1@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |