starred/shelfmark
1
0 Fork 0
mirror of https://github.com/calibrain/shelfmark.git synced 2026-11-15 18:08:12 +00:00
Code Issues Packages Projects Releases 10 Wiki Activity
634 Commits 5 Branches 52 Tags
3c5cfcb77d75bcb5c07d85675525ee21fb6a63fa
Commit Graph
634 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
CaliBrain 3c5cfcb77d fix/redact log secrets (#1488) 
- fix(logging): mask tracker API keys in log output (#1486)
- fix(welib): follow slow_download links through the countdown (#1447)
 2026-10-20 01:55:49 -04:00
William Leerbeck MeyerClaude Opus 5.5CaliBrain
 		8369f1b626 fix(docker): bump Chromium pin to 155.0.8059.79 (#1477) 
The `149.0.7827.196` pin from #1105 now lacks fixes for two Chromium
CVEs on CISA's Known Exploited Vulnerabilities list:

- CVE-2026-85046, fixed in `152.0.7977.82-1~deb13u1`
- CVE-2026-87491, fixed in `153.0.8010.47-2~deb13u1`

Trivy also reports 46 critical and 534 high Chromium CVEs in
`shelfmark:latest` (1.4.0). This browser runs third-party mirror pages
with the sandbox off.

The 150 regression behind the pin, a missing DevTools TCP port, no
longer occurs in Debian's current trixie-security build,
**155.0.8059.79-1~deb13u1**. In a copy of `shelfmark:latest` upgraded to
that version, `cdp_driver.start_async(...)` with the bypasser's own
arguments (`xvfb=True, sandbox=False, incognito=True, ad_block=True`,
plus the `_get_browser_args()` flags) starts and loads a page, as it
does on 149. A live DDoS-Guard or Cloudflare challenge wasn't tested.

The change bumps `CHROMIUM_VERSION` and moves `CHROMIUM_SNAPSHOT` to
`20261016T000000Z`, the first snapshot containing that version for amd64
and arm64. It also updates the comment. The Chromium `RUN` step builds
on the pinned `python:3.14.7-slim` base.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-20 01:34:37 -04:00
splitsec2sandwichsandwichCopilot Autofix powered by AI
 		bb1655238a feat(slskd): add Soulseek (slskd) release source, building on #1335 (#1428) 
## Add Soulseek (slskd) as a release source, building on #1335

This is @dskvr's work from #1335 rebased onto current `main`, with my
changes on top. #1335 has been quiet since 2026-09-13 and I needed the
changes below, so I carried it forward instead of starting over. Their
two commits are the first two in this branch with their authorship
intact, and the source plugin, handler, API client, settings tab, tests,
`ReleaseProtocol.SOULSEEK`, test client compose file and frontend bits
are all theirs. I haven't changed how a search turns into releases
beyond what is listed here.

If @dskvr would rather keep #1335 alive and take these as commits on
their branch, I can do that instead and close this.

### What I changed

**Downloads survive other apps using the same slskd.** The handler found
its files by listing slskd's downloads, and another app on the same
instance (SoulSync here) sends `DELETE
/transfers/downloads/all/completed` after each of its batches. Once that
ran, a finished download no longer appeared in the list and the task
never saw it complete, even though the files were on disk. With the new
`SLSKD_ISOLATE_DOWNLOADS` setting (on by default) each task:

- enqueues one batch (`POST /transfers/downloads/batches`) into its own
folder, `<SLSKD_DESTINATION_PREFIX>/<task id>`
- polls each transfer by id, which slskd still answers after the list
has been cleared
- decides it is done from the files on disk (sizes, not names), with the
`/events` log as a fallback when the transfers are gone and the files
aren't visible yet
- copies out of that folder, and removes it only if
`SLSKD_KEEP_COMPLETED` is off and the import worked

With isolation off the handler behaves as it did in #1335. If the batch
endpoint isn't there (404/405) it falls back to the original per-file
enqueue.

**Source changes.** m4b/m4a files are their own release next to loose
chapter files, so auto-download can prefer one file over a chapter set.
Results from the query variants are merged per peer. The folder text is
exposed as `extra["author"]` and `extra["title_raw"]`, which is what
auto-download's strict match and pack detection read. `is_available()`
also needs an API key now.

**Smaller fixes.** Cancelling while files are still being located now
removes the transfer records it created. In the settings tab, a cleared
form field is no longer replaced by the saved value when testing the
connection. The new settings are in `docs/environment-variables.md`.

### Testing

`tests/slskd` has 192 passing and 6 live tests that skip without an
instance. I wrote the new tests first and checked the handler and source
rules by breaking them and confirming a test failed. Ruff is clean. On
the whole suite the only failures are 4 in `tests/download` that import
`seleniumbase`, which isn't installed in my environment, and they fail
the same on `main`.

I've been running this on my own deployment against slskd 0.26.0 behind
a VPN, with SoulSync active on a second instance. A search returned a
couple hundred results from about 70 peers, an epub came down and was
imported, and auto-download fetched five audiobooks as single m4b files.
That is a day of use, so I don't know how it behaves on other slskd
versions or on Windows path mappings.

---------

Co-authored-by: sandwich <dskvr@users.noreply.github.com>
Co-authored-by: sandwich <299465+dskvr@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
 2026-10-20 01:33:12 -04:00
dependabot[bot] 5669b0686a build(deps): bump the gh-actions group with 5 updates (#1472) 
Bumps the gh-actions group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.2.0`
| `10.3.0` |
| [actions/setup-node](https://github.com/actions/setup-node) | `7.0.0`
| `7.1.0` |
| [github/codeql-action/init](https://github.com/github/codeql-action) |
`4.38.2` | `4.38.3` |
|
[github/codeql-action/autobuild](https://github.com/github/codeql-action)
| `4.38.2` | `4.38.3` |
|
[github/codeql-action/analyze](https://github.com/github/codeql-action)
| `4.38.2` | `4.38.3` |

Updates `astral-sh/setup-uv` from 10.2.0 to 10.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's
releases</a>.</em></p>
<blockquote>
<h2>v10.3.0 🌈 Add Python architecture selection</h2>
<h2>Changes</h2>
<p>This release adds the <code>python-arch</code> input to select a
Python architecture independently of the Python version. With
<code>uv</code> 0.13.0 or later, set <code>python-arch: x86_64</code> to
use x64 Python on Windows ARM64 runners.</p>
<p>It also includes embedded checksums for <code>uv</code> releases
through 0.13.0.</p>
<ul>
<li>Use macOS 15 runners for tests <a
href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1081">#1081</a>)</li>
</ul>
<h2>🚀 Enhancements</h2>
<ul>
<li>Add <code>python-arch</code> support <a
href="https://github.com/zanieb"><code>@​zanieb</code></a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1079">#1079</a>)</li>
</ul>
<h2>🧰 Maintenance</h2>
<ul>
<li>chore: update known checksums for 0.13.0 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1089">#1089</a>)</li>
<li>chore: update known checksums for 0.12.24 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1084">#1084</a>)</li>
<li>chore: update known checksums for 0.12.23 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1082">#1082</a>)</li>
<li>chore: update known checksums for 0.12.22 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1080">#1080</a>)</li>
<li>chore: update known checksums for 0.12.21 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1078">#1078</a>)</li>
<li>chore: update known checksums for 0.12.20 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1076">#1076</a>)</li>
<li>chore: update known checksums for 0.12.19 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1068">#1068</a>)</li>
<li>chore: update known checksums for 0.12.18 @<a
href="https://github.com/apps/github-actions">github-actions[bot]</a>
(<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1065">#1065</a>)</li>
</ul>
<h2>⬆️ Dependency updates</h2>
<ul>
<li>chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 @<a
href="https://github.com/apps/dependabot">dependabot[bot]</a> (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1077">#1077</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/1c37ad07a6a961277cf70c0d37d6f313000f5884"><code>1c37ad0</code></a>
chore: update known checksums for 0.13.0 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1089">#1089</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/b3c9b5fc56ebc90760c43b1ac9552c0d1705d3ca"><code>b3c9b5f</code></a>
chore: update known checksums for 0.12.24 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1084">#1084</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/b06acff4b6a41bdd9cdac56507ead0bd7734e757"><code>b06acff</code></a>
Add <code>python-arch</code> support (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1079">#1079</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/c84232ca4fde9b022e20a930bfbbecd386b56fdf"><code>c84232c</code></a>
chore: update known checksums for 0.12.23 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1082">#1082</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/51fdd265d38a27ffcbca0da885510bc6fcc0ff55"><code>51fdd26</code></a>
Use macOS 15 runners for tests (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1081">#1081</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/a96208bed1fb5efb8da349c9bcc6cc58af9e7d74"><code>a96208b</code></a>
chore: update known checksums for 0.12.22 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1080">#1080</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/0e3884b860e20d3f4d5daa2347130beb51ccde47"><code>0e3884b</code></a>
chore: update known checksums for 0.12.21 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1078">#1078</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/bcf05803b55ef01a5ec6368521ee1b42f97bc438"><code>bcf0580</code></a>
chore: update known checksums for 0.12.20 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1076">#1076</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/b92a892142bde7280cd163c2abff341413314f9f"><code>b92a892</code></a>
chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1077">#1077</a>)</li>
<li><a
href="https://github.com/astral-sh/setup-uv/commit/227a0f6bea25cde3444f52decccf4a18de6635f4"><code>227a0f6</code></a>
chore: update known checksums for 0.12.19 (<a
href="https://redirect.github.com/astral-sh/setup-uv/issues/1068">#1068</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/setup-uv/compare/c18668ad3cf93ea998bef934396af7bb5c839dc7...1c37ad07a6a961277cf70c0d37d6f313000f5884">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/setup-node` from 7.0.0 to 7.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-node/releases">actions/setup-node's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements:</h3>
<ul>
<li>Add support for mise.toml file by <a
href="https://github.com/gperdomor"><code>@​gperdomor</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1421">actions/setup-node#1421</a></li>
<li>Support absolute paths in node-version-file by <a
href="https://github.com/v-mahabaleshwars"><code>@​v-mahabaleshwars</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1633">actions/setup-node#1633</a></li>
</ul>
<h3>Bug fixes:</h3>
<ul>
<li>Add Node version validation and manifest fetch retry by <a
href="https://github.com/v-jitenderpalsingh"><code>@​v-jitenderpalsingh</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1580">actions/setup-node#1580</a></li>
</ul>
<h3>Documentation updates:</h3>
<ul>
<li>README.md: bump actions/checkout to latest version 7 by <a
href="https://github.com/deining"><code>@​deining</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1578">actions/setup-node#1578</a></li>
<li>docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change by <a
href="https://github.com/v-gowridurgad"><code>@​v-gowridurgad</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1593">actions/setup-node#1593</a></li>
<li>Fixed cache recommendation syntax by <a
href="https://github.com/SubJunk"><code>@​SubJunk</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1603">actions/setup-node#1603</a></li>
</ul>
<h3>Dependency updates:</h3>
<ul>
<li>Update workflow pins and migrate Node matrices to modern versions by
<a
href="https://github.com/v-HarithaVattikuti"><code>@​v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1583">actions/setup-node#1583</a></li>
<li>Upgrade <code>@​actions/cache</code> to 6.2.0 by <a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1584">actions/setup-node#1584</a></li>
<li>Pin <code>@​types/node</code> to v24 by <a
href="https://github.com/v-priyagupta108"><code>@​v-priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1585">actions/setup-node#1585</a></li>
<li>Override brace-expansion to 5.0.8 by <a
href="https://github.com/v-priyagupta108"><code>@​v-priyagupta108</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-node/pull/1599">actions/setup-node#1599</a></li>
<li>Upgrade actions/checkout from 7.0.0 to 7.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1598">actions/setup-node#1598</a></li>
<li>Upgrade prettier from 3.8.4 to 3.9.6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1590">actions/setup-node#1590</a></li>
<li>Upgrade <code>@​vercel/ncc</code> from 0.44.0 to 0.45.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1610">actions/setup-node#1610</a></li>
<li>Upgrade pnpm/action-setup from 6.0.9 to 6.0.10 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1602">actions/setup-node#1602</a></li>
<li>Upgrade baseline-browser-mapping from 2.10.38 to 2.11.22 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1629">actions/setup-node#1629</a></li>
<li>Upgrade <code>@​types/semver</code> from 7.7.1 to 7.8.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1616">actions/setup-node#1616</a></li>
<li>Upgrade <code>@​typescript-eslint/parser</code> from 8.62.0 to
8.70.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1615">actions/setup-node#1615</a></li>
<li>Upgrade pnpm/action-setup from 6.0.10 to 6.1.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1631">actions/setup-node#1631</a></li>
<li>Upgrade jest-each from 30.4.1 to 30.5.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1636">actions/setup-node#1636</a></li>
<li>Upgrade eslint-plugin-n from 18.1.0 to 18.3.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1638">actions/setup-node#1638</a></li>
<li>Update dependencies and add license files by <a
href="https://github.com/v-HarithaVattikuti"><code>@​v-HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-node/pull/1642">actions/setup-node#1642</a></li>
<li>Upgrade eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to
7.1.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-node/pull/1635">actions/setup-node#1635</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/v-jitenderpalsingh"><code>@​v-jitenderpalsingh</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1580">actions/setup-node#1580</a></li>
<li><a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1584">actions/setup-node#1584</a></li>
<li><a href="https://github.com/gperdomor"><code>@​gperdomor</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1421">actions/setup-node#1421</a></li>
<li><a href="https://github.com/SubJunk"><code>@​SubJunk</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-node/pull/1603">actions/setup-node#1603</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0">https://github.com/actions/setup-node/compare/v7.0.0...v7.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-node/commit/949feb2413d6458794dcd2491c4babbbce0c15c1"><code>949feb2</code></a>
Bump eslint from 10.5.0 to 10.11.0 and package.json from 7.0.0 to 7.1.0
(<a
href="https://redirect.github.com/actions/setup-node/issues/1635">#1635</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/7207c4f1189c7ee83ddf20c7c68bd1af6fdd751c"><code>7207c4f</code></a>
chore: update dependencies and add license files (<a
href="https://redirect.github.com/actions/setup-node/issues/1642">#1642</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/54337e0d02de9202d0948aaff36ad556375497b9"><code>54337e0</code></a>
Bump eslint-plugin-n from 18.1.0 to 18.3.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1638">#1638</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/fb54fa8c14c63410cc752f0ae3b7b3ca6af161fc"><code>fb54fa8</code></a>
Bump jest-each from 30.4.1 to 30.5.2 (<a
href="https://redirect.github.com/actions/setup-node/issues/1636">#1636</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/7f84f1d52d0c56afb45c62fee31a93b843cea4d6"><code>7f84f1d</code></a>
Bump pnpm/action-setup from 6.0.10 to 6.1.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1631">#1631</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/0c54c7b07420dcba69a7d832587f55ebdf771c9e"><code>0c54c7b</code></a>
Bump <code>@​typescript-eslint/parser</code> from 8.62.0 to 8.70.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1615">#1615</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/a8294190049a9c296f01b9a432aff41dd83d8284"><code>a829419</code></a>
Bump <code>@​types/semver</code> from 7.7.1 to 7.8.0 (<a
href="https://redirect.github.com/actions/setup-node/issues/1616">#1616</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/680d1e489b82f1243de15bc7665c0007e3c9a860"><code>680d1e4</code></a>
Support absolute paths in node-version-file (<a
href="https://redirect.github.com/actions/setup-node/issues/1633">#1633</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/db0fb3a98ed314b69026b6e8c9be26a7e2fe65a8"><code>db0fb3a</code></a>
Bump baseline-browser-mapping from 2.10.38 to 2.11.22 (<a
href="https://redirect.github.com/actions/setup-node/issues/1629">#1629</a>)</li>
<li><a
href="https://github.com/actions/setup-node/commit/94196ee1d15439c1b6651cd87ef14e88ec435966"><code>94196ee</code></a>
Bump pnpm/action-setup from 6.0.9 to 6.0.10 (<a
href="https://redirect.github.com/actions/setup-node/issues/1602">#1602</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-node/compare/820762786026740c76f36085b0efc47a31fe5020...949feb2413d6458794dcd2491c4babbbce0c15c1">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/init` from 4.38.2 to 4.38.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.38.3</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d"><code>24c5418</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4214">#4214</a>
from github/update-v4.38.3-e0b52dbdc</li>
<li><a
href="https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8"><code>69e87c5</code></a>
Add changelog note for <a
href="https://redirect.github.com/github/codeql-action/issues/4184">#4184</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa"><code>23b6828</code></a>
Update changelog for v4.38.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b"><code>e0b52db</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4210">#4210</a>
from github/henrymercer/pin-python-for-older-clis-in-ci</li>
<li><a
href="https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc"><code>6b99698</code></a>
Pin Python 3.13.15 for older CLI versions in multi-language check</li>
<li><a
href="https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8"><code>63d3d63</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4203">#4203</a>
from github/update-bundle/codeql-bundle-v2.27.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe"><code>7377a10</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524"><code>c1a30cd</code></a>
Update default bundle to codeql-bundle-v2.27.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974"><code>d208ec7</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4200">#4200</a>
from github/mbg/esm/migrate-pr-checks</li>
<li><a
href="https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845"><code>a71b0c6</code></a>
Replace <code>__dirname</code> in <code>sync.ts</code></li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/autobuild` from 4.38.2 to 4.38.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's
releases</a>.</em></p>
<blockquote>
<h2>v4.38.3</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d"><code>24c5418</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4214">#4214</a>
from github/update-v4.38.3-e0b52dbdc</li>
<li><a
href="https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8"><code>69e87c5</code></a>
Add changelog note for <a
href="https://redirect.github.com/github/codeql-action/issues/4184">#4184</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa"><code>23b6828</code></a>
Update changelog for v4.38.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b"><code>e0b52db</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4210">#4210</a>
from github/henrymercer/pin-python-for-older-clis-in-ci</li>
<li><a
href="https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc"><code>6b99698</code></a>
Pin Python 3.13.15 for older CLI versions in multi-language check</li>
<li><a
href="https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8"><code>63d3d63</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4203">#4203</a>
from github/update-bundle/codeql-bundle-v2.27.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe"><code>7377a10</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524"><code>c1a30cd</code></a>
Update default bundle to codeql-bundle-v2.27.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974"><code>d208ec7</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4200">#4200</a>
from github/mbg/esm/migrate-pr-checks</li>
<li><a
href="https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845"><code>a71b0c6</code></a>
Replace <code>__dirname</code> in <code>sync.ts</code></li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.38.3</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/24c54180a607b1449ed407dd24f251e4e9147c8d"><code>24c5418</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4214">#4214</a>
from github/update-v4.38.3-e0b52dbdc</li>
<li><a
href="https://github.com/github/codeql-action/commit/69e87c56c1db5253592f61da177da1d20d033bd8"><code>69e87c5</code></a>
Add changelog note for <a
href="https://redirect.github.com/github/codeql-action/issues/4184">#4184</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/23b682830be5e93afb6466bfc0197142d70268aa"><code>23b6828</code></a>
Update changelog for v4.38.3</li>
<li><a
href="https://github.com/github/codeql-action/commit/e0b52dbdc5c3376dd8cb78e956fd23fa07ca2c5b"><code>e0b52db</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4210">#4210</a>
from github/henrymercer/pin-python-for-older-clis-in-ci</li>
<li><a
href="https://github.com/github/codeql-action/commit/6b99698c8cda6115e2bc7c52226b508dc558d7dc"><code>6b99698</code></a>
Pin Python 3.13.15 for older CLI versions in multi-language check</li>
<li><a
href="https://github.com/github/codeql-action/commit/63d3d632fc7cbd91c8089c7fea5322f1bc73d7d8"><code>63d3d63</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4203">#4203</a>
from github/update-bundle/codeql-bundle-v2.27.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/7377a10091aa5d781c1d36dc3834817d8ad0acfe"><code>7377a10</code></a>
Add changelog note</li>
<li><a
href="https://github.com/github/codeql-action/commit/c1a30cda114f23a88a09ab61f4ec08c312d2c524"><code>c1a30cd</code></a>
Update default bundle to codeql-bundle-v2.27.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/d208ec71e39ae46397cbf6569bef8439b9aab974"><code>d208ec7</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4200">#4200</a>
from github/mbg/esm/migrate-pr-checks</li>
<li><a
href="https://github.com/github/codeql-action/commit/a71b0c6684dea6ca627a472a11bf5b80bd47c845"><code>a71b0c6</code></a>
Replace <code>__dirname</code> in <code>sync.ts</code></li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2...24c54180a607b1449ed407dd24f251e4e9147c8d">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-20 01:24:54 -04:00
dependabot[bot] 4af4940687 build(deps-dev): bump the npm-deps group across 1 directory with 8 updates (#1471) 
Bumps the npm-deps group with 8 updates in the /src/frontend directory:

| Package | From | To |
| --- | --- | --- |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `26.6.3` | `26.6.5` |
|
[@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react)
| `6.1.1` | `6.1.2` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) |
`6.38.0` | `6.41.0` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) |
`0.71.0` | `0.72.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.86.0` | `1.87.0` |
| [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) |
`7.0.2003` | `7.0.2004` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) |
`8.3.1` | `8.3.4` |
|
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)
| `5.0.2` | `5.0.4` |


Updates `@types/node` from 26.6.3 to 26.6.5
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `@vitejs/plugin-react` from 6.1.1 to 6.1.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/releases">@​vitejs/plugin-react's
releases</a>.</em></p>
<blockquote>
<h2>plugin-react@6.1.2</h2>
<h3>Fix HMR for compound components (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1484">#1484</a>)</h3>
<p>Adding or removing a component from a compound component was not
handled, creating stale updates. Doing this now triggers hmr invalidate
on the file and propagates the invalidation to importers.</p>
<h3>Fix <code>compiler.logDiagnostics</code> option not working (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1483">#1483</a>)</h3>
<p>With <code>oxc-transform-react</code> &gt;= 0.148, the
<code>logDiagnostics</code> was not working. This version fixes it and
requires <code>oxc-transform-react</code> &gt;= 0.152 as a peer
dependency if you are using the <code>compiler</code> option.
<code>compiler.logDiagnostics</code> option is now deprecated and should
be swapped for the builtin <code>compiler.reportDiagnostics</code>.</p>
<h3>Disable refresh for non-jsx with compiler enabled (fix <a
href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1478">#1478</a>)
(<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1485">#1485</a>)</h3>
<p>When the compiler was enabled, TS files could trigger fast refresh
which would cause runtime errors. The logic now follows what the builtin
oxc plugin in Vite does.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md">@​vitejs/plugin-react's
changelog</a>.</em></p>
<blockquote>
<h2>6.1.2 (2026-10-05)</h2>
<h3>Fix HMR for compound components (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1484">#1484</a>)</h3>
<p>Adding or removing a component from a compound component was not
handled, creating stale updates. Doing this now triggers hmr invalidate
on the file and propagates the invalidation to importers.</p>
<h3>Fix <code>compiler.logDiagnostics</code> option not working (<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1483">#1483</a>)</h3>
<p>With <code>oxc-transform-react</code> &gt;= 0.148, the
<code>logDiagnostics</code> was not working. This version fixes it and
requires <code>oxc-transform-react</code> &gt;= 0.152 as a peer
dependency if you are using the <code>compiler</code> option.
<code>compiler.logDiagnostics</code> option is now deprecated and should
be swapped for the builtin <code>compiler.reportDiagnostics</code>.</p>
<h3>Disable refresh for non-jsx with compiler enabled (fix <a
href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1478">#1478</a>)
(<a
href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1485">#1485</a>)</h3>
<p>When the compiler was enabled, TS files could trigger fast refresh
which would cause runtime errors. The logic now follows what the builtin
oxc plugin in Vite does.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/ac47648e17674299accb51816e9e33b8a7b07b05"><code>ac47648</code></a>
release: plugin-react@6.1.2 (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1491">#1491</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/98277e7d49fea7fa707170d2892738c8bfb5f1c0"><code>98277e7</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1486">#1486</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/12eddea34ae9de92b3dc8d8b8a76fa1260b781bf"><code>12eddea</code></a>
fix(hmr): better handle compound components (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1484">#1484</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/3cfb1d1114df64cf9aeee4aae0ac951d0c2f3abf"><code>3cfb1d1</code></a>
fix(plugin-react): fix <code>compiler.logDiagnostics</code> (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1483">#1483</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/6de9915e1b4c1b8a7b390eb1364ab6cd83d64e62"><code>6de9915</code></a>
fix(plugin-react): disable refresh for non-jsx with compiler enabled (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1485">#1485</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/ee97d2f3bd25cda8f06c27366722f01aaac0201f"><code>ee97d2f</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1445">#1445</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/b0a014da31be23c7806ffb0b997ec53b52ab68f2"><code>b0a014d</code></a>
chore: use Babel 8 for babel compiler playgrounds (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1460">#1460</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/61b650fe93c3fe30d79aa8615199cdcb0a2594f4"><code>61b650f</code></a>
fix(deps): update react-related dependencies (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1452">#1452</a>)</li>
<li><a
href="https://github.com/vitejs/vite-plugin-react/commit/736efe2f004002abee693a44b405e70699432ecd"><code>736efe2</code></a>
chore(deps): update tsdown to v0.23 (<a
href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1451">#1451</a>)</li>
<li>See full diff in <a
href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.2/packages/plugin-react">compare
view</a></li>
</ul>
</details>
<br />

Updates `knip` from 6.38.0 to 6.41.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webpro-nl/knip/releases">knip's
releases</a>.</em></p>
<blockquote>
<h2>Release 6.41.0</h2>
<ul>
<li>Add Flue plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2124">#2124</a>)
(c52737d45ff008d6d96d4c2d4182048a2aa64602) - thanks <a
href="https://github.com/LuisFigueroaG"><code>@​LuisFigueroaG</code></a>!</li>
<li>Match all React Native config file extensions (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2125">#2125</a>)
(898fdffb37ae0bdb3d2653038eb10c2e01edf983) - thanks <a
href="https://github.com/LuisFigueroaG"><code>@​LuisFigueroaG</code></a>!</li>
<li>Consolidate fixture guidance and extend plugin guidelines
(37a4ca04645f71f599e9b530676543f9893bd641)</li>
<li>Add AI contribution policy
(b15f0fbb090ea0427240880da2bec602c11cea50)</li>
<li>Use files from tsconfig references with --use-tsconfig-files (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2126">#2126</a>)
(9618185eafb0c5cb365035f89e9d66718642338a) - thanks <a
href="https://github.com/kaanisthatyou"><code>@​kaanisthatyou</code></a>!</li>
<li>Compile gitignore walk patterns once (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2127">#2127</a>)
(09c80299779fa5abe133ee8f82051c25870007b8)</li>
<li>Drop readdir order dependent case from gitignore walk test
(ab3da8ff95a05a0fbfba6873b64559017d038aa7)</li>
<li>fix: recognize binaries from absent optional dependencies (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2120">#2120</a>)
(d908556eaa98bf9637a2744d2de089bab31b8dbc) - thanks <a
href="https://github.com/DreamLongYT"><code>@​DreamLongYT</code></a>!</li>
<li>Apply a directory's .gitignore before walking its subdirectories
(9560c07862d4c72dc956371b9a77e049d83ed4a9)</li>
<li>Apply nested .gitignore files to workspace globs
(23d35421dd67c405254f2f8bcbc09b18d224e338)</li>
<li>Update gitignore matcher and walk notes
(499f85f4544457dc7c51c4a7612fea69773ef3dd)</li>
<li>Keep the cwd out of glob patterns and matchers (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2107">#2107</a>)
(1e82fb807c88cc46951f2028214569f9a2eb0061) - thanks <a
href="https://github.com/kaanisthatyou"><code>@​kaanisthatyou</code></a>!</li>
<li>Support function configs in Rsbuild plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2122">#2122</a>)
(38071db87e9023e5dd61173ce32f9020a1a5d7ff) - thanks <a
href="https://github.com/bytedoe"><code>@​bytedoe</code></a>!</li>
<li>Separate Expo Router plugin; remove expo-router entry points from
Expo plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2128">#2128</a>)
(ad541764ca7d3c062236661677d1d66d5275122f) - thanks <a
href="https://github.com/jjjjonathan"><code>@​jjjjonathan</code></a>!</li>
<li>Link Expo config discovery source and fold expo6 fixture into
expo-router (2ddeca50956790b10580e835df50bc980cce961d)</li>
<li>Update dependencies (c9f79148f7165314a7b3c801eff926d1d0d6b060)</li>
<li>Migrate shell script parsing to unbash v5
(4942cca05303410120a007a5bb23b0c2da725da1)</li>
<li>Handle updated Formatly result types
(ca9e8315e003dae69646f7500fa98ab9ed403b92)</li>
<li>Preserve TypeScript 5.0 compatibility in shell AST filters
(957ac7bbd654f6d3d0c4dc4eab2f4aa133ff0b4b)</li>
<li>Point timerify crashes to the Node.js version that fixes them
(0c235de096fd3361eb918d1290241fa32a62f089)</li>
<li>Copy importer identifier sets into the reverse index
(2860d678a87dddb5ad56299119fb6e108ceffa12)</li>
<li>Clear the resolver cache at the start of a run
(10b5bb82ecd03c88b68ace58a7aea23d188cc5f1)</li>
</ul>
<h2>Release 6.40.0</h2>
<ul>
<li>Resolve local and scope-only extends in commitlint plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2079">#2079</a>)
(e667552d4e7122094565d3ad9ae407acfc0ac684) - thanks <a
href="https://github.com/giaBaoJS"><code>@​giaBaoJS</code></a>!</li>
<li>Clarify worktree guides and plugin review preparation
(dd02baf020d23af1d47c44c1a726a61014b270bd)</li>
<li>Document stale cache results and workarounds (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2078">#2078</a>)
(3573749a5d5bbee6305f207cc7d1b72c200c8c9b)</li>
<li>Exclude test files from package entries in production mode (resolve
<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2082">#2082</a>)
(b86f45f9d38d4b83baad98e43983e08910e00c78) - thanks <a
href="https://github.com/jonathanong"><code>@​jonathanong</code></a>!</li>
<li>Resolve Serverless file variables in plugins and functions (resolve
<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2074">#2074</a>)
(99cac789694ea8d76cd38184d2d7c95f34315224) - thanks <a
href="https://github.com/SwastikTripathi"><code>@​SwastikTripathi</code></a>!</li>
<li>Preserve locally referenced namespace members (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2070">#2070</a>)
(f0f36df766cd74ad7ae03fbf8940bdeb792439be) - thanks <a
href="https://github.com/MFA-G"><code>@​MFA-G</code></a>!</li>
<li>fix: add the commitlint-plugin prefix to Commitlint plugin names (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2096">#2096</a>)
(3decd35ff0a4220c7cd2c9142dc69c89794b3927) - thanks <a
href="https://github.com/devYRPauli"><code>@​devYRPauli</code></a>!</li>
<li>fix: match .mjs config files in the simple-git-hooks plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2097">#2097</a>)
(79a87d92396c2444ae4ef3c780c0d2e18cd73e4c) - thanks <a
href="https://github.com/devYRPauli"><code>@​devYRPauli</code></a>!</li>
<li>fix: match capacitor.config.js in the Capacitor plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2098">#2098</a>)
(4a5ec96d818117a7f2eafa027e3b707bc97573a8) - thanks <a
href="https://github.com/devYRPauli"><code>@​devYRPauli</code></a>!</li>
<li>fix(typescript): ArrayExpression (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2099">#2099</a>)
(<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2100">#2100</a>)
(87fea9f201c2fd864eafa31bdad68910a8a177ba) - thanks <a
href="https://github.com/DreamLongYT"><code>@​DreamLongYT</code></a>!</li>
<li>Preserve development entry pattern groups
(7c229f4e1918075d801ed3b046fa022b1d3bcc41)</li>
<li>Resolve null package exports to the files they hide (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2084">#2084</a>,
close <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2085">#2085</a>)
(5bd46260feb60b957c2631bc72375ef192e441e0)</li>
<li>Pin InvokeAI ecosystem test
(4e0a3432eb35e3f628f6d3b7fcd14b942de343d0)</li>
<li>fix(utils): add jsx extension to source mapping (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2087">#2087</a>)
(eaa353b5fc30c2f12cdf2c29e6dd68e0d0950062) - thanks <a
href="https://github.com/DreamLongYT"><code>@​DreamLongYT</code></a>!</li>
<li>fix(serverless-framework): handle explicit extensions in handler
paths (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2091">#2091</a>)
(e9393965be7563640921e3f20c946fcb9132e1cb) - thanks <a
href="https://github.com/DreamLongYT"><code>@​DreamLongYT</code></a>!</li>
<li>Annotate published manifest return type
(d95a8310a0d0dca8f23d8dd3f83e7b0a1909d038)</li>
<li>Add Jasmine plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2105">#2105</a>)
(9ed14911d5c5752aef36878ab3d515c35d1ac6bc) - thanks <a
href="https://github.com/SulimanAbdulrazzaq"><code>@​SulimanAbdulrazzaq</code></a>!</li>
<li>fix: resolve workspace exports with fallback arrays (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2088">#2088</a>)
(49c2aaeaba4544f25cc02c19d5da5152a8ef68c3) - thanks <a
href="https://github.com/DreamLongYT"><code>@​DreamLongYT</code></a>!</li>
<li>fix(postcss): ignore disabled plugins in object configs (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2092">#2092</a>)
(b84fdf8a8ee676ee45f4313009ebfe969d034a88) - thanks <a
href="https://github.com/DreamLongYT"><code>@​DreamLongYT</code></a>!</li>
<li>Resolve webServer commands in Playwright plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2110">#2110</a>)
(1af96bce36b0d0d07791de100c7f2ea5672a478c) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>Cache config file inputs per plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2109">#2109</a>)
(01cb43267ca5dc03a2cbcba0a19fd891d4ed1f37) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>fix: include custom compiler extensions in source path mapping (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2090">#2090</a>)
(dc3a47e2d810808314454b8f5c23070f136d15d3) - thanks <a
href="https://github.com/DreamLongYT"><code>@​DreamLongYT</code></a>!</li>
<li>Don't let a self-closing <!-- raw HTML omitted --> swallow the next
<!-- raw HTML omitted --> (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2113">#2113</a>)
(989fdadde0a068d1d1c52e26a8327b99c5de0668) - thanks <a
href="https://github.com/maniflopi"><code>@​maniflopi</code></a>!</li>
<li>fix(oxlint): resolve lint from loaded Vite config (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2108">#2108</a>)
(6d44e532ed6320cdf4f4c3253b26e155c4d26ba7) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>fix: resolve Jest module names without the jest-* prefix (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2095">#2095</a>)
(a5f4cfbff7f263a0ea8d5461a3f9216cbef38602) - thanks <a
href="https://github.com/devYRPauli"><code>@​devYRPauli</code></a>!</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/webpro-nl/knip/commit/13d7f21e8ec5b30d8fe6d8377c9012b9db96f871"><code>13d7f21</code></a>
Release knip@6.41.0</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/10b5bb82ecd03c88b68ace58a7aea23d188cc5f1"><code>10b5bb8</code></a>
Clear the resolver cache at the start of a run</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/2860d678a87dddb5ad56299119fb6e108ceffa12"><code>2860d67</code></a>
Copy importer identifier sets into the reverse index</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/0c235de096fd3361eb918d1290241fa32a62f089"><code>0c235de</code></a>
Point timerify crashes to the Node.js version that fixes them</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/957ac7bbd654f6d3d0c4dc4eab2f4aa133ff0b4b"><code>957ac7b</code></a>
Preserve TypeScript 5.0 compatibility in shell AST filters</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/ca9e8315e003dae69646f7500fa98ab9ed403b92"><code>ca9e831</code></a>
Handle updated Formatly result types</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/4942cca05303410120a007a5bb23b0c2da725da1"><code>4942cca</code></a>
Migrate shell script parsing to unbash v5</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/c9f79148f7165314a7b3c801eff926d1d0d6b060"><code>c9f7914</code></a>
Update dependencies</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/2ddeca50956790b10580e835df50bc980cce961d"><code>2ddeca5</code></a>
Link Expo config discovery source and fold expo6 fixture into
expo-router</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/ad541764ca7d3c062236661677d1d66d5275122f"><code>ad54176</code></a>
Separate Expo Router plugin; remove expo-router entry points from Expo
plugin...</li>
<li>Additional commits viewable in <a
href="https://github.com/webpro-nl/knip/commits/knip@6.41.0/packages/knip">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxfmt` from 0.71.0 to 0.72.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxfmt's
releases</a>.</em></p>
<blockquote>
<h2>oxfmt v0.72.0</h2>
<h3>💥 BREAKING CHANGES</h3>
<ul>
<li>e2c68b1 oxfmt: [<strong>BREAKING</strong>] Format
<code>parser:markdown</code> files by
<code>oxc_formatter_markdown</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27256">#27256</a>)
(leaysgur)</li>
</ul>
<h3>🚀 Features</h3>
<ul>
<li>b538e3c formatter_css: Parse embedded CSS as a block's contents (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27284">#27284</a>)
(leaysgur)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>71e400b formatter_markdown: Fixed remaining issues found by fuzz (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27334">#27334</a>)
(leaysgur)</li>
<li>7d0e54d formatter_markdown: Preserve line breaks around
Chinese/Japanese characters in all <code>proseWrap</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27331">#27331</a>)
(leaysgur)</li>
<li>e9ae2d8 formatter_css: Fix layouts found in mdn-content repo
(css-in-md) (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27326">#27326</a>)
(leaysgur)</li>
<li>df85b4c oxfmt: Keep blank lines after a line break in Prettier Doc
to IR (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27325">#27325</a>)
(leaysgur)</li>
<li>7f65b75 formatter: Format assignment target property as
assignment-like (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27289">#27289</a>)
(leaysgur)</li>
<li>6c08f2a formatter_css: Apply the <code>url()</code> import exception
to a lone comma group (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27288">#27288</a>)
(leaysgur)</li>
<li>1967302 formatter_css: Hug a spaced <code>ident (</code> only at the
at-rule prelude head (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27283">#27283</a>)
(leaysgur)</li>
<li>2445064 formatter_markdown: Keep a preserved line break before a
delimiter row that opens no table (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27278">#27278</a>)
(leaysgur)</li>
<li>dd72fbf formatter_markdown: Keep container columns as spaces under
<code>useTabs</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27277">#27277</a>)
(leaysgur)</li>
<li>1686018 oxfmt: Make one state <code>conditionalGroup</code> fit up
to first <code>hardline</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27275">#27275</a>)
(leaysgur)</li>
<li>fd4ddce formatter_json: Flatten block comment only array|object (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27274">#27274</a>)
(leaysgur)</li>
<li>267557c formatter,oxfmt: Embed only original JSDoc plugin supported
languages (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27241">#27241</a>)
(leaysgur)</li>
<li>2606c60 oxfmt: Do not re-include a file below an excluded directory
with a negated pattern (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27237">#27237</a>)
(Nicolas Le Cam)</li>
<li>c2de02b formatter: Decide embedded template layout from AST, not
source shape (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27218">#27218</a>)
(leaysgur)</li>
<li>c9e1224 formatter: Handle <code>quoteProps: consistent</code> for
patterns and computed keys (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27216">#27216</a>)
(leaysgur)</li>
<li>36e14df formatter: Keep comments between callee and its opener on
the callee side (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27172">#27172</a>)
(leaysgur)</li>
<li>6da7657 oxfmt: Render diagnostics with source in Stdin mode (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27130">#27130</a>)
(leaysgur)</li>
<li>e9b2ec5 oxfmt/lsp: Reload <code>.prettierignore</code> on watched
file change (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27129">#27129</a>)
(leaysgur)</li>
<li>30eb463 oxfmt: Check global ignores before resolving nested config
in Stdin mode (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27128">#27128</a>)
(leaysgur)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>72f42a3 formatter_markdown: Pre-allocate the IR buffer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27333">#27333</a>)
(leaysgur)</li>
<li>cea47e3 formatter_core: Avoid exponential <code>will_break</code>
check on nested interned (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27211">#27211</a>)
(leaysgur)</li>
<li>0aba566 oxfmt: Do not resolve root js config from nested context (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27147">#27147</a>)
(leaysgur)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>51506c6 formatter_css: Record divergences found in mdn-content
(css-in-md) (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27327">#27327</a>)
(leaysgur)</li>
<li>656b81c formatter_markdown: Record unclosed fences closing at a
directive's closer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27279">#27279</a>)
(leaysgur)</li>
<li>66545bf formatter_markdown: Record setext heading wrap divergence
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27221">#27221</a>)
(leaysgur)</li>
<li>af4b269 oxfmt: Document why <code>format()</code> API does not take
cwd (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27131">#27131</a>)
(leaysgur)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/2bd08ebe8f36fcf1954a675ffdeb4c6d0129f609"><code>2bd08eb</code></a>
release(apps): oxlint v1.87.0 &amp;&amp; oxfmt v0.72.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27341">#27341</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.72.0/npm/oxfmt">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.86.0 to 1.87.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.87.0</h2>
<h3>🚀 Features</h3>
<ul>
<li>42dcfd2 linter/react/no-unescaped-entities: Implement suggestion (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27292">#27292</a>)
(Mikhail Baev)</li>
<li>cd4510d linter/unicorn/no-useless-switch-case: Implement suggestion
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27245">#27245</a>)
(Mikhail Baev)</li>
<li>1a7c902 linter/react/jsx-no-target-blank: Implement suggestion (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27181">#27181</a>)
(Mikhail Baev)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>176b4b9 linter/jsx-a11y/label-has-associated-control: Validate label
attribute values (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27302">#27302</a>)
(sama Pyb)</li>
<li>7d381c3 linter/jsx-a11y/mouse-events-have-key-events: Handle nullish
event handlers (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27306">#27306</a>)
(sama Pyb)</li>
<li>4e09837 linter/jsx-a11y/lang: Validate lang expression strings (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27304">#27304</a>)
(sama Pyb)</li>
<li>7d28a66 linter/unicorn/numeric-separators-style: Report misgrouped
BigInt literals (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27207">#27207</a>)
(breken)</li>
<li>e928322 linter/unicorn/no-zero-fractions: Parenthesize separator and
large integers in fixer (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27206">#27206</a>)
(breken)</li>
<li>3d61a59 parser: Validate TypeScript type member separators (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27222">#27222</a>)
(camc314)</li>
<li>f08236b linter/eslint/prefer-exponentiation-operator: Preserve
autofix precedence (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27150">#27150</a>)
(camc314)</li>
<li>7d60ae3 linter/valid-title: Continue checks after allowed words (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27146">#27146</a>)
(Cameron)</li>
<li>ad5dd5d linter/eslint/no-unused-vars: Respect disabled argument
checks for used ignore patterns (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26925">#26925</a>)
(camc314)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<p>All notable changes to this package will be documented in this
file.</p>
<p>The format is based on <a
href="https://keepachangelog.com/en/1.0.0">Keep a Changelog</a>.</p>
<h2>[1.88.0] - 2026-10-13</h2>
<h3>🚀 Features</h3>
<ul>
<li>3c361a7 linter/unicorn/prefer-query-selector: Add
<code>allowWithVariables</code> option (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27346">#27346</a>)
(Mikhail Baev)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/2bd08ebe8f36fcf1954a675ffdeb4c6d0129f609"><code>2bd08eb</code></a>
release(apps): oxlint v1.87.0 &amp;&amp; oxfmt v0.72.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27341">#27341</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.87.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-tsgolint` from 7.0.2003 to 7.0.2004
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/tsgolint/releases">oxlint-tsgolint's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.2004</h2>
<h2>What's Changed</h2>
<ul>
<li>chore(deps): update taiki-e/install-action action to v2.87.20 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1246">oxc-project/tsgolint#1246</a></li>
<li>chore(deps): update dependency dprint-json to v0.25.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1247">oxc-project/tsgolint#1247</a></li>
<li>fix(no-unsafe-return): preserve deferred indexed return type by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1248">oxc-project/tsgolint#1248</a></li>
<li>chore(deps): update crate-ci/typos action to v1.50.3 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1250">oxc-project/tsgolint#1250</a></li>
<li>fix(no-misused-promises): don't report comma expressions as
conditionals by <a
href="https://github.com/geniusmonir"><code>@​geniusmonir</code></a> in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1254">oxc-project/tsgolint#1254</a></li>
<li>chore(deps): update gomod by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1257">oxc-project/tsgolint#1257</a></li>
<li>chore(deps): update dprint plugins by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1256">oxc-project/tsgolint#1256</a></li>
<li>chore(deps): update taiki-e/install-action action to v2.87.22 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1258">oxc-project/tsgolint#1258</a></li>
<li>chore(deps): update npm packages by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1259">oxc-project/tsgolint#1259</a></li>
<li>fix(no-floating-promises): respect safe-call declaration sources by
<a href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1261">oxc-project/tsgolint#1261</a></li>
<li>fix(no-unsafe-return): avoid panic on JSDoc callbacks without
returns by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1264">oxc-project/tsgolint#1264</a></li>
<li>fix(no-deprecated): include reasons for variable declarations by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1266">oxc-project/tsgolint#1266</a></li>
<li>fix(no-unnecessary-type-parameters): parenthesize constraint in
optional tuple elements by <a
href="https://github.com/baevm"><code>@​baevm</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1267">oxc-project/tsgolint#1267</a></li>
<li>chore(deps): update crate-ci/typos action to v1.51.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1268">oxc-project/tsgolint#1268</a></li>
<li>chore(deps): update crate-ci/typos action to v1.51.1 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1269">oxc-project/tsgolint#1269</a></li>
<li>fix: restore line disable comments for type-aware diagnostics by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1271">oxc-project/tsgolint#1271</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/geniusmonir"><code>@​geniusmonir</code></a>
made their first contribution in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1254">oxc-project/tsgolint#1254</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/oxc-project/tsgolint/compare/v7.0.2003...v7.0.2004">https://github.com/oxc-project/tsgolint/compare/v7.0.2003...v7.0.2004</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/a61289117febcb1a60cf3bc75ef2b6bbccc4b665"><code>a612891</code></a>
fix: restore line disable comments for type-aware diagnostics (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1271">#1271</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/fc7068f798b045829f25650ec669ee28896bba0b"><code>fc7068f</code></a>
chore(deps): update crate-ci/typos action to v1.51.1 (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1269">#1269</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/8d4c05c9245c1f67a7419b596001dd5ac55d585e"><code>8d4c05c</code></a>
chore(deps): update crate-ci/typos action to v1.51.0 (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1268">#1268</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/6d20f350733b76ce3cf4a6c52ece675412fefca5"><code>6d20f35</code></a>
fix(no-unnecessary-type-parameters): parenthesize constraint in optional
tupl...</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/322b3856ef035c220c39ef1b37cf70413f80566d"><code>322b385</code></a>
fix(no-deprecated): include reasons for variable declarations (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1266">#1266</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/db76296ac176722cd2bd3431fafd07c48815f310"><code>db76296</code></a>
fix(no-unsafe-return): avoid panic on JSDoc callbacks without returns
(<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1264">#1264</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/24b18b48c47b7ae0d84e21a0e974575026e27908"><code>24b18b4</code></a>
fix(no-floating-promises): respect safe-call declaration sources (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1261">#1261</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/c8f5cbc884b706c42efb8b451fe31d2f1079df10"><code>c8f5cbc</code></a>
chore(deps): update npm packages (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1259">#1259</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/93fe3a5123616ced5fe0015d080c88ad34843bc7"><code>93fe3a5</code></a>
chore(deps): update taiki-e/install-action action to v2.87.22 (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1258">#1258</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/dd0a3068c463b875d5f0649a40bfcb2991b13e0b"><code>dd0a306</code></a>
chore(deps): update dprint plugins (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1256">#1256</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/oxc-project/tsgolint/compare/v7.0.2003...v7.0.2004">compare
view</a></li>
</ul>
</details>
<br />

Updates `vite` from 8.3.1 to 8.3.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.3.4</h2>
<h3>Features</h3>
<ul>
<li><strong>bundled-dev:</strong> support
<code>import.meta.hot.acceptExports</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23463">#23463</a>)
(<a
href="https://github.com/vitejs/vite/commit/bc0f21c56a2e003a4d2dd23ccb9da3ec8c706c4e">bc0f21c</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>avoid mutating hmr defaults (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23575">#23575</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23576">#23576</a>)
(<a
href="https://github.com/vitejs/vite/commit/574d5e351905fe99891364d03c2440531378f7fd">574d5e3</a>)</li>
<li><strong>build:</strong> correct preloads when chunkImportMap is
enabled with non-root base (<a
href="https://redirect.github.com/vitejs/vite/issues/23698">#23698</a>)
(<a
href="https://github.com/vitejs/vite/commit/2a8c0f05c76e35c43ab3560984a5103c8db8dbcd">2a8c0f0</a>)</li>
<li><strong>build:</strong> wait for in-flight stylesheets in preload
helper (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23652">#23652</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23662">#23662</a>)
(<a
href="https://github.com/vitejs/vite/commit/036b74599b2fe1d8c61475371b856ceb88d26963">036b745</a>)</li>
<li><strong>bundled-dev:</strong> serve <code>/@vite/client</code> and
stub <code>@vite/env</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23664">#23664</a>)
(<a
href="https://github.com/vitejs/vite/commit/5afc5a8876624888fc1e8f43fed1c85c4b0e830b">5afc5a8</a>)</li>
<li><strong>client:</strong> skip rewriting unchanged adopted styles (<a
href="https://redirect.github.com/vitejs/vite/issues/23697">#23697</a>)
(<a
href="https://github.com/vitejs/vite/commit/fa7146938b0ca703653c90c20907191a01c032ba">fa71469</a>)</li>
<li><strong>css:</strong> resolve imported preprocessors from their file
path with lightningcss (<a
href="https://redirect.github.com/vitejs/vite/issues/23688">#23688</a>)
(<a
href="https://github.com/vitejs/vite/commit/cf52011c46409a4a45f3d74bba631b8f005c4bc9">cf52011</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23648">#23648</a>)
(<a
href="https://github.com/vitejs/vite/commit/8a4c19cfc035f2dd203f2fa6d00ab9256a5e77c9">8a4c19c</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23649">#23649</a>)
(<a
href="https://github.com/vitejs/vite/commit/794516d50cff80e405bc9b3e5faac1c82987566c">794516d</a>)</li>
<li><strong>dev:</strong> a restart requested during a restart used to
be dropped (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23392">#23392</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23484">#23484</a>)
(<a
href="https://github.com/vitejs/vite/commit/70d56ea1848909edab416934f3f68ce14343eb73">70d56ea</a>)</li>
<li>don't treat modules ending with js-like query as js (<a
href="https://redirect.github.com/vitejs/vite/issues/23687">#23687</a>)
(<a
href="https://github.com/vitejs/vite/commit/fcb6f1252a95857823d935f98554b938888d41a0">fcb6f12</a>)</li>
<li><strong>html:</strong> avoid adding filesystem root to watcher (<a
href="https://redirect.github.com/vitejs/vite/issues/23689">#23689</a>)
(<a
href="https://github.com/vitejs/vite/commit/3a7f2aea757d59bae66ad6edf6b321d26a7e6778">3a7f2ae</a>)</li>
<li><strong>html:</strong> skip caching CSS of chunks in a cycle (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23628">#23628</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23636">#23636</a>)
(<a
href="https://github.com/vitejs/vite/commit/15d82f7dc679ab9c18d5ce2c3711157c2365ddd1">15d82f7</a>)</li>
<li><strong>optimizer:</strong> scan deep imports with custom extensions
(<a
href="https://redirect.github.com/vitejs/vite/issues/23678">#23678</a>)
(<a
href="https://github.com/vitejs/vite/commit/8579189bae8626b6ddab55a09325e209d62e027e">8579189</a>)</li>
<li>remove input option unescaping for now (<a
href="https://redirect.github.com/vitejs/vite/issues/23694">#23694</a>)
(<a
href="https://github.com/vitejs/vite/commit/facc2fb1fffce03d9e2dd7011d0bd0eeddc7d0f6">facc2fb</a>)</li>
<li><strong>server:</strong> match static aliases on path boundaries (<a
href="https://redirect.github.com/vitejs/vite/issues/23643">#23643</a>)
(<a
href="https://github.com/vitejs/vite/commit/b28db28e9e62d9866a9a0f1b22e74589cc180577">b28db28</a>)</li>
<li><strong>watcher:</strong> normalize file before root check in
<code>ensureWatchedFile</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23673">#23673</a>)
(<a
href="https://github.com/vitejs/vite/commit/12bb28c22379c8d2fe90088fa0eefbfa2ab3fb80">12bb28c</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li><strong>module-runner:</strong> skip cloning call sites that have no
source map (<a
href="https://redirect.github.com/vitejs/vite/issues/23646">#23646</a>)
(<a
href="https://github.com/vitejs/vite/commit/3d674869a50a0bca84a8cc8dc55bd35d57100e37">3d67486</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>bundled-dev:</strong> import CSS HMR helpers from
<code>/@vite/client</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23674">#23674</a>)
(<a
href="https://github.com/vitejs/vite/commit/182f5b2a65391da5bee05f9c3df1aeb3794e98d9">182f5b2</a>)</li>
</ul>
<h2>v8.3.3</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update launch-editor to v2.14.2 (<a
href="https://redirect.github.com/vitejs/vite/issues/23654">#23654</a>)
(<a
href="https://github.com/vitejs/vite/commit/22fd1d5238cce2ee9db0eb4122f9e8feb6b06097">22fd1d5</a>)</li>
<li><strong>html:</strong> filename passed to transformIndexHtml should
not include queries (<a
href="https://redirect.github.com/vitejs/vite/issues/23653">#23653</a>)
(<a
href="https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17">7dafd8e</a>)</li>
<li><strong>server:</strong> check <code>fs.serve</code> for
<code>?vite-wasm-instance</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23655">#23655</a>)
(<a
href="https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73">ba8b7ab</a>)</li>
<li><strong>server:</strong> store ids to <code>safeModulePaths</code>
rather than URLs (<a
href="https://redirect.github.com/vitejs/vite/issues/23656">#23656</a>)
(<a
href="https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905">c3e06f9</a>)</li>
</ul>
<h2>v8.3.2</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>build:</strong> preload CSS correctly when
<code>renderBuiltUrl</code> returns URLs with queries (<a
href="https://redirect.github.com/vitejs/vite/issues/23611">#23611</a>)
(<a
href="https://github.com/vitejs/vite/commit/64e0a215c24f0522b27b91f93cfd93e317b94481">64e0a21</a>)</li>
<li><strong>bundled-dev:</strong> serve lazy chunk sourcemaps (<a
href="https://redirect.github.com/vitejs/vite/issues/23026">#23026</a>)
(<a
href="https://github.com/vitejs/vite/commit/eb7aa9a8816a1e926d5d9b4cbe7e796b61314ce2">eb7aa9a</a>)</li>
<li><strong>bundled-dev:</strong> serve the rolldown runtime from the
installed rolldown (<a
href="https://redirect.github.com/vitejs/vite/issues/23568">#23568</a>)
(<a
href="https://github.com/vitejs/vite/commit/bc598a6a8a6b7d6e157e9f19c16911cff8d2360c">bc598a6</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23601">#23601</a>)
(<a
href="https://github.com/vitejs/vite/commit/9944fa6033873f13ae88f59e023ab642c50fee2b">9944fa6</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23602">#23602</a>)
(<a
href="https://github.com/vitejs/vite/commit/88c17415af221b3a13e778f4f2c0e907c8287baf">88c1741</a>)</li>
<li><strong>html:</strong> resolve percent-encoded srcset urls (<a
href="https://redirect.github.com/vitejs/vite/issues/23609">#23609</a>)
(<a
href="https://github.com/vitejs/vite/commit/53f1ce7bfe38426861f6da572ef0e3359f6a80cd">53f1ce7</a>)</li>
<li>limit size of object and array printing via
<code>forwardConsole</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23565">#23565</a>)
(<a
href="https://github.com/vitejs/vite/commit/e64a5877dd3e552843a545749ccc257568917d28">e64a587</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.3.3...v8.3.4">8.3.4</a>
(2026-10-08)<!-- raw HTML omitted --></h2>
<h3>Features</h3>
<ul>
<li><strong>bundled-dev:</strong> support
<code>import.meta.hot.acceptExports</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23463">#23463</a>)
(<a
href="https://github.com/vitejs/vite/commit/bc0f21c56a2e003a4d2dd23ccb9da3ec8c706c4e">bc0f21c</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>avoid mutating hmr defaults (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23575">#23575</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23576">#23576</a>)
(<a
href="https://github.com/vitejs/vite/commit/574d5e351905fe99891364d03c2440531378f7fd">574d5e3</a>)</li>
<li><strong>build:</strong> correct preloads when chunkImportMap is
enabled with non-root base (<a
href="https://redirect.github.com/vitejs/vite/issues/23698">#23698</a>)
(<a
href="https://github.com/vitejs/vite/commit/2a8c0f05c76e35c43ab3560984a5103c8db8dbcd">2a8c0f0</a>)</li>
<li><strong>build:</strong> wait for in-flight stylesheets in preload
helper (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23652">#23652</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23662">#23662</a>)
(<a
href="https://github.com/vitejs/vite/commit/036b74599b2fe1d8c61475371b856ceb88d26963">036b745</a>)</li>
<li><strong>bundled-dev:</strong> serve <code>/@vite/client</code> and
stub <code>@vite/env</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23664">#23664</a>)
(<a
href="https://github.com/vitejs/vite/commit/5afc5a8876624888fc1e8f43fed1c85c4b0e830b">5afc5a8</a>)</li>
<li><strong>client:</strong> skip rewriting unchanged adopted styles (<a
href="https://redirect.github.com/vitejs/vite/issues/23697">#23697</a>)
(<a
href="https://github.com/vitejs/vite/commit/fa7146938b0ca703653c90c20907191a01c032ba">fa71469</a>)</li>
<li><strong>css:</strong> resolve imported preprocessors from their file
path with lightningcss (<a
href="https://redirect.github.com/vitejs/vite/issues/23688">#23688</a>)
(<a
href="https://github.com/vitejs/vite/commit/cf52011c46409a4a45f3d74bba631b8f005c4bc9">cf52011</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23648">#23648</a>)
(<a
href="https://github.com/vitejs/vite/commit/8a4c19cfc035f2dd203f2fa6d00ab9256a5e77c9">8a4c19c</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23649">#23649</a>)
(<a
href="https://github.com/vitejs/vite/commit/794516d50cff80e405bc9b3e5faac1c82987566c">794516d</a>)</li>
<li><strong>dev:</strong> a restart requested during a restart used to
be dropped (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23392">#23392</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23484">#23484</a>)
(<a
href="https://github.com/vitejs/vite/commit/70d56ea1848909edab416934f3f68ce14343eb73">70d56ea</a>)</li>
<li>don't treat modules ending with js-like query as js (<a
href="https://redirect.github.com/vitejs/vite/issues/23687">#23687</a>)
(<a
href="https://github.com/vitejs/vite/commit/fcb6f1252a95857823d935f98554b938888d41a0">fcb6f12</a>)</li>
<li><strong>html:</strong> avoid adding filesystem root to watcher (<a
href="https://redirect.github.com/vitejs/vite/issues/23689">#23689</a>)
(<a
href="https://github.com/vitejs/vite/commit/3a7f2aea757d59bae66ad6edf6b321d26a7e6778">3a7f2ae</a>)</li>
<li><strong>html:</strong> skip caching CSS of chunks in a cycle (fix <a
href="https://redirect.github.com/vitejs/vite/issues/23628">#23628</a>)
(<a
href="https://redirect.github.com/vitejs/vite/issues/23636">#23636</a>)
(<a
href="https://github.com/vitejs/vite/commit/15d82f7dc679ab9c18d5ce2c3711157c2365ddd1">15d82f7</a>)</li>
<li><strong>optimizer:</strong> scan deep imports with custom extensions
(<a
href="https://redirect.github.com/vitejs/vite/issues/23678">#23678</a>)
(<a
href="https://github.com/vitejs/vite/commit/8579189bae8626b6ddab55a09325e209d62e027e">8579189</a>)</li>
<li>remove input option unescaping for now (<a
href="https://redirect.github.com/vitejs/vite/issues/23694">#23694</a>)
(<a
href="https://github.com/vitejs/vite/commit/facc2fb1fffce03d9e2dd7011d0bd0eeddc7d0f6">facc2fb</a>)</li>
<li><strong>server:</strong> match static aliases on path boundaries (<a
href="https://redirect.github.com/vitejs/vite/issues/23643">#23643</a>)
(<a
href="https://github.com/vitejs/vite/commit/b28db28e9e62d9866a9a0f1b22e74589cc180577">b28db28</a>)</li>
<li><strong>watcher:</strong> normalize file before root check in
<code>ensureWatchedFile</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23673">#23673</a>)
(<a
href="https://github.com/vitejs/vite/commit/12bb28c22379c8d2fe90088fa0eefbfa2ab3fb80">12bb28c</a>)</li>
</ul>
<h3>Performance Improvements</h3>
<ul>
<li><strong>module-runner:</strong> skip cloning call sites that have no
source map (<a
href="https://redirect.github.com/vitejs/vite/issues/23646">#23646</a>)
(<a
href="https://github.com/vitejs/vite/commit/3d674869a50a0bca84a8cc8dc55bd35d57100e37">3d67486</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li><strong>bundled-dev:</strong> import CSS HMR helpers from
<code>/@vite/client</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23674">#23674</a>)
(<a
href="https://github.com/vitejs/vite/commit/182f5b2a65391da5bee05f9c3df1aeb3794e98d9">182f5b2</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.3.2...v8.3.3">8.3.3</a>
(2026-10-06)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update launch-editor to v2.14.2 (<a
href="https://redirect.github.com/vitejs/vite/issues/23654">#23654</a>)
(<a
href="https://github.com/vitejs/vite/commit/22fd1d5238cce2ee9db0eb4122f9e8feb6b06097">22fd1d5</a>)</li>
<li><strong>html:</strong> filename passed to transformIndexHtml should
not include queries (<a
href="https://redirect.github.com/vitejs/vite/issues/23653">#23653</a>)
(<a
href="https://github.com/vitejs/vite/commit/7dafd8e56f152403a3230608fa4005273c2e9e17">7dafd8e</a>)</li>
<li><strong>server:</strong> check <code>fs.serve</code> for
<code>?vite-wasm-instance</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23655">#23655</a>)
(<a
href="https://github.com/vitejs/vite/commit/ba8b7ab43b4afa5d0292ab4b6e3a7b5033cc9c73">ba8b7ab</a>)</li>
<li><strong>server:</strong> store ids to <code>safeModulePaths</code>
rather than URLs (<a
href="https://redirect.github.com/vitejs/vite/issues/23656">#23656</a>)
(<a
href="https://github.com/vitejs/vite/commit/c3e06f92e969952466b4e2f5801e85e1e00cd905">c3e06f9</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.3.1...v8.3.2">8.3.2</a>
(2026-10-01)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>build:</strong> preload CSS correctly when
<code>renderBuiltUrl</code> returns URLs with queries (<a
href="https://redirect.github.com/vitejs/vite/issues/23611">#23611</a>)
(<a
href="https://github.com/vitejs/vite/commit/64e0a215c24f0522b27b91f93cfd93e317b94481">64e0a21</a>)</li>
<li><strong>bundled-dev:</strong> serve lazy chunk sourcemaps (<a
href="https://redirect.github.com/vitejs/vite/issues/23026">#23026</a>)
(<a
href="https://github.com/vitejs/vite/commit/eb7aa9a8816a1e926d5d9b4cbe7e796b61314ce2">eb7aa9a</a>)</li>
<li><strong>bundled-dev:</strong> serve the rolldown runtime from the
installed rolldown (<a
href="https://redirect.github.com/vitejs/vite/issues/23568">#23568</a>)
(<a
href="https://github.com/vitejs/vite/commit/bc598a6a8a6b7d6e157e9f19c16911cff8d2360c">bc598a6</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23601">#23601</a>)
(<a
href="https://github.com/vitejs/vite/commit/9944fa6033873f13ae88f59e023ab642c50fee2b">9944fa6</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23602">#23602</a>)
(<a
href="https://github.com/vitejs/vite/commit/88c17415af221b3a13e778f4f2c0e907c8287baf">88c1741</a>)</li>
<li><strong>html:</strong> resolve percent-encoded srcset urls (<a
href="https://redirect.github.com/vitejs/vite/issues/23609">#23609</a>)
(<a
href="https://github.com/vitejs/vite/commit/53f1ce7bfe38426861f6da572ef0e3359f6a80cd">53f1ce7</a>)</li>
<li>limit size of object and array printing via
<code>forwardConsole</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23565">#23565</a>)
(<a
href="https://github.com/vitejs/vite/commit/e64a5877dd3e552843a545749ccc257568917d28">e64a587</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/b6c20f6a8126d8561891e5fb9368e8fc9da37538"><code>b6c20f6</code></a>
release: v8.3.4 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23702">#23702</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/b28db28e9e62d9866a9a0f1b22e74589cc180577"><code>b28db28</code></a>
fix(server): match static aliases on path boundaries (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23643">#23643</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/bc0f21c56a2e003a4d2dd23ccb9da3ec8c706c4e"><code>bc0f21c</code></a>
feat(bundled-dev): support <code>import.meta.hot.acceptExports</code>
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23463">#23463</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/fa7146938b0ca703653c90c20907191a01c032ba"><code>fa71469</code></a>
fix(client): skip rewriting unchanged adopted styles (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23697">#23697</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/2a8c0f05c76e35c43ab3560984a5103c8db8dbcd"><code>2a8c0f0</code></a>
fix(build): correct preloads when chunkImportMap is enabled with
non-root bas...</li>
<li><a
href="https://github.com/vitejs/vite/commit/3a7f2aea757d59bae66ad6edf6b321d26a7e6778"><code>3a7f2ae</code></a>
fix(html): avoid adding filesystem root to watcher (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23689">#23689</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/facc2fb1fffce03d9e2dd7011d0bd0eeddc7d0f6"><code>facc2fb</code></a>
fix: remove input option unescaping for now (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23694">#23694</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/70d56ea1848909edab416934f3f68ce14343eb73"><code>70d56ea</code></a>
fix(dev): a restart requested during a restart used to be dropped (fix
<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23392">#23392</a>...</li>
<li><a
href="https://github.com/vitejs/vite/commit/cf52011c46409a4a45f3d74bba631b8f005c4bc9"><code>cf52011</code></a>
fix(css): resolve imported preprocessors from their file path with
lightningc...</li>
<li><a
href="https://github.com/vitejs/vite/commit/fcb6f1252a95857823d935f98554b938888d41a0"><code>fcb6f12</code></a>
fix: don't treat modules ending with js-like query as js (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23687">#23687</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.3.4/packages/vite">compare
view</a></li>
</ul>
</details>
<br />

Updates `vitest` from 5.0.2 to 5.0.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">vitest's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.4</h2>
<h3>   🚀 Features</h3>
<ul>
<li><strong>experimental</strong>:
<ul>
<li>Tag cache directories with CACHEDIR.TAG  -  by <a
href="https://github.com/lifeiscontent"><code>@​lifeiscontent</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11461">vitest-dev/vitest#11461</a>
<a href="https://github.com/vitest-dev/vitest/commit/a8ea3c8fd"><!-- raw
HTML omitted -->(a8ea3)<!-- raw HTML omitted --></a></li>
<li>Support <code>test.ui.theme</code> option  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11499">vitest-dev/vitest#11499</a>
<a href="https://github.com/vitest-dev/vitest/commit/1da66405d"><!-- raw
HTML omitted -->(1da66)<!-- raw HTML omitted --></a></li>
<li>Highlight selector multiple matches in trace view  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>Claude Opus 5.5</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11489">vitest-dev/vitest#11489</a>
<a href="https://github.com/vitest-dev/vitest/commit/5abba1e1b"><!-- raw
HTML omitted -->(5abba)<!-- raw HTML omitted --></a></li>
<li>Print how many tests were affected and a total when running
<code>--changed</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11424">vitest-dev/vitest#11424</a>
<a href="https://github.com/vitest-dev/vitest/commit/a23368585"><!-- raw
HTML omitted -->(a2336)<!-- raw HTML omitted --></a></li>
<li>Add an option to cache dependencies instead of statically parsing
them  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11515">vitest-dev/vitest#11515</a>
<a href="https://github.com/vitest-dev/vitest/commit/c06012ac8"><!-- raw
HTML omitted -->(c0601)<!-- raw HTML omitted --></a></li>
<li>Add fit and zoom controls to trace viewer  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>Claude Opus 5.5</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11490">vitest-dev/vitest#11490</a>
<a href="https://github.com/vitest-dev/vitest/commit/f5dd99ed0"><!-- raw
HTML omitted -->(f5dd9)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li>Fail the run on git and location filter errors  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11430">vitest-dev/vitest#11430</a>
<a href="https://github.com/vitest-dev/vitest/commit/30d0304d2"><!-- raw
HTML omitted -->(30d03)<!-- raw HTML omitted --></a></li>
<li>Enable fsModuleCache by default  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11435">vitest-dev/vitest#11435</a>
<a href="https://github.com/vitest-dev/vitest/commit/ad208cc29"><!-- raw
HTML omitted -->(ad208)<!-- raw HTML omitted --></a></li>
<li>Track project files and mocks with --changed  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11432">vitest-dev/vitest#11432</a>
<a href="https://github.com/vitest-dev/vitest/commit/b0f2b3bb9"><!-- raw
HTML omitted -->(b0f2b)<!-- raw HTML omitted --></a></li>
<li>Refactor caching, fix <code>:</code> in project and change the shape
of <code>results</code> cache  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11453">vitest-dev/vitest#11453</a>
<a href="https://github.com/vitest-dev/vitest/commit/9673c49a4"><!-- raw
HTML omitted -->(9673c)<!-- raw HTML omitted --></a></li>
<li>Keep full <code>$</code> string values when
<code>taskTitleValueFormatTruncate</code> is 0  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>Claude Opus 5.5</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11485">vitest-dev/vitest#11485</a>
<a href="https://github.com/vitest-dev/vitest/commit/4f7e1799b"><!-- raw
HTML omitted -->(4f7e1)<!-- raw HTML omitted --></a></li>
<li>Resolve node builtins in client environments  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11417">vitest-dev/vitest#11417</a>
<a href="https://github.com/vitest-dev/vitest/commit/56b319ac6"><!-- raw
HTML omitted -->(56b31)<!-- raw HTML omitted --></a></li>
<li>Fix module graph builtin externals after <a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11421">#11421</a>
 -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>Claude Opus 5.5</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11491">vitest-dev/vitest#11491</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11421">vitest-dev/vitest#11421</a>
<a href="https://github.com/vitest-dev/vitest/commit/008e184cb"><!-- raw
HTML omitted -->(008e1)<!-- raw HTML omitted --></a></li>
<li>Wrap module mocks during in-source testing  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11505">vitest-dev/vitest#11505</a>
<a href="https://github.com/vitest-dev/vitest/commit/36d19cb00"><!-- raw
HTML omitted -->(36d19)<!-- raw HTML omitted --></a></li>
<li>Handle line endings in snapshot  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11522">vitest-dev/vitest#11522</a>
<a href="https://github.com/vitest-dev/vitest/commit/4c468aa40"><!-- raw
HTML omitted -->(4c468)<!-- raw HTML omitted --></a></li>
<li>Respect root in projects  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11521">vitest-dev/vitest#11521</a>
<a href="https://github.com/vitest-dev/vitest/commit/26642f793"><!-- raw
HTML omitted -->(26642)<!-- raw HTML omitted --></a></li>
<li>Resolve mocks in directories with spaces  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11539">vitest-dev/vitest#11539</a>
<a href="https://github.com/vitest-dev/vitest/commit/caaef9416"><!-- raw
HTML omitted -->(caaef)<!-- raw HTML omitted --></a></li>
<li><strong>api</strong>:
<ul>
<li>Publish the api token atomically  -  by <a
href="https://github.com/umairnawaz333"><code>@​umairnawaz333</code></a>
in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11323">vitest-dev/vitest#11323</a>
<a href="https://github.com/vitest-dev/vitest/commit/6f990fef1"><!-- raw
HTML omitted -->(6f990)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>browser</strong>:
<ul>
<li>Close the mock route interception race  -  by <a
href="https://github.com/cplieger"><code>@​cplieger</code></a> and <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/8339">vitest-dev/vitest#8339</a>
and <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11083">vitest-dev/vitest#11083</a>
<a href="https://github.com/vitest-dev/vitest/commit/d6620fae6"><!-- raw
HTML omitted -->(d6620)<!-- raw HTML omitted --></a></li>
<li>Allow toHaveTextContent without arguments  -  by <a
href="https://github.com/nomadical"><code>@​nomadical</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11425">vitest-dev/vitest#11425</a>
<a href="https://github.com/vitest-dev/vitest/commit/8ebcf5f8a"><!-- raw
HTML omitted -->(8ebcf)<!-- raw HTML omitted --></a></li>
<li>Apply API options without browser config  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/10852">vitest-dev/vites...

_Description has been truncated_

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-20 01:24:43 -04:00
dependabot[bot] 6ffcf3b363 build(deps): bump python from 3.14.7-slim to 3.14.8-slim (#1470) 
Bumps python from 3.14.7-slim to 3.14.8-slim.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.7-slim&new-version=3.14.8-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-20 01:24:34 -04:00
dependabot[bot] 4b7607e224 build(deps): bump astral-sh/uv from 0.12.22 to 0.12.24 in the docker-base-image-digests group (#1449) 
> [!WARNING]
> Cooldown could not be applied because no publication date was
available from the registry.
>

Bumps the docker-base-image-digests group with 1 update:
[astral-sh/uv](https://github.com/astral-sh/uv).

Updates `astral-sh/uv` from 0.12.22 to 0.12.24
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases">astral-sh/uv's
releases</a>.</em></p>
<blockquote>
<h2>0.12.24</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-08.</p>
<h3>Enhancements</h3>
<ul>
<li>Remove orphaned temporary build environments with <code>uv cache
prune</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22171">#22171</a>)</li>
<li>Accept PEP 508 marker operators directly before grouped expressions
(<a
href="https://redirect.github.com/astral-sh/uv/pull/22309">#22309</a>)</li>
<li>Reject malformed requirements-file options instead of partially
parsing or ignoring them (<a
href="https://redirect.github.com/astral-sh/uv/pull/22317">#22317</a>)</li>
<li>Show underlying filesystem and registry errors when managed Python
uninstallation fails (<a
href="https://redirect.github.com/astral-sh/uv/pull/22362">#22362</a>)</li>
<li>Identify the invalid source URL in Python mirror errors (<a
href="https://redirect.github.com/astral-sh/uv/pull/22364">#22364</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Display preferred advisory IDs in <code>uv audit</code> reports,
prioritizing PYSEC, GHSA, then CVE identifiers (<a
href="https://redirect.github.com/astral-sh/uv/pull/22292">#22292</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Support custom installation mirrors for GraalPy (<a
href="https://redirect.github.com/astral-sh/uv/pull/22269">#22269</a>)</li>
<li>Support custom installation mirrors for Pyodide (<a
href="https://redirect.github.com/astral-sh/uv/pull/22271">#22271</a>)</li>
<li>Allow <code>UV_NO_CACHE=false</code> to override <code>no-cache =
true</code> in configuration (<a
href="https://redirect.github.com/astral-sh/uv/pull/22324">#22324</a>)</li>
<li>Report more precise error locations for invalid trusted-host ports
and preview-feature list entries (<a
href="https://redirect.github.com/astral-sh/uv/pull/22144">#22144</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Speed up later commands after creating an environment by warming its
interpreter cache (<a
href="https://redirect.github.com/astral-sh/uv/pull/21304">#21304</a>)</li>
<li>Reduce code-signature verification work for ARM64 macOS releases
with 16 KiB signature pages (<a
href="https://redirect.github.com/astral-sh/uv/pull/22246">#22246</a>)</li>
<li>Enforce resource limits when parsing package indexes and
<code>--find-links</code> pages with <code>astral-html</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22203">#22203</a>)</li>
<li>Reduce standalone <code>uv-build</code> executable size by 7.5% by
omitting unused Zstandard support (<a
href="https://redirect.github.com/astral-sh/uv/pull/22242">#22242</a>)</li>
<li>Reduce uv's binary size by about 232 KB by simplifying configuration
deserialization (<a
href="https://redirect.github.com/astral-sh/uv/pull/22144">#22144</a>)</li>
<li>Reduce Python download error formatting code size by sharing its
formatter (<a
href="https://redirect.github.com/astral-sh/uv/pull/22141">#22141</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Verify supplied hashes even when hash presence is disabled with
<code>--no-require-hashes</code> or <code>require-hashes = false</code>
(<a
href="https://redirect.github.com/astral-sh/uv/pull/22369">#22369</a>)</li>
<li>Honor exact managed Python patch pins when creating script
environments instead of following patch upgrades (<a
href="https://redirect.github.com/astral-sh/uv/pull/22360">#22360</a>)</li>
<li>Prevent dependency overrides and constraints from activating
optional dependencies when their extras are not selected (<a
href="https://redirect.github.com/astral-sh/uv/pull/22237">#22237</a>)</li>
<li>Exclude optional dependencies from exports when their extras are
activated only in incompatible environments (<a
href="https://redirect.github.com/astral-sh/uv/pull/22234">#22234</a>)</li>
<li>Give explicit <code>uv publish --trusted-publishing</code> values
precedence over configuration (<a
href="https://redirect.github.com/astral-sh/uv/pull/22279">#22279</a>)</li>
<li>Allow <code>UV_OFFLINE=false</code> to override <code>offline =
true</code> in configuration (<a
href="https://redirect.github.com/astral-sh/uv/pull/22283">#22283</a>)</li>
<li>Allow <code>UV_SYSTEM_CERTS=false</code> to override
<code>system-certs = true</code> in configuration (<a
href="https://redirect.github.com/astral-sh/uv/pull/22291">#22291</a>)</li>
<li>Allow <code>uv auth login</code> over IPv6 loopback addresses (<a
href="https://redirect.github.com/astral-sh/uv/pull/22306">#22306</a>)</li>
<li>Resolve GitHub dependencies whose Git references contain
<code>#</code> or <code>%</code> characters (<a
href="https://redirect.github.com/astral-sh/uv/pull/22281">#22281</a>)</li>
<li>Recognize existing Pyodide interpreters as satisfying Pyodide Python
requests (<a
href="https://redirect.github.com/astral-sh/uv/pull/22322">#22322</a>)</li>
<li>Preserve JSON output from <code>uv version</code> and <code>uv self
version</code> with a single <code>--quiet</code> flag (<a
href="https://redirect.github.com/astral-sh/uv/pull/22280">#22280</a>)</li>
<li>Preserve trailing spaces and tabs in passwords returned by
subprocess keyrings (<a
href="https://redirect.github.com/astral-sh/uv/pull/22284">#22284</a>)</li>
<li>Restore wheel incompatibility hints when <code>WHEEL</code> metadata
contains multiple expanded <code>Tag:</code> rows (<a
href="https://redirect.github.com/astral-sh/uv/pull/22235">#22235</a>)</li>
<li>Preserve Windows wheel-script rename errors unless a cross-drive
copy fallback applies (<a
href="https://redirect.github.com/astral-sh/uv/pull/22302">#22302</a>)</li>
<li>Prevent workspace-cache assertion failures after modifying a project
at the workspace root (<a
href="https://redirect.github.com/astral-sh/uv/pull/22236">#22236</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's
changelog</a>.</em></p>
<blockquote>
<h2>0.12.24</h2>
<p>Released on 2026-10-08.</p>
<h3>Enhancements</h3>
<ul>
<li>Remove orphaned temporary build environments with <code>uv cache
prune</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22171">#22171</a>)</li>
<li>Accept PEP 508 marker operators directly before grouped expressions
(<a
href="https://redirect.github.com/astral-sh/uv/pull/22309">#22309</a>)</li>
<li>Reject malformed requirements-file options instead of partially
parsing or ignoring them (<a
href="https://redirect.github.com/astral-sh/uv/pull/22317">#22317</a>)</li>
<li>Show underlying filesystem and registry errors when managed Python
uninstallation fails (<a
href="https://redirect.github.com/astral-sh/uv/pull/22362">#22362</a>)</li>
<li>Identify the invalid source URL in Python mirror errors (<a
href="https://redirect.github.com/astral-sh/uv/pull/22364">#22364</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Display preferred advisory IDs in <code>uv audit</code> reports,
prioritizing PYSEC, GHSA, then CVE identifiers (<a
href="https://redirect.github.com/astral-sh/uv/pull/22292">#22292</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Support custom installation mirrors for GraalPy (<a
href="https://redirect.github.com/astral-sh/uv/pull/22269">#22269</a>)</li>
<li>Support custom installation mirrors for Pyodide (<a
href="https://redirect.github.com/astral-sh/uv/pull/22271">#22271</a>)</li>
<li>Allow <code>UV_NO_CACHE=false</code> to override <code>no-cache =
true</code> in configuration (<a
href="https://redirect.github.com/astral-sh/uv/pull/22324">#22324</a>)</li>
<li>Report more precise error locations for invalid trusted-host ports
and preview-feature list entries (<a
href="https://redirect.github.com/astral-sh/uv/pull/22144">#22144</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Speed up later commands after creating an environment by warming its
interpreter cache (<a
href="https://redirect.github.com/astral-sh/uv/pull/21304">#21304</a>)</li>
<li>Reduce code-signature verification work for ARM64 macOS releases
with 16 KiB signature pages (<a
href="https://redirect.github.com/astral-sh/uv/pull/22246">#22246</a>)</li>
<li>Enforce resource limits when parsing package indexes and
<code>--find-links</code> pages with <code>astral-html</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22203">#22203</a>)</li>
<li>Reduce standalone <code>uv-build</code> executable size by 7.5% by
omitting unused Zstandard support (<a
href="https://redirect.github.com/astral-sh/uv/pull/22242">#22242</a>)</li>
<li>Reduce uv's binary size by about 232 KB by simplifying configuration
deserialization (<a
href="https://redirect.github.com/astral-sh/uv/pull/22144">#22144</a>)</li>
<li>Reduce Python download error formatting code size by sharing its
formatter (<a
href="https://redirect.github.com/astral-sh/uv/pull/22141">#22141</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Verify supplied hashes even when hash presence is disabled with
<code>--no-require-hashes</code> or <code>require-hashes = false</code>
(<a
href="https://redirect.github.com/astral-sh/uv/pull/22369">#22369</a>)</li>
<li>Honor exact managed Python patch pins when creating script
environments instead of following patch upgrades (<a
href="https://redirect.github.com/astral-sh/uv/pull/22360">#22360</a>)</li>
<li>Prevent dependency overrides and constraints from activating
optional dependencies when their extras are not selected (<a
href="https://redirect.github.com/astral-sh/uv/pull/22237">#22237</a>)</li>
<li>Exclude optional dependencies from exports when their extras are
activated only in incompatible environments (<a
href="https://redirect.github.com/astral-sh/uv/pull/22234">#22234</a>)</li>
<li>Give explicit <code>uv publish --trusted-publishing</code> values
precedence over configuration (<a
href="https://redirect.github.com/astral-sh/uv/pull/22279">#22279</a>)</li>
<li>Allow <code>UV_OFFLINE=false</code> to override <code>offline =
true</code> in configuration (<a
href="https://redirect.github.com/astral-sh/uv/pull/22283">#22283</a>)</li>
<li>Allow <code>UV_SYSTEM_CERTS=false</code> to override
<code>system-certs = true</code> in configuration (<a
href="https://redirect.github.com/astral-sh/uv/pull/22291">#22291</a>)</li>
<li>Allow <code>uv auth login</code> over IPv6 loopback addresses (<a
href="https://redirect.github.com/astral-sh/uv/pull/22306">#22306</a>)</li>
<li>Resolve GitHub dependencies whose Git references contain
<code>#</code> or <code>%</code> characters (<a
href="https://redirect.github.com/astral-sh/uv/pull/22281">#22281</a>)</li>
<li>Recognize existing Pyodide interpreters as satisfying Pyodide Python
requests (<a
href="https://redirect.github.com/astral-sh/uv/pull/22322">#22322</a>)</li>
<li>Preserve JSON output from <code>uv version</code> and <code>uv self
version</code> with a single <code>--quiet</code> flag (<a
href="https://redirect.github.com/astral-sh/uv/pull/22280">#22280</a>)</li>
<li>Preserve trailing spaces and tabs in passwords returned by
subprocess keyrings (<a
href="https://redirect.github.com/astral-sh/uv/pull/22284">#22284</a>)</li>
<li>Restore wheel incompatibility hints when <code>WHEEL</code> metadata
contains multiple expanded <code>Tag:</code> rows (<a
href="https://redirect.github.com/astral-sh/uv/pull/22235">#22235</a>)</li>
<li>Preserve Windows wheel-script rename errors unless a cross-drive
copy fallback applies (<a
href="https://redirect.github.com/astral-sh/uv/pull/22302">#22302</a>)</li>
<li>Prevent workspace-cache assertion failures after modifying a project
at the workspace root (<a
href="https://redirect.github.com/astral-sh/uv/pull/22236">#22236</a>)</li>
<li>Hide the ignored <code>--keyring-provider</code> option from
<code>uv auth</code> help (<a
href="https://redirect.github.com/astral-sh/uv/pull/19520">#19520</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/5411378eb76dc1ea1ad90aeb10e84e997e5bbd96"><code>5411378</code></a>
Bump version to 0.12.24 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22371">#22371</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/213e6de8b643a831a84bbc12ff9f9ee6f0bfc13d"><code>213e6de</code></a>
Clarify integration test style in agent guidance (<a
href="https://redirect.github.com/astral-sh/uv/issues/22372">#22372</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/35deef2029377b87a293579f4c89548f2ec41f14"><code>35deef2</code></a>
Skip Python setup in static version and credential tests (<a
href="https://redirect.github.com/astral-sh/uv/issues/22370">#22370</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/bbddf2f44a7be6888b24264eb2d8a35293e7a58f"><code>bbddf2f</code></a>
Share requirements-file arguments across commands (<a
href="https://redirect.github.com/astral-sh/uv/issues/22145">#22145</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/9a123eb638016dee70515e326a4a5fa88e74e090"><code>9a123eb</code></a>
Deserialize trusted hosts and preview features directly (<a
href="https://redirect.github.com/astral-sh/uv/issues/22144">#22144</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/57a9256bf0ee3bb75e438f193c6a2afe2adc6e9c"><code>57a9256</code></a>
Share archive decoding across reader types (<a
href="https://redirect.github.com/astral-sh/uv/issues/22143">#22143</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/3e3374b961fefaed663747868c09e95863c9a3d2"><code>3e3374b</code></a>
Verify hashes even when they are not required (<a
href="https://redirect.github.com/astral-sh/uv/issues/22369">#22369</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/d3c092a30ed2712d15c855af652d5741d4d5c7c5"><code>d3c092a</code></a>
Move installation layout operations out of Python types (<a
href="https://redirect.github.com/astral-sh/uv/issues/22367">#22367</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/1be3e88341157061a75b68f78953ff3a3c309576"><code>1be3e88</code></a>
Accept PEP 508 marker operators before parentheses (<a
href="https://redirect.github.com/astral-sh/uv/issues/22309">#22309</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/e27def75aaf746634b7c6576bc23ebf572d101a5"><code>e27def7</code></a>
Retain Python download request errors directly (<a
href="https://redirect.github.com/astral-sh/uv/issues/22366">#22366</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.12.22...0.12.24">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/uv&package-manager=docker&previous-version=0.12.22&new-version=0.12.24)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-20 01:24:26 -04:00
dependabot[bot] d86d34b8e9 build(deps): bump apprise from 1.13.1 to 2.0.0 (#1437) 
Bumps [apprise](https://github.com/caronc/apprise) from 1.13.1 to 2.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/caronc/apprise/releases">apprise's
releases</a>.</em></p>
<blockquote>
<h2>Apprise v2.0.0</h2>
<h2>What's Changed</h2>
<p>🎉 <strong>Welcome to Apprise v2.0.0!</strong> 🎉</p>
<p>This is the first official release of Apprise v2. It's a big one.
Much of how Apprise works under the hood was rebuilt, and many features
people have asked for over the years are finally here:</p>
<ul>
<li>template variables to keep secrets out of your config files</li>
<li>tag priorities and escalation</li>
<li>smarter retries</li>
<li>timeouts</li>
<li>a detailed <code>AppriseResult</code> object returned from every
<code>notify()</code> call</li>
<li>...and much more</li>
</ul>
<p><strong>Note:</strong> ⚠️ <strong>This is a breaking release
for anyone using Apprise v1.x.</strong> If you are a developer embedding
Apprise in your own project, please read the <strong>Breaking
Changes</strong> section below before upgrading. If you are not ready to
move yet, pin your <code>pyproject.toml</code> or
<code>requirements.txt</code> to <code>apprise &gt;=1.0.0,
&lt;2.0.0</code>. The v1 codebase lives on in the <a
href="https://github.com/caronc/apprise/tree/apprise-v1-release"><code>apprise-v1-release</code></a>
branch. I will keep patching it for security issues and bugs where
practical for a year or two, but v2.x is the way forward.</p>
<h3>⚠️ Breaking Changes</h3>
<ul>
<li><strong><code>notify()</code> now returns an
<code>AppriseResult</code> object instead of
<code>True</code>/<code>False</code>/<code>None</code></strong>
<ul>
<li><code>bool(result)</code> still gives you
<code>True</code>/<code>False</code>, so most existing <code>if
apobj.notify(...):</code> checks keep working. <code>None</code> can't
come back from <code>bool()</code>, so a &quot;nothing matched&quot;
result now reads as <code>False</code>.</li>
<li>The object also holds the logs for each individual service called,
plus a status for each one, so your application can report exactly what
worked and what didn't.</li>
<li>The status values line up with the CLI exit codes:
<ul>
<li><code>SUCCESS</code> (0) - every service was notified successfully
(the old <code>True</code>)</li>
<li><code>FAILURE</code> (1) - the notification failed (the old
<code>False</code>)</li>
<li><code>NOMATCH</code> (3) - nothing matched the tags given, or no
services were loaded (the old <code>None</code>)</li>
<li><code>PARTIAL</code> (4) - some services succeeded but at least one
failed (v1 returned <code>False</code> here)</li>
<li><code>TIMEOUT</code> (5) - a service didn't finish before its time
limit (new in v2)</li>
</ul>
</li>
</ul>
</li>
<li><strong>Multiple body formats per service</strong>
<ul>
<li>In v1 each service supported a single body format. Services can now
support more than one when the upstream service allows it (Telegram, for
example, accepts both Markdown and HTML).</li>
<li>Apprise picks the best matching format automatically based on the
<code>format</code> you send with, so it no longer rewrites your content
when the service can already accept it as-is.</li>
<li>You can also choose the format yourself in the URL with
<code>?format=</code>.</li>
</ul>
</li>
<li><strong>Consistent error handling</strong>
<ul>
<li>Every error Apprise raises now comes from a single
<code>AppriseException</code> family, so developers can catch everything
in one place.</li>
<li>Each error still behaves like the plain Python error it used to be
(a bad setting is still a <code>ValueError</code>, a disk problem is
still an <code>OSError</code>), so existing
<code>try</code>/<code>except</code> blocks keep working.</li>
</ul>
</li>
<li><strong>Deprecations removed</strong> - Apprise v2 starts with a
clean slate:
<ul>
<li>The <code>APPRISE_CONFIG</code> environment variable is now
<code>APPRISE_CONFIG_PATH</code>. The old name still works for now, but
prints a deprecation warning.</li>
<li>The Email options <code>use_pgp=</code> and <code>?pgpkey=</code>
(deprecated back in v1) have been removed. Use <code>pgp_mode=</code>
and <code>?pgppub=</code> instead.</li>
<li>Bad settings in a URL (such as an unknown <code>?format=</code>) now
fail with a clear error message instead of quietly doing something
unexpected.</li>
</ul>
</li>
</ul>
<h3>📣 New Notification Services:</h3>
<ul>
<li>Delta Chat (<code>deltachat://</code>) support added in <a
href="https://redirect.github.com/caronc/apprise/pull/1666">caronc/apprise#1666</a></li>
<li>WPUSH (<code>wpush://</code>) support added by <a
href="https://github.com/anhao"><code>@​anhao</code></a> in <a
href="https://redirect.github.com/caronc/apprise/pull/1721">caronc/apprise#1721</a></li>
<li>YouLMK (<code>youlmk://</code>) support added by <a
href="https://github.com/elilat"><code>@​elilat</code></a> in <a
href="https://redirect.github.com/caronc/apprise/pull/1726">caronc/apprise#1726</a></li>
<li>Telnyx SMS (<code>telnyx://</code>) support added by <a
href="https://github.com/anandghegde"><code>@​anandghegde</code></a> in
<a
href="https://redirect.github.com/caronc/apprise/pull/1731">caronc/apprise#1731</a></li>
</ul>
<h3>🐞  Bugfixes</h3>
<ul>
<li>DingTalk Markdown messages now set <code>msgtype</code> to
<code>markdown</code> so they actually get delivered by <a
href="https://github.com/xtqxk"><code>@​xtqxk</code></a> in <a
href="https://redirect.github.com/caronc/apprise/pull/1733">caronc/apprise#1733</a></li>
<li>OneSignal now honors <code>language=</code> and keeps it in
<code>url()</code> by <a
href="https://github.com/MaxFreedomPollard"><code>@​MaxFreedomPollard</code></a>
in <a
href="https://redirect.github.com/caronc/apprise/pull/1720">caronc/apprise#1720</a></li>
<li>SIGNL4 now keeps its query parameters in <code>url()</code> by <a
href="https://github.com/MaxFreedomPollard"><code>@​MaxFreedomPollard</code></a>
in <a
href="https://redirect.github.com/caronc/apprise/pull/1732">caronc/apprise#1732</a></li>
<li>VAPID now delivers to the subscription endpoint instead of a
per-mode base URL by <a
href="https://github.com/RT530"><code>@​RT530</code></a> in <a
href="https://redirect.github.com/caronc/apprise/pull/1728">caronc/apprise#1728</a></li>
<li>Fluxer now works with self-hosted servers by using the correct URL
by <a href="https://github.com/LaaZa"><code>@​LaaZa</code></a> in <a
href="https://redirect.github.com/caronc/apprise/pull/1740">caronc/apprise#1740</a></li>
<li>ntfy <code>attach=</code> filename detection fixed, and
<code>filename=</code> is kept in <code>url()</code> by <a
href="https://github.com/SulimanAbdulrazzaq"><code>@​SulimanAbdulrazzaq</code></a>
in <a
href="https://redirect.github.com/caronc/apprise/pull/1744">caronc/apprise#1744</a></li>
<li>Compressed IPv6 addresses are now handled properly in <a
href="https://redirect.github.com/caronc/apprise/pull/1734">caronc/apprise#1734</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/caronc/apprise/commit/68f0eaf8bd2127ed693f451414f5e45686eaffd0"><code>68f0eaf</code></a>
bumped version to v2.0.0</li>
<li><a
href="https://github.com/caronc/apprise/commit/782f3038ab6070549117825b83ab173255f6ceca"><code>782f303</code></a>
Fixed o365:// inline attachment contentType sent as a literal string (<a
href="https://redirect.github.com/caronc/apprise/issues/1747">#1747</a>)</li>
<li><a
href="https://github.com/caronc/apprise/commit/a5b7e51b90890b76e4752f6fb00cb515403f438b"><code>a5b7e51</code></a>
Keep CC display names in url() for mailgun, ses, smtp2go and sparkpost
(<a
href="https://redirect.github.com/caronc/apprise/issues/1749">#1749</a>)</li>
<li><a
href="https://github.com/caronc/apprise/commit/5c4f272d0398e86597f46b9b719fd632a4b88a4c"><code>5c4f272</code></a>
Apprise v2 Release (<a
href="https://redirect.github.com/caronc/apprise/issues/1666">#1666</a>)</li>
<li><a
href="https://github.com/caronc/apprise/commit/971861bdc097936b2f988e7e782c91855a26687b"><code>971861b</code></a>
handling of Apprise v1 Branch</li>
<li><a
href="https://github.com/caronc/apprise/commit/6819cc45baff08a68aa3606cb9e707301d46b783"><code>6819cc4</code></a>
reduced codecov retention of file in github from 90 days to 7</li>
<li><a
href="https://github.com/caronc/apprise/commit/1fe1f703ab6eba7c95113123d7032b9ea32d467c"><code>1fe1f70</code></a>
Fix ntfy:// attach= filename detection and keep filename= in url() (<a
href="https://redirect.github.com/caronc/apprise/issues/1744">#1744</a>)</li>
<li><a
href="https://github.com/caronc/apprise/commit/2e72688d0526614980316b483c36d525441b9a4b"><code>2e72688</code></a>
fixes issue with yaml/config parsing (<a
href="https://redirect.github.com/caronc/apprise/issues/1743">#1743</a>)</li>
<li><a
href="https://github.com/caronc/apprise/commit/a02d47bcbfd3c270fc822118cb10cd80064d1914"><code>a02d47b</code></a>
Fluxer improvements to self-hosted api path (<a
href="https://redirect.github.com/caronc/apprise/issues/1740">#1740</a>)</li>
<li><a
href="https://github.com/caronc/apprise/commit/9e15330ed5f08b931d266ff888d6aba16c09b3ac"><code>9e15330</code></a>
Additional improvements/handling of macosx terminal-notifier wrapper (<a
href="https://redirect.github.com/caronc/apprise/issues/1742">#1742</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/caronc/apprise/compare/v1.13.1...v2.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=apprise&package-manager=uv&previous-version=1.13.1&new-version=2.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-20 01:24:13 -04:00
Amalkrishna A S b38e4e4a00 feat(naming): add {AuthorSort} template variable (#1484) 
Closes #1178.

Adds `{AuthorSort}`, the first author surname-first ("Arthur Conan
Doyle" → "Doyle, Arthur Conan"), for rename and organize templates,
alongside `{FirstAuthor}`.

- A value already in "Last, First" form (one word before the comma) is
kept as is; Jr/Sr/II/III/IV stay at the end.
- Known limits, same as calibre's default: the last word is treated as
the surname, so particles ("Le Guin") and surname-first names aren't
detected.
- Added to the settings help, env docs, the frontend variable
picker/preview, and tests.
 2026-10-20 01:22:05 -04:00
misko903andClaude Opus 5.5 b83e35ee0a feat(metadata): add Databáze knih metadata provider (#1479) 
## What

Adds [Databáze knih](https://www.databazeknih.cz), the Czech and Slovak
community book catalog, as a metadata provider. It follows the Moly.hu
provider (#1172): HTML scraping, no API key, disabled by default, and a
settings tab with an enable checkbox and a Test Connection button.

## Why

Hardcover, Open Library and Google Books cover Czech and Slovak editions
poorly. Databáze knih is the de facto catalog for them, including Czech
and Slovak translations of foreign works. With this provider, Universal
mode works end to end for Czech and Slovak titles: the localized title
and author from Databáze knih feed the release search.

## How

- HTML scraping with BeautifulSoup, which is already a dependency. Book
pages carry schema.org JSON-LD, so most fields come from structured data
rather than CSS selectors.
- **Title search** uses `/vyhledavani/knihy`, with the site's pagination
(`page`) and language filter (`lang` for cs/sk/en/de). A search with a
single match redirects straight to the book page, and that case is
handled.
- **Author search:** the site search only matches titles, so an
author-only search finds the author (accent- and word-order-insensitive)
and lists their books page, which is also paginated. Title + author
filters the title results on the author.
- **ISBN search** follows the site's redirect from `/search?q=<isbn>` to
the book page.
- **`get_book`** reads the full description (the JSON-LD one is
truncated), ISBN-10/13, publisher, edition year, language, genres, cover
(placeholder images dropped), series with id and position, and rating
and rating count. It also reads the page count and original title from
the more-info fragment.
- The `RateLimiter` from Open Library (30 requests/min) and the standard
`@cacheable` decorators. Fetch failures return `None`, so they are not
cached.
- `docs/environment-variables.md`: added the `DATABAZEKNIH_ENABLED`
section.

## Testing

- `tests/metadata/test_databazeknih_parse.py`: offline tests with
shortened copies of real pages. They cover search parsing, pagination
and language parameters, redirect-to-book, author listing, title +
author filtering, uncached failures, book details, ISBN resolution and
helpers.
- `uv run pytest tests/metadata` is green (89 passed), and `ruff check`
and `ruff format --check` are clean.
- Verified live against databazeknih.cz: connection test, title search
(pages 1 and 2), author books, title + author, `get_book`, and ISBN
lookup.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-20 01:20:26 -04:00
Alex 72893262aa fix: search settings popup and positioning refinement (#1476) 
Hey @calibrain, thought i'd come back to do a quick UI fix I noticed :)

A previous PR appears to have broken the search options in any context
that is not the desktop homescreen, they can clip off the page on
mobile, or break the search results screen. I've tweaked this to revive
the popover for search results context and allowed for cleaner wrapping
on mobile, plus a little bit of UI refinement.

Desktop homepage: 
<img width="2880" height="1800" alt="image"
src="https://github.com/user-attachments/assets/a129ce56-1bea-4ede-a9c6-99777a4bc3cc"
/>

Mobile homepage: 
<img width="600" alt="image"
src="https://github.com/user-attachments/assets/544e58f9-84bd-4802-97d5-22ee23c3745f"
/>

Desktop and mobile search results: 
<img width="2880" height="1800" alt="image"
src="https://github.com/user-attachments/assets/9ec09e2b-fcb8-4342-a04e-c14255c373c1"
/>
 2026-10-20 01:13:25 -04:00
sean0407andSean Li a0ffb268b2 fix: wait for synced files before processing completed downloads (#1464) 
## Summary

```text
wait for completed download path
  regular file -> keep existing immediate handling
  directory -> inspect files enabled for this task's content type
              wait until the supported-file signature is stable across checks
```

Fixes the remote-sync race in #1463. A mapped torrent folder can appear
before its large media file finishes copying, so path existence alone
does not mean the download is ready.

## Evidence

- **Before:** In #1463, qBittorrent reported a multi-file audiobook
complete while the destination contained only `.cue` and `.jpg`;
Shelfmark immediately post-processed the folder and failed with “No book
files found in download.” Retrying after the `.m4b` sync finished
imported it.
- **After:** A regression test starts with the cue sheet and cover
present, then simulates the `.m4b` file appearing and growing. Path
waiting returns only after the supported file's size and modification
time remain stable across checks.
- Credential-free isolated `python -m pytest
tests/prowlarr/test_remote_path_mappings.py -q -n 0 -o addopts=''`: 11
passed.
- `ruff check shelfmark/download/clients/base_handler.py
tests/prowlarr/test_remote_path_mappings.py`: passed.

## Merge Danger

**Door:** Two-way

**Blast Radius:** Download handling

The wait uses the existing completed-path timeout and leaves regular
single-file downloads on their current path.

Co-authored-by: Sean Li <22557931+sean0407@users.noreply.github.com>
 2026-10-20 01:12:49 -04:00
splitsec2 0ade063db5 fix(download): extract RAR archives in place, not in the IO threadpool (#1459) 
Fixes #1458.

A RAR download fails with `Download failed: TypeError`, and the log says
`child watchers are only available on the default loop`. rarfile
extracts by running `unrar` as a subprocess, and `extract_archive_files`
calls it through `run_blocking_io`, so it runs in gevent's IO
threadpool. gevent only lets a subprocess start on the thread that owns
the default loop. `run_blocking_io` already avoids the threadpool for
`subprocess.run`, but a RAR gets to the subprocess through rarfile, so
nothing catches it.

This extracts a RAR on the calling greenlet, where the patched
subprocess waits for `unrar` without blocking anything else. ZIP is pure
Python and stays in the threadpool. I checked it with a real RAR4 file
on a build of main with the stock image's `unrar`: from the threadpool
it raises the TypeError, in place it extracts all 7 files.

Two tests. One checks that a RAR doesn't go through `run_blocking_io`.
The other runs under real gevent patching with an extractor that starts
a process the way rarfile does. Both fail without the change, and the
full suite passes.

I keyed it on the `.rar` suffix to keep it small. Teaching
`run_blocking_io` about rarfile's subprocess would be the more general
fix, but that's a bigger change to a helper a lot of code goes through,
so I left it for you to say if you want it.
 2026-10-20 01:12:10 -04:00
ultraviolet150 5f3647a496 fix(clients): wait for qBittorrent-compatible clients to finish before post-processing (#1465) 
## Summary

`QBittorrentClient.get_status()` treats a torrent as complete as soon as
`progress >= 1.0`, excluding only the `moving` state. Some
qBittorrent-compatible clients report full progress before they are
finished. rdt-client (v2.0.142) reports `progress = 1.0` once the debrid
and local downloads are done, but keeps `state = "downloading"` for a
few seconds while it finalises the torrent, and until then reports a
guessed `content_path`. It only switches to `pausedUP` with the real
path afterwards.

Shelfmark picks the torrent up inside that window, so post-processing
runs against a path that isn't there yet and fails within milliseconds
("No book files found" / `post-processing failed`). Clicking Retry then
imports it fine. Every rdt-client download hits this.

## Change

- Add `_INCOMPLETE_STATES` (all download-side states, plus `moving`) and
only mark a torrent complete when `progress >= 1.0` **and** its state is
not one of those.
- Real qBittorrent leaves these states when a torrent reaches 100%, so
its behaviour is unchanged.

## Example log (before)

```
12:04:43,215 base_handler - Remapped download path for qbittorrent (<hash>): <rdt-client download dir>\<torrent name>\ -> /downloads/<torrent name>
12:04:43,216 orchestrator - download finished; starting post-processing
12:04:43,232 orchestrator - WARNING - post-processing failed
```

## Testing

- New test
`test_get_status_full_progress_still_downloading_not_complete`: fails
before the change, passes after.
- `tests/prowlarr/`: all passing. `ruff check`, `ruff format --check`
and `basedpyright` clean on the changed files.
- Running the patched client against rdt-client: downloads now import
without Retry.

Related to #1463 / #1464, which handle the same symptom when the client
really is finished but files are still syncing to local disk. This PR
addresses a different cause: the client reports 100% progress while
still in a downloading state, so Shelfmark shouldn't treat it as
complete yet. The two changes are independent and complementary. Not
covered by #741, which fixed add-time failures. Possibly related: #607.
 2026-10-20 01:11:33 -04:00
FarawayMagnet ad62f41edc improve hints/docs regarding http proxy user/pass auth (#1462) 
in the web UI (Settings > Network > Proxy) it's unclear that shelfmark's
proxy option supports proxies that require user/pass auth. this PR adds
a note to the web UI's hint to explain this. it updates the associated
documentation as well.

also removed the `e.g.` note, since the form field already includes an
example and this was redundant.

a side note: i think the verbiage "HTTPS proxy URL (leave empty to use
HTTP proxy for HTTPS)" is a little confusing. i believe it's referring
to the fact that a user can specify one proxy address for HTTP requests
that shelfmark would make, and another proxy address for HTTPS requests
that shelfmark would make. i'll leave this for the maintainer to decide
whether to clarify.
 2026-10-20 01:10:41 -04:00
Matt Van HornandMatt Van Horn d3bcf0674d fix(direct_download): Anna's Archive search 404 on ISBN queries (#1456) 
When ISBN filters are present, the search query is now the deduplicated
bare ISBN strings, with the free-text query appended only if it is not
already one of those tokens. Searches with no ISBN still send the quoted
free-text query alone. An Anna's Archive lookup that includes an ISBN
comes back as 404 Not Found, so the direct-download release search fails
and the book cannot be retrieved. The failing request puts an
isbn13:/isbn10: boolean expression in the q parameter.

The direct-download search query tests passed.

Closes #1444

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>
 2026-10-20 01:10:03 -04:00
splitsec2 84d1d7196c fix(irc): pin the TLS context to TLS 1.2 or newer (#1455) 
CodeQL on my fork flagged `ssl.create_default_context()` in the IRC
client as allowing TLS 1.0 and 1.1 (`py/insecure-protocol`, rated high).

In practice the shipped image is already fine. Python 3.10+ sets a TLS
1.2 floor on the default context, and on the current image (Python
3.14.7, OpenSSL 3.5.7) `minimum_version` comes back as TLS 1.2. An
OpenSSL config on the host can still lower that floor, so this pins it
with one line, `context.minimum_version = ssl.TLSVersion.TLSv1_2`.

Added `tests/irc/test_client_tls.py`. It drops the floor to the minimum
before `connect()` runs, then checks that `connect()` raised it back to
1.2. It fails without the change.

Certificate and hostname verification are still off (`CERT_NONE`). I
left that alone because of the comment about self-signed certs on IRC
servers. Turning verification on, or making it a setting, would be the
bigger fix, but that is ultimately a call for @calibrain if you want a
PR for it.
 2026-10-20 01:09:26 -04:00
Som Samantray 2b8e0da2f3 fix(direct-download): clarify required search mirror (#1454) 
Direct Download now tells users who configure only a Z-Library mirror
that they need an Anna's Archive mirror for search. Z-Library, LibGen,
and Welib mirrors download results found through Anna's Archive.

Fixes #1408. Validation: the Direct mode browser check, 18 focused
tests, Ruff, formatting, and backend/test type checks passed. The
CI-style Python suite passed 3,569 tests;
`tests/core/test_hardlink.py::TestSameFilesystem::test_string_paths` was
excluded because this container reports different `st_dev` values for a
file and its parent directory. AI disclosure: OpenAI Codex assisted with
diagnosis, implementation, and validation.
 2026-10-20 01:09:09 -04:00
HeihoffJandClaude Opus 5.5 756bdec19b fix(metadata): show the translation a search matched on Open Library and Hardcover (#1451) 
Searching a translated title on Open Library or Hardcover returned the
original-language work. "Der Weg der Könige" came back as "The Way of
Kings" (2010), and that English title then went into the release search
and the download name. Both providers keep one record per work, titled
after the original, and list translations underneath it.

#483 already searches releases per language with Hardcover's localized
titles, which fixed the release side of #360 when the matching language
is selected. This PR fixes the search result itself, so the book a user
picks is the translation they searched for, and it covers Open Library,
the default provider, which has no titles_by_language.

- Open Library: request the matched edition (editions.*) and prefer its
title, ISBNs, cover, language and publication year when its title
differs from the work's.
- Hardcover: use the alternative title named in the hit's highlights
(alternative_titles, best index first), without the original's subtitle.
A hit whose title also matched keeps the work title.
- /api/releases: when the modal sends a title that differs from the book
record's, it becomes search_title. Before, Hardcover's search_title from
the original won, so picking "Kinder des Nebels" still searched "The
Final Empire" first.
- Release cache: keyed on title and language as well as the provider ID.
All translations share that ID, so opening "The Way of Kings" after "Der
Weg der Könige" showed the German releases until a reload.

Known limitations: neither provider has descriptions per edition, so the
description stays the work's (usually English). Hardcover's search hits
carry no year or language for alternative titles, so those stay the
work's; Open Library's do not. Google Books is unaffected, since it
already returns one volume per edition.

Tests: Open Library edition parsing, Hardcover alternative-title
matching, the /api/releases title override, and the release cache, each
written to fail first. The Python suite passes apart from the 9
test_entrypoint_permissions.py tests, which fail the same way on an
unmodified main on macOS. The frontend typecheck, lint, format check and
unit tests pass. Checked on a live instance with Open Library, Hardcover
and Google Books.

Refs #360, #483

Disclaimer:
This was developed with the help of AI but reviewed and tested as well
as deployed on my server by a real human.

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-20 01:08:45 -04:00
splitsec2andCaliBrain 45548687b7 fix(hardcover): defensive rate limiting and 429 backoff (#1439) 
Kept as small as I could so it's easy to review. It is still about 140
lines of code plus tests, in two commits so the second can be dropped on
its own. Same kind of fix as #1429, so see the question there about
separate PRs versus combined.

This is a defensive change. I found the problem on my own deployment,
which has a more automated ingestion on top of this provider: Hardcover
want-to-read items turn into requests, and each pending request gets one
`get_book` lookup. One pass made around 38 lookups back to back, which
is more than Hardcover's burst allows, and a few came back as 429.
`_execute_query` swallowed the 429 and returned `None`, so `get_book`
returned `None`, and the caller read that as "no such book". Nothing in
the logs said a lookup had been throttled.

**What it does**
- Every POST goes through one shared token bucket (burst 5, 0.8 requests
per second), set under the documented Free limits. The limit is per user
across all of the account's apps, so I kept well below it.
- A 429 is retried up to 3 attempts in total. It waits for `Retry-After`
when Hardcover sends one, otherwise 2^attempt seconds plus up to a
second of jitter, and the wait holds back other threads too. A
`Retry-After` over 30 seconds (a spent daily quota) is not waited out.
- When the retries run out it raises `HardcoverRateLimitError`, a
`RuntimeError`, instead of returning `None`.
- The second commit makes `get_book` ask for that error, so a throttled
or failed lookup is no longer taken for a missing book. GraphQL
rejections still return `None`.

**Behaviour change in the second commit.** `/api/metadata/book` already
turns a `RuntimeError` into a 503, so a timeout or HTTP error there now
returns 503 instead of 404. In `/api/releases` the same error goes
through the operational errors handler and returns 500 with the message,
where it used to return 404 "Book not found". If you'd rather keep
returning `None` and only have the pacing and backoff, I can drop the
second commit.

**Limits.** I read them from the `hardcover-docs` repo
(`api/Getting-Started.mdx`, Rate Limits), because the docs site blocks
my headless browser: Free is 60 per minute, a burst of 10 and 5,000 a
day, with `Retry-After` on a 429. Personal Access Tokens get double the
burst. I didn't parse the `RateLimit-Policy` headers, so the bucket
constants are fixed.

**Testing.** The tests use a fake clock and never sleep. I broke each
rule in turn (pacing, `Retry-After`, the 30 second cap, the shared
hold-back, and `get_book` raising) and each break failed a test. Ruff,
basedpyright, `tests/metadata` and `tests/core` pass. I haven't seen a
real 429 from Hardcover with this change running, so the `Retry-After`
handling comes from the docs.

The one red check is the existing clock-dependent test
`test_a_queued_torrent_asks_for_a_grace_once`, which fails on any runner
that booted recently. It is fixed in #1426 and is not caused by this
change.

---------

Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-20 01:06:56 -04:00
splitsec2andCaliBrain 95ed00ce78 fix(activity): Clear Completed leaves out requests that are still pending (#1438) 
Kept small on purpose so it's easy to review. Same kind of small fix as
#1429, so see the question there about separate PRs versus combined.

"Clear Completed" sends each finished download plus the request linked
to it. The server only dismisses finished requests, and if one request
in the batch is still pending it answers 409 "Only terminal requests can
be dismissed" and nothing gets cleared. A request can be pending while
its download has ended, for example when the startup sweep from #1409
reopens the request of an interrupted download. On my instance 25
finished downloads were linked to 21 pending requests, and the button
failed every time.

The button now leaves out the request target when the request list shows
it as pending, and still dismisses the download. A request the list has
no record of is sent as before. The target logic moved into a small
`getClearCompletedTargets` helper so it can be tested without rendering
the sidebar. The pending-request test fails on the old logic.

Vitest (225 passing), tsc, oxlint and oxfmt are clean. I reproduced the
409 from the server log and the data, but I haven't clicked through it
in the UI with this build.

The one red check is the existing clock-dependent test
`test_a_queued_torrent_asks_for_a_grace_once`, which fails on any runner
that booted recently. It is fixed in #1426 and is not caused by this
change.

Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-20 01:05:55 -04:00
splitsec2 b5e47b2593 ci: a cache export error should not fail the image publish (#1435) 
Kept small on purpose so it's easy to review. Same kind of small fix as
#1429 to #1432, so see the question in #1429 about separate PRs versus
combined. I'm sending them separately until I hear otherwise.

`cache-to: type=gha` has no `ignore-error`, and the Docker docs list it
as defaulting to `false`. If the GitHub Actions cache service errors
while exporting, the build step fails after the image has been built and
pushed, so the attestation step is skipped. The docs suggest
`ignore-error=true` when cache export is optional, which it is here.

I haven't seen an export fail on this repo, so this is a precaution and
I can't reproduce it locally. It's a one-line change plus a comment.

The one red check is the existing clock-dependent test
`test_a_queued_torrent_asks_for_a_grace_once`, which fails on any runner
that booted recently. It is fixed in #1426 and is not caused by this
change.
 2026-10-20 01:01:56 -04:00
splitsec2 61cf0792bd fix(googlebooks): report more pages when limit is above the 40 result maximum (#1434) 
Kept small on purpose so it's easy to review. Same kind of small fix as
#1429 to #1432, so see the question in #1429 about separate PRs versus
combined. I'm sending them separately until I hear otherwise.

`search_paginated` guesses `has_more` as `len(books) >= options.limit`.
Google Books returns at most 40 per page and `search` already caps
`maxResults` at 40, but `/api/metadata/search` accepts a limit up to
100. With a limit over 40 a full page of 40 never reaches `limit`, so
`has_more` is always False. The UI sends 40, so this only affects direct
API callers.

The Google provider now overrides `search_paginated` to apply the same
cap before the base heuristic runs. A full page of 40 with a limit of
100 reports more results and a short page doesn't. The first test fails
on current `main`. Ruff, basedpyright and `tests/metadata` pass.

The one red check is the existing clock-dependent test
`test_a_queued_torrent_asks_for_a_grace_once`, which fails on any runner
that booted recently. It is fixed in #1426 and is not caused by this
change.
 2026-10-20 01:01:38 -04:00
splitsec2 f0f0d46381 fix(queue): first terminal status wins, so a late COMPLETE cannot overwrite a cancel (#1429) 
Kept small on purpose so it's easy to review. I have a few more small
fixes like this from going back over recently merged PRs. Would you
rather get them as separate PRs like this one, or combined into one?

#1361 made `cancel_download` write under the queue lock, which stops a
cancel from overwriting a download that finished first. The other
direction is still open. The worker checks `cancel_flag.is_set()` and
then calls `update_status(COMPLETE)` a few lines later in
`_process_single_download`. If a cancel lands between those two lines
the task goes CANCELLED, then the worker writes COMPLETE over it.
`_apply_status_locked` allows terminal to terminal moves, so the
terminal hook also fires a second time and records two events for one
task.

This makes the first terminal status win: `_apply_status_locked` ignores
a different terminal status once the task already has one. Requeueing
from a terminal status still works because QUEUED isn't terminal.

I replaced the existing race test. It patched `queue.update_status`,
which `cancel_download` no longer calls, so it never exercised the path
it names, and its last assertion only looked at the final hook event.
The new tests call the queue directly: complete then cancel is refused,
cancel then complete stays cancelled with one hook event, error then
complete stays error, and a terminal task can still be requeued. The two
late-write tests fail on current `main`.

Ruff and basedpyright are clean. `tests/core` and `tests/download` pass
apart from 4 `seleniumbase` import failures in my environment that also
fail on `main`.

The one red check is the existing clock-dependent test
`test_a_queued_torrent_asks_for_a_grace_once`, which fails on any runner
that booted recently. It is fixed in #1426 and is not caused by this
change.
 2026-10-20 01:00:21 -04:00
splitsec2 65dbf42a86 fix(release-search): report a ValueError from a source as that source's error (#1433) 
Kept small on purpose so it's easy to review. This is the same kind of
small fix as the ones in #1429 to #1432, so see the question in #1429
about separate PRs versus combined. I'm sending them separately until I
hear otherwise.

In `search_source_releases` the `except ValueError` comes before the
branch that handles the operational errors, and `ValueError` is in that
tuple. A `ValueError` from `build_release_search_plan` or
`source.search()` is therefore reported as `Unknown source: <name>`
instead of `<name>: <message>`. The only `ValueError` meant for that
branch is the one `get_source` raises for a name that isn't registered,
so that call now has its own `try` and the rest goes back to the
operational errors branch.

The failure test already covered `OSError` and `RuntimeError`, so I
added `ValueError` to it, and that case fails on current `main`. Ruff,
basedpyright and `tests/core` pass.

The one red check is the existing clock-dependent test
`test_a_queued_torrent_asks_for_a_grace_once`, which fails on any runner
that booted recently. It is fixed in #1426 and is not caused by this
change.
 2026-10-20 00:59:54 -04:00
splitsec2 93f58caf7a fix(debug): keep SHELFMARK_API_KEY_READONLY out of the debug bundle (#1432) 
Kept small on purpose so it's easy to review.

`genDebug.sh` filters secrets out of `environment.txt` by matching
`_KEY=`, `_SECRET=`, `_PASSWORD=` and `_TOKEN=`, which only catches
names that end in those words. `SHELFMARK_API_KEY_READONLY` ends in
`_READONLY`, so its value lands in the file, and people attach these
bundles to issues. That key only reads counters, so the impact is small,
but any variable like `DB_PASSWORD_FILE` would leak the same way.

The pattern now matches the secret word anywhere in the variable name.
The new test runs the real filter line from the script against a made-up
environment, and it fails on the old pattern.

The one red check is the existing clock-dependent test
`test_a_queued_torrent_asks_for_a_grace_once`, which fails on any runner
that booted recently. It is fixed in #1426 and is not caused by this
change.
 2026-10-20 00:59:10 -04:00
splitsec2 be2653bdb7 fix(debridlink): reuse the file list from the status check (#1431) 
Kept small on purpose so it's easy to review.

When a torrent is ready, `get_status` has already fetched the full
record with `/seedbox/list?ids=` and `_handle_torrent_info` has checked
that every file is at 100%. The retrieval thread was then started
without that list, so `_process_and_download` called `_fetch_file_list`,
which asks the same endpoint again. That second call runs inside the
thread's generic `except`, without the flood and transient error
handling the status path has, so a rate limit or a hiccup there sets the
phase to error for a torrent that finished fine.

This passes the files already in hand into the thread.
`_process_and_download` already took an optional `files` argument. The
new test starts the thread from a ready status and checks it uses the
given list and never calls `_fetch_file_list`.

Separately, `download_url` returns a `BytesIO`, so a whole file sits in
memory. AllDebrid, TorBox and Real-Debrid do the same, so I left that
for a streaming variant of the shared helper instead of fixing it for
one client here.

Ruff and basedpyright are clean and `tests/prowlarr` passes.

The one red check is the existing clock-dependent test
`test_a_queued_torrent_asks_for_a_grace_once`, which fails on any runner
that booted recently. It is fixed in #1426 and is not caused by this
change.
 2026-10-20 00:59:00 -04:00
splitsec2 e8f6505bea fix(library): back off after a failed index instead of retrying for every result (#1430) 
Kept small on purpose so it's easy to review.

`library_index._entries_for` retries `fetch_entries` on every call while
the index is failing. The lookup runs once per search result, so with
the Calibre path unreadable a page of 40 results makes 40 attempts and
logs 40 warnings. The entrypoint runs one gevent worker and the Calibre
read is synchronous sqlite, so each attempt also holds up every other
request.

After a failure it now answers from the stale cache (or an empty list)
for 60 seconds before trying again, and a successful index clears that.
The new tests cover 40 lookups against a failing library with a stale
cache (one failed attempt, one warning), a failing library with no cache
(tried once), and a retry once the 60 seconds have passed. The first and
second fail on current `main`.

I left a few other things in this module out to keep this one small:
re-indexing blocks the worker for as long as a big library takes (I
haven't measured how long), `test_connection` stores entries from the
unsaved form path under the shared cache key, and a title with a
collection word in it, like "Books of Blood", shows as "In a
collection". I can send any of those separately.

Ruff and basedpyright are clean and `tests/core` passes.

The one red check is the existing clock-dependent test
`test_a_queued_torrent_asks_for_a_grace_once`, which fails on any runner
that booted recently. It is fixed in #1426 and is not caused by this
change.
 2026-10-20 00:58:49 -04:00
splitsec2 47707b827a feat(download): make the torrent stall window a setting (#1426) 
#1420 gave a torrent 15 minutes to get going and 15 minutes after each
step forward. That suits my swarms, but other people will want it
shorter or longer, so this makes the number a setting.

`TORRENT_STALL_TIMEOUT_MINUTES` sits in Download Clients with the other
torrent options and takes 5 to 60. The default is 15, so nothing changes
unless someone sets it. 5 is the orchestrator's own stall timeout, so
choosing it asks for no extra time and gives the old behaviour. The
value can arrive as text from an env var, so anything that isn't a
number falls back to the default and anything out of range is clamped.

The orchestrator caps one activity grace at 16 minutes, so I raised that
to an hour to fit the top of the range. As far as I can tell the
protection bypass is the only caller that asks for more than a few
minutes, but I haven't audited every caller. If you'd rather keep the
cap, I can lower the maximum to 16 minutes instead.

Tests cover the default, 5 and 30, text values, out of range values and
NaN, the start and movement windows following the setting, and the
setting showing up in the Download Clients tab. I broke each rule on
purpose to check a test catches it. The full suite fails the same tests
with and without this change (the bypass and seleniumbase tests don't
run in my environment).
 2026-10-20 00:58:24 -04:00
Josh Theisen 3f2873916f feat(QoL): implement top-level settings button (#1427) 
Implementing a top-level/reusable settings button that can be clicked
directly from the home page instead of having to require a second click
to get to the settings menu.

<img width="1315" height="449" alt="image"
src="https://github.com/user-attachments/assets/687cba23-621e-4231-b39f-5c484ca15974"
/>
 2026-10-20 00:57:53 -04:00
CaliBrainandClaude Opus 5.5 9321096032 fix(clients): correct Debrid-Link file listing and rate-limit handling (#1425) 
Follow-up to #1380.

- Fetch the file list with ?ids=, the documented parameter. There is no
  ?id=, so a many-file torrent was not expanded and the call could fail
  with badArguments at the last step of every download.
- Back off status checks for 60s after floodDetected, doubling to a 240s
cap, instead of an hour. The orchestrator cancels a download after five
minutes without a change, so the hour-long pause cancelled every active
  download. Only a flood on the status check starts it, and a successful
  check resets it.
- Drop the client-side one-hour stall timer. The orchestrator stall
timer
  always fires first.
- Keep progress at 50% when file retrieval starts instead of dropping to
  0% until the first file arrives.
- Report queued, paused and verifying torrents as QUEUED, PAUSED and
  CHECKING, so a queued torrent gets the handler queue grace.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-03 08:08:32 -04:00
splitsec2 cad18b8019 feat(clients): add Debrid-Link as a torrent client (#1380) 
calibrain said in #1315 that he'd review and merge a Debrid-Link client
if someone took a stab at it, so here it is. It's the fourth debrid
service alongside AllDebrid, Real-Debrid and TorBox and it uses the same
DownloadClient interface as the other three. No frontend changes, the
settings UI picks it up from the backend field definitions.

**I can't test this against the live API.** I don't use debrid and I
don't have a Debrid-Link key. Everything here is built from their v2 API
docs and cross-checked against two independent reference
implementations, so the request shapes should be right, but nobody has
run a real magnet through it yet.

@Tatsu941 you opened the issue and mentioned they give developers free
premium. Would you be able to try it? The things most worth confirming
are the field names on a seedbox torrent, that `premiumLeft` is the
right premium check, and that an API error comes back the way the client
expects. Happy to fix whatever turns up.

Two things about their API shaped how this is written.

Every v2 endpoint wraps its payload in a `{success, value}` envelope and
a failure can arrive with an HTTP 200, so `_request_value` decides the
outcome from the body instead of the status code.

A completed seedbox torrent already carries a direct `downloadUrl` on
every file. The other three clients each need a separate unrestrict or
link-request call per file and this one doesn't, which is why it came
out shorter than them despite doing the same job.

Endpoints used:

| Endpoint | Used for |
|---|---|
| `GET account/infos` | test the key, confirm premium time remains |
| `POST seedbox/add` | magnet as JSON, .torrent as multipart |
| `GET seedbox/list` | poll progress |
| `DELETE seedbox/{id}/remove` | clean up |

Ruff and basedpyright are clean and the 36 new tests pass. The two
failures in `tests/e2e/test_proxy_auth_middleware.py` are already on
main and fail the same way on a pristine checkout. They assume the first
proxy-authenticated user becomes an admin, which only holds while the
user table has no admin in it, so they depend on how many users earlier
tests created.

One thing for review: the download loop uses `download_url` like the
other three clients, which holds each file in memory. I kept the
existing pattern rather than do something different in a new-provider
PR, but say so if you'd rather it streamed here.

Closes #1315
 2026-10-03 07:55:36 -04:00
CaliBrain f773ac6029 fix(sabnzbd): strip Prowlarr API key on cross-host NZB redirects (#1424) 
_fetch_nzb_content sent X-Api-Key
then followed redirects with the header still attached, leaking the
Prowlarr key when Prowlarr 302s to the indexer download link. Follow
redirects manually with allow_redirects=False and re-evaluate headers
 per hop, mirroring the torrent path.
 2026-10-02 22:46:16 -04:00
splitsec2 755f28a6a4 feat(api): add a read-only API key and a /api/stats endpoint (#1419) 
This is the read-only API key from #1410, where you said to go ahead.

I run Shelfmark behind Homepage and wanted more on the dashboard tile
than up or down, without putting an admin API key in the dashboard's
config. This adds a second key, `SHELFMARK_API_KEY_READONLY`, that can
read one new endpoint.

`GET /api/stats` returns counts only: books added over the last 7 and 30
days by format, the queue, requests by outcome, and download failures
over the last 7 days. No titles and no user names. The read-only key,
the admin key or an admin session can read it.

The read-only key gets a 403 on every other path and on any write,
including a POST to `/api/stats` itself, and it never gets a session or
a cookie. If a request carries both keys, the admin one wins, so a
proxy's own `Authorization` header can't downgrade a correct
`X-Api-Key`. Unset means off, like the existing key. The endpoint exists
either way, but without a key only an admin session can read it.

It also adds a `db_path` property on `UserDB`, so the stats module can
open the database read-only.

Tests cover the key scope, the 403s for the read-only key, both keys at
once, who can reach the endpoint, and the counters. The full suite
passes, and I broke each rule on purpose to check a test catches it. A
version of this has been running on my own install behind Homepage.

If you'd rather have the stats in a different shape or under a different
path, I'm happy to change it.
 2026-10-02 22:45:48 -04:00
adman234andClaude Opus 5.5 32abaff21e feat(naming): {Narrator} placeholder and MyAnonamouse series fallback (#1407) 
## Human-Written explanation:

Following up on previous PR to use MAM ID to get nararrator and series
to show up in search, this PR will allow the series and nararrator
fields to be added to the path when saving an audiobook.

I have tested my ghcr.io image on my instance and it seemed to work
properly.

All the text below is written by Claude.

# feat(naming): {Narrator} placeholder and MyAnonamouse series fallback

Follow-up to #1390 and #1399. Related to #605 and #934 (narrator
support).

## Problem

Several narrations of the same audiobook currently land in the same
folder, because nothing in the path template tells them apart. Keeping
more than one version means renaming folders by hand after every
download.

Since #1390, MyAnonamouse results carry the release's narrator and
series in `extra`, but the naming templates can't use them: there is no
`{Narrator}` placeholder, and `{Series}` / `{SeriesPosition}` only come
from the metadata provider.

## Changes

- **`{Narrator}` placeholder** (`core/naming.py`,
`download/postprocess/transfer.py`, `core/models.py`): `DownloadTask`
gains `narrator`, read from `narrator` or `extra.narrator` when a
release is queued, and kept in the restart-safe retry payload. It's
available in audiobook templates like any other placeholder, including
prefix/suffix blocks such as `{ - Narrator}`.
- **Audiobookshelf folder style**: Audiobookshelf reads the narrator
from folder names like `Title {Narrator}`. The template `{Title}
{{Narrator}}` already matches as `{` + `{Narrator}`; the parser now also
drops the closing brace when the narrator is empty, so the folder is
`Title` rather than `Title }`.
- **No stray spaces around `/`**: an empty placeholder at the start or
end of a folder name no longer leaves a space there (e.g. `Title
/Title`). This applies to all templates.
- **Series fallback** (`release_sources/prowlarr/mam.py`, `source.py`,
`download/orchestrator.py`): MAM enrichment also stores the first
series' name and number as `extra.series_name` /
`extra.series_position`, which queueing already falls back to when the
metadata provider has no series. The provider's series still wins. A
release-level series number is only used when it names the same series
as the provider, so a provider series is never paired with the number of
a different MAM series (an omnibus, for example).
- **Settings and preview** (`config/settings.py`,
`namingTemplatePreview.ts`): the audiobook template descriptions list
`{Narrator}` and explain `{{Narrator}}`. The settings page preview
mirrors the parser changes and offers `{Narrator}` under "Insert
variable" for audiobook templates only.
- **Docs**: regenerated `environment-variables.md`. This also picked up
the Library Check settings, which weren't in the generated docs yet;
happy to drop that part to keep the diff focused.

## Example

Audiobook Path Template `{Author}/{Title} {{Narrator}}/{Title}`:

| Narrator | Result |
|----------|--------|
| Samuel Roukin | `Christopher Ruocchio/Empire of Silence {Samuel
Roukin}/Empire of Silence.m4b` |
| none | `Christopher Ruocchio/Empire of Silence/Empire of Silence.m4b`
|

## Testing

- `tests/core/test_narrator_template_variable.py` (new, 16 tests):
`{{Narrator}}` with and without a value, the `{ {Narrator}}` prefix
form, prefix/suffix blocks, sanitizing, `build_library_path`, task
metadata, retry payload round trip, MAM series name/number parsing
(including a `1-3` range having no number), and queueing (narrator from
`extra`, series fallback, no cross-series number, blank narrator).
- `namingTemplatePreview.test.ts`: the same `{{Narrator}}` cases for the
preview.
- Updated `test_generate_env_docs.py` for the new template description.
- Full `pytest -m "not integration and not e2e"` compared with an
upstream `main` worktree on the same machine: no new failures (the
remaining ones are Windows-only on both).
- `ruff check`, `ruff format --check`, `basedpyright` (0 errors) and
`vulture` on touched files; frontend `tsc --noEmit`, `oxlint`, `oxfmt
--check`, `vitest` (218 passed).
- Checked the settings page locally: the audiobook preview renders `...
{Simon Vance}.mp3` and `{Narrator}` is listed for audiobook templates
only.

No behavior change for existing templates, apart from spaces next to `/`
being trimmed.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-02 22:45:10 -04:00
dependabot[bot] 23d7d482d7 build(deps): bump the python-deps group across 1 directory with 3 updates (#1412) 
Bumps the python-deps group with 3 updates in the / directory:
[seleniumbase](https://github.com/seleniumbase/SeleniumBase),
[prek](https://github.com/j178/prek) and
[ruff](https://github.com/astral-sh/ruff).

Updates `seleniumbase` from 4.54.10 to 4.54.12
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's
releases</a>.</em></p>
<blockquote>
<h2>4.54.12 - Dependency update</h2>
<h2>Dependency update</h2>
<ul>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/d37046c342cea47177c96c3f4cdc0914c1ede0fe">Refresh
Python dependencies</a>
--&gt; Upgrade <code>filelock</code>
--&gt; Upgrade <code>soupsieve</code>
--&gt; Drop <code>platformdirs</code> (Looks like nothing was using it
anymore)
--&gt; Update some optional dependencies</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Dependency update by <a
href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a
href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4512">seleniumbase/SeleniumBase#4512</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.11...v4.54.12">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.11...v4.54.12</a></p>
<h2>4.54.11 - MCP Server: Patch 19</h2>
<h2>MCP Server: Patch 19</h2>
<ul>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/67a1543bf4ecd04db5cb649fd92ad948e6b54bd9">Update
the MCP server</a></li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/d49755183d2ad25a73800c34ac23234833ef4d2e">Update
the MCP ReadMe</a></li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/45c3f068ad647cada64f20f3ce580bac35654c2a">Refresh
Python dependencies</a>
--&gt; <code>filelock</code>
--&gt; <code>platformdirs</code>
--&gt; <code>parse</code>
--&gt; <code>uv</code> (optional)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>MCP Server: Patch 19 by <a
href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a
href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4511">seleniumbase/SeleniumBase#4511</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.10...v4.54.11">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.10...v4.54.11</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/67767bb57498dc09db70350f6c05144898cc5200"><code>67767bb</code></a>
Merge pull request <a
href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4512">#4512</a>
from seleniumbase/dependency-update</li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/9ab8de7545e1368b644fd8a084395ce490a31293"><code>9ab8de7</code></a>
Version 4.54.12</li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/7d13ec22d7091a7d48ddffae2eb472425cea1cb3"><code>7d13ec2</code></a>
Update server.json</li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/61ca74f205c98690f8fb134da4a2ae4983374aec"><code>61ca74f</code></a>
Update the deploy script</li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/d37046c342cea47177c96c3f4cdc0914c1ede0fe"><code>d37046c</code></a>
Refresh Python dependencies</li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/51d75da1397048ec78a020f270970d12de395cb8"><code>51d75da</code></a>
Update the Petco example</li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/e13dadbc570a40ffb79a36fab30b819f63f4f109"><code>e13dadb</code></a>
Add a Petco example</li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/44de25decafb56dc53f76c7ea9714e1fb413d7f0"><code>44de25d</code></a>
Update the Yelp example</li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/a035346b898546d97abfc12535626f746c44128a"><code>a035346</code></a>
Merge pull request <a
href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4511">#4511</a>
from seleniumbase/mcp-server-patch-19</li>
<li><a
href="https://github.com/seleniumbase/SeleniumBase/commit/7b371c2dfe008c0d77460d74a26cbff9a38ce9fe"><code>7b371c2</code></a>
Version 4.54.11</li>
<li>Additional commits viewable in <a
href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.10...v4.54.12">compare
view</a></li>
</ul>
</details>
<br />

Updates `prek` from 0.5.3 to 0.5.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/j178/prek/releases">prek's
releases</a>.</em></p>
<blockquote>
<h2>0.5.4</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-28.</p>
<h3>Highlights</h3>
<h4>Faster builtin hooks</h4>
<p>In our end-to-end benchmark, prek is about 38% faster than 0.5.3,
with some builtin
hooks up to 273% faster (<code>check-yaml</code>: 273%,
<code>check-json</code>: 80%,
<code>check-merge-conflict</code>: 71%).</p>
<h3>Enhancements</h3>
<ul>
<li>Add <code>include_deleted</code> to allow hooks to include deleted
files (<a
href="https://redirect.github.com/j178/prek/pull/2733">#2733</a>)</li>
<li>Add <code>--check</code> and simplify <code>end-of-file-fixer</code>
(<a
href="https://redirect.github.com/j178/prek/pull/2764">#2764</a>)</li>
<li>Add <code>--check</code> to <code>file-contents-sorter</code> (<a
href="https://redirect.github.com/j178/prek/pull/2765">#2765</a>)</li>
<li>Add <code>--check</code> to <code>requirements-txt-fixer</code> (<a
href="https://redirect.github.com/j178/prek/pull/2766">#2766</a>)</li>
<li>Add <code>--check</code> to <code>trailing-whitespace</code> (<a
href="https://redirect.github.com/j178/prek/pull/2763">#2763</a>)</li>
<li>Expose and document <code>prek util generate-shell-completion</code>
(<a
href="https://redirect.github.com/j178/prek/pull/2727">#2727</a>)</li>
<li>Support <code>hide_status</code> in project and user configuration
(<a
href="https://redirect.github.com/j178/prek/pull/2760">#2760</a>)</li>
<li>Support look-around regex in builtin pattern hooks (<a
href="https://redirect.github.com/j178/prek/pull/2732">#2732</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Cache the resolved Git executable on macOS (<a
href="https://redirect.github.com/j178/prek/pull/2726">#2726</a>)</li>
<li>Combine and cache Git repository path queries (<a
href="https://redirect.github.com/j178/prek/pull/2724">#2724</a>)</li>
<li>Optimize common builtin hook execution (<a
href="https://redirect.github.com/j178/prek/pull/2768">#2768</a>)</li>
<li>Optimize scanning in <code>mixed-line-ending</code> and
<code>trailing-whitespace</code> (<a
href="https://redirect.github.com/j178/prek/pull/2769">#2769</a>)</li>
<li>Scan <code>check-merge-conflict</code> files in fixed-size blocks
(<a
href="https://redirect.github.com/j178/prek/pull/2781">#2781</a>)</li>
<li>Use SIMD UTF-8 validation in <code>check-json</code>,
<code>check-toml</code>, and <code>check-yaml</code> (<a
href="https://redirect.github.com/j178/prek/pull/2770">#2770</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Retry transient rename failures on Windows (<a
href="https://redirect.github.com/j178/prek/pull/2756">#2756</a>)</li>
<li>Use PATH to resolve prek in completion scripts (<a
href="https://redirect.github.com/j178/prek/pull/2719">#2719</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Clarify the flow and scope of usage guides (<a
href="https://redirect.github.com/j178/prek/pull/2710">#2710</a>)</li>
<li>Reorganize usage guides and reference documentation (<a
href="https://redirect.github.com/j178/prek/pull/2709">#2709</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Sync latest identify tags (<a
href="https://redirect.github.com/j178/prek/pull/2762">#2762</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/github-actions"><code>@​github-actions</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/j178/prek/blob/master/CHANGELOG.md">prek's
changelog</a>.</em></p>
<blockquote>
<h2>0.5.4</h2>
<p>Released on 2026-09-28.</p>
<h3>Highlights</h3>
<h4>Faster builtin hooks</h4>
<p>In our end-to-end benchmark, prek is about 38% faster than 0.5.3,
with some builtin
hooks up to 273% faster (<code>check-yaml</code>: 273%,
<code>check-json</code>: 80%,
<code>check-merge-conflict</code>: 71%).</p>
<h3>Enhancements</h3>
<ul>
<li>Add <code>include_deleted</code> to allow hooks to include deleted
files (<a
href="https://redirect.github.com/j178/prek/pull/2733">#2733</a>)</li>
<li>Add <code>--check</code> and simplify <code>end-of-file-fixer</code>
(<a
href="https://redirect.github.com/j178/prek/pull/2764">#2764</a>)</li>
<li>Add <code>--check</code> to <code>file-contents-sorter</code> (<a
href="https://redirect.github.com/j178/prek/pull/2765">#2765</a>)</li>
<li>Add <code>--check</code> to <code>requirements-txt-fixer</code> (<a
href="https://redirect.github.com/j178/prek/pull/2766">#2766</a>)</li>
<li>Add <code>--check</code> to <code>trailing-whitespace</code> (<a
href="https://redirect.github.com/j178/prek/pull/2763">#2763</a>)</li>
<li>Expose and document <code>prek util generate-shell-completion</code>
(<a
href="https://redirect.github.com/j178/prek/pull/2727">#2727</a>)</li>
<li>Support <code>hide_status</code> in project and user configuration
(<a
href="https://redirect.github.com/j178/prek/pull/2760">#2760</a>)</li>
<li>Support look-around regex in builtin pattern hooks (<a
href="https://redirect.github.com/j178/prek/pull/2732">#2732</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Cache the resolved Git executable on macOS (<a
href="https://redirect.github.com/j178/prek/pull/2726">#2726</a>)</li>
<li>Combine and cache Git repository path queries (<a
href="https://redirect.github.com/j178/prek/pull/2724">#2724</a>)</li>
<li>Optimize common builtin hook execution (<a
href="https://redirect.github.com/j178/prek/pull/2768">#2768</a>)</li>
<li>Optimize scanning in <code>mixed-line-ending</code> and
<code>trailing-whitespace</code> (<a
href="https://redirect.github.com/j178/prek/pull/2769">#2769</a>)</li>
<li>Scan <code>check-merge-conflict</code> files in fixed-size blocks
(<a
href="https://redirect.github.com/j178/prek/pull/2781">#2781</a>)</li>
<li>Use SIMD UTF-8 validation in <code>check-json</code>,
<code>check-toml</code>, and <code>check-yaml</code> (<a
href="https://redirect.github.com/j178/prek/pull/2770">#2770</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Retry transient rename failures on Windows (<a
href="https://redirect.github.com/j178/prek/pull/2756">#2756</a>)</li>
<li>Use PATH to resolve prek in completion scripts (<a
href="https://redirect.github.com/j178/prek/pull/2719">#2719</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Clarify the flow and scope of usage guides (<a
href="https://redirect.github.com/j178/prek/pull/2710">#2710</a>)</li>
<li>Reorganize usage guides and reference documentation (<a
href="https://redirect.github.com/j178/prek/pull/2709">#2709</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Sync latest identify tags (<a
href="https://redirect.github.com/j178/prek/pull/2762">#2762</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/github-actions"><code>@​github-actions</code></a></li>
<li><a href="https://github.com/j178"><code>@​j178</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/j178/prek/commit/77c4056ce76b600de77d5d425e52844a76652a58"><code>77c4056</code></a>
Summarize builtin hook speedups</li>
<li><a
href="https://github.com/j178/prek/commit/7a6b8d1b4fdc87c6ef11a925177b425feb33d8a7"><code>7a6b8d1</code></a>
Bump version to 0.5.4</li>
<li><a
href="https://github.com/j178/prek/commit/c7ec693f66b37fb5afe7491e36e456c459654ac8"><code>c7ec693</code></a>
Update ubuntu:26.04 Docker digest to da6fc2b (<a
href="https://redirect.github.com/j178/prek/issues/2772">#2772</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/eee58225d1ba5719fdcc0bdf14ec6b563caba8bc"><code>eee5822</code></a>
Scan <code>check-merge-conflict</code> files in fixed-size blocks (<a
href="https://redirect.github.com/j178/prek/issues/2781">#2781</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/4c579dc913e388379579d816b0b99844f9a85505"><code>4c579dc</code></a>
Update dependency uv to v0.12.17 (<a
href="https://redirect.github.com/j178/prek/issues/2773">#2773</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/1f2a621d397004de8e9ba13ef55db2ab6e50c15e"><code>1f2a621</code></a>
Update Rust crate clap to v4.6.7 (<a
href="https://redirect.github.com/j178/prek/issues/2775">#2775</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/aeea7a54343a36625e3f2571a43cd8bda6f867cd"><code>aeea7a5</code></a>
Update GitHub Actions (<a
href="https://redirect.github.com/j178/prek/issues/2778">#2778</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/51ca2dbb1c29b13e3c1c2e5c6531ad23ec52a030"><code>51ca2db</code></a>
Update Rust crate rustix to v1.1.5 (<a
href="https://redirect.github.com/j178/prek/issues/2777">#2777</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/80e8bcce8933a5895a79a8eef54522b166be9569"><code>80e8bcc</code></a>
Update Rust crate clap_complete to v4.6.11 (<a
href="https://redirect.github.com/j178/prek/issues/2776">#2776</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/0f237646fcfe1c99191dc493974deaf4cbb2d31c"><code>0f23764</code></a>
Update Rust crate async-compression to v0.4.48 (<a
href="https://redirect.github.com/j178/prek/issues/2774">#2774</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/j178/prek/compare/v0.5.3...v0.5.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `ruff` from 0.16.8 to 0.16.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/releases">ruff's
releases</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev"><code>@​qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith"><code>@​sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran"><code>@​webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot"><code>@​zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin"><code>@​ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone"><code>@​spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12"><code>@​IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge"><code>@​devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir"><code>@​GruffElixir</code></a></li>
</ul>
<h2>Install ruff 0.16.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/ruff/releases/download/0.16.9/ruff-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's
changelog</a>.</em></p>
<blockquote>
<h2>0.16.9</h2>
<p>Released on 2026-09-24.</p>
<h3>Preview features</h3>
<ul>
<li>[<code>ruff</code>] Avoid false positives for overloaded division
(<code>RUF069</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28309">#28309</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>[<code>flake8-bugbear</code>] Avoid false positives for calls with
keyword arguments (<code>B009</code>, <code>B010</code>,
<code>B043</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28776">#28776</a>)</li>
<li>[<code>flake8-tidy-imports</code>] Allow lazy imports to be used in
deferred annotations (<code>TID255</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28767">#28767</a>)</li>
</ul>
<h3>Rule changes</h3>
<ul>
<li>Update LibCST-based fixes for Python 3.15 (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28616">#28616</a>)</li>
<li>[<code>flake8-pyi</code>] Mention stubs in the diagnostic message
(<code>PYI002</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28542">#28542</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Fix horizontal overflow on the rules documentation page (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28699">#28699</a>)</li>
<li>Update rules table with category information (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28651">#28651</a>)</li>
<li>[<code>flake8-annotations</code>] Clarify that <code>ANN401</code>
checks return types in addition to arguments (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28334">#28334</a>)</li>
<li>[<code>flake8-bugbear</code>] Document type-checker interaction
(<code>B010</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28509">#28509</a>)</li>
<li>[<code>flake8-comprehensions</code>] Document
<code>map</code>/generator exception behavior (<code>C417</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/27794">#27794</a>)</li>
<li>[<code>ruff</code>] Mention related isort settings
(<code>RUF022</code>) (<a
href="https://redirect.github.com/astral-sh/ruff/pull/28719">#28719</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a
href="https://github.com/qinpei-dev"><code>@​qinpei-dev</code></a></li>
<li><a
href="https://github.com/sanjayrohith"><code>@​sanjayrohith</code></a></li>
<li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li>
<li><a
href="https://github.com/webdevsamran"><code>@​webdevsamran</code></a></li>
<li><a
href="https://github.com/zaniebot"><code>@​zaniebot</code></a></li>
<li><a
href="https://github.com/ewdurbin"><code>@​ewdurbin</code></a></li>
<li><a
href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li>
<li><a
href="https://github.com/spaceone"><code>@​spaceone</code></a></li>
<li><a
href="https://github.com/IbrahimKhan12"><code>@​IbrahimKhan12</code></a></li>
<li><a
href="https://github.com/devtechedge"><code>@​devtechedge</code></a></li>
<li><a
href="https://github.com/GruffElixir"><code>@​GruffElixir</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/ruff/commit/0be08a206f9c3180afd3e93bcc792ed5cb1f4db1"><code>0be08a2</code></a>
Bump version to 0.16.9 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28882">#28882</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/b4920b72b354e7c715ab861ae23458874683bb02"><code>b4920b7</code></a>
Rename <code>ruff_cli</code> to <code>ruff_command_line</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28881">#28881</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/47c751b95908a4d1f95f9ef8723036aae9da0b18"><code>47c751b</code></a>
Update dependency astral-sh/uv to v0.12.18 (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28880">#28880</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/8c244e56a1aeac31c26d2371ef26588e0632235c"><code>8c244e5</code></a>
[<code>flake8-comprehensions</code>] Document <code>map</code>/generator
exception behavior (<code>C417</code>...</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/5edf5a1d0a84663079e46983216059f06acea87d"><code>5edf5a1</code></a>
Use <code>target</code> form in <code>rooster.version_files</code> (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28876">#28876</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/915bb2b4bf9ae7eee47cf55646bbfebae254a23b"><code>915bb2b</code></a>
[ty] Prefer existing @ paths over response files in Ruff and ty (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28877">#28877</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/4710e1aa962b13720cf64aa84eb279c5333896d7"><code>4710e1a</code></a>
ci(github): update version number in placeholder of issue template (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28871">#28871</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/eedfc62a75bf1ba86d48959b00eea75ae87eadca"><code>eedfc62</code></a>
[ty] Propagate outer type context through cast calls (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28855">#28855</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/ceaa6a00830e1e350b8a23977a1a10ac467920a1"><code>ceaa6a0</code></a>
[ty] Contain rendered code within Markdown fences (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28869">#28869</a>)</li>
<li><a
href="https://github.com/astral-sh/ruff/commit/dba0f30615424b94f94a174bba6ce6cce4bf11ff"><code>dba0f30</code></a>
authorize ruff-pre-commit dispatch via OIDC (<a
href="https://redirect.github.com/astral-sh/ruff/issues/28867">#28867</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/ruff/compare/0.16.8...0.16.9">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-02 22:38:15 -04:00
dependabot[bot] 33010efa16 build(deps): bump astral-sh/uv from 0.12.19 to 0.12.22 in the docker-base-image-digests group (#1413) 
> [!WARNING]
> Cooldown could not be applied because no publication date was
available from the registry.
>

Bumps the docker-base-image-digests group with 1 update:
[astral-sh/uv](https://github.com/astral-sh/uv).

Updates `astral-sh/uv` from 0.12.19 to 0.12.22
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases">astral-sh/uv's
releases</a>.</em></p>
<blockquote>
<h2>0.12.22</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-01.</p>
<h3>Python</h3>
<ul>
<li>Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22147">#22147</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Accept uppercase release suffixes in wheel platform tags (<a
href="https://redirect.github.com/astral-sh/uv/pull/22113">#22113</a>)</li>
<li>Record workspace-member default groups in lockfiles (<a
href="https://redirect.github.com/astral-sh/uv/pull/22010">#22010</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li>
<li>Record workspace-member dependency-group Python requirements in
lockfiles (<a
href="https://redirect.github.com/astral-sh/uv/pull/22044">#22044</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li>
<li>Record default groups for non-project workspace roots in lockfiles
(<a
href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li>
<li>Record dependency-group Python requirements for non-project
workspace roots in lockfiles (<a
href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li>
<li>Format URLs and paths consistently in CLI messages (<a
href="https://redirect.github.com/astral-sh/uv/pull/21937">#21937</a>)</li>
<li>Hide the unsupported <code>--offline</code> option from <code>uv
publish</code> help (<a
href="https://redirect.github.com/astral-sh/uv/pull/22124">#22124</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Honor <code>--no-default-groups</code> in <code>uv audit</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22090">#22090</a>)</li>
<li>Report a clear error when <code>uv audit</code> or <code>uv tool
audit</code> runs offline and hide the unsupported option from help (<a
href="https://redirect.github.com/astral-sh/uv/pull/22114">#22114</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Add <code>UV_PYTHON_ARCH</code> to select an interpreter
architecture independently of its Python version (<a
href="https://redirect.github.com/astral-sh/uv/pull/22098">#22098</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Reduce uv's binary size by compressing embedded Python download
metadata (<a
href="https://redirect.github.com/astral-sh/uv/pull/22126">#22126</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Verify unchanged requirements against existing lockfile hashes when
relocking (<a
href="https://redirect.github.com/astral-sh/uv/pull/22083">#22083</a>)</li>
<li>Honor dependency-group Python requirements at non-project workspace
roots (<a
href="https://redirect.github.com/astral-sh/uv/pull/22101">#22101</a>)</li>
<li>Use each selected workspace member's recorded default groups during
frozen sync (<a
href="https://redirect.github.com/astral-sh/uv/pull/22015">#22015</a>)</li>
<li>Avoid false entry-point warnings for required workspace members (<a
href="https://redirect.github.com/astral-sh/uv/pull/22112">#22112</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Raise the minimum supported Rust version for building uv to 1.97 and
update the toolchain to Rust 1.99 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22121">#22121</a>)</li>
</ul>
<h2>Install uv 0.12.22</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/uv/releases/download/0.12.22/uv-installer.sh
| sh
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's
changelog</a>.</em></p>
<blockquote>
<h2>0.12.22</h2>
<p>Released on 2026-10-01.</p>
<h3>Python</h3>
<ul>
<li>Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22147">#22147</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Accept uppercase release suffixes in wheel platform tags (<a
href="https://redirect.github.com/astral-sh/uv/pull/22113">#22113</a>)</li>
<li>Record workspace-member default groups in lockfiles (<a
href="https://redirect.github.com/astral-sh/uv/pull/22010">#22010</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li>
<li>Record workspace-member dependency-group Python requirements in
lockfiles (<a
href="https://redirect.github.com/astral-sh/uv/pull/22044">#22044</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li>
<li>Record default groups for non-project workspace roots in lockfiles
(<a
href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li>
<li>Record dependency-group Python requirements for non-project
workspace roots in lockfiles (<a
href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li>
<li>Format URLs and paths consistently in CLI messages (<a
href="https://redirect.github.com/astral-sh/uv/pull/21937">#21937</a>)</li>
<li>Hide the unsupported <code>--offline</code> option from <code>uv
publish</code> help (<a
href="https://redirect.github.com/astral-sh/uv/pull/22124">#22124</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Honor <code>--no-default-groups</code> in <code>uv audit</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22090">#22090</a>)</li>
<li>Report a clear error when <code>uv audit</code> or <code>uv tool
audit</code> runs offline and hide the unsupported option from help (<a
href="https://redirect.github.com/astral-sh/uv/pull/22114">#22114</a>)</li>
</ul>
<h3>Configuration</h3>
<ul>
<li>Add <code>UV_PYTHON_ARCH</code> to select an interpreter
architecture independently of its Python version (<a
href="https://redirect.github.com/astral-sh/uv/pull/22098">#22098</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Reduce uv's binary size by compressing embedded Python download
metadata (<a
href="https://redirect.github.com/astral-sh/uv/pull/22126">#22126</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Verify unchanged requirements against existing lockfile hashes when
relocking (<a
href="https://redirect.github.com/astral-sh/uv/pull/22083">#22083</a>)</li>
<li>Honor dependency-group Python requirements at non-project workspace
roots (<a
href="https://redirect.github.com/astral-sh/uv/pull/22101">#22101</a>)</li>
<li>Use each selected workspace member's recorded default groups during
frozen sync (<a
href="https://redirect.github.com/astral-sh/uv/pull/22015">#22015</a>)</li>
<li>Avoid false entry-point warnings for required workspace members (<a
href="https://redirect.github.com/astral-sh/uv/pull/22112">#22112</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Raise the minimum supported Rust version for building uv to 1.97 and
update the toolchain to Rust 1.99 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22121">#22121</a>)</li>
</ul>
<h2>0.12.21</h2>
<p>Released on 2026-09-29.</p>
<h3>Python</h3>
<ul>
<li>Update CPython to use OpenSSL 3.5.9 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22076">#22076</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/70fe1196a546e49148a73b1c592b2f74c33af80e"><code>70fe119</code></a>
Bump version to 0.12.22 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22148">#22148</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/7e9d252e37065168cd3ed8419bb31da512133604"><code>7e9d252</code></a>
Sync latest Python releases (<a
href="https://redirect.github.com/astral-sh/uv/issues/22147">#22147</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/d644be28bdb7820055801b9796e56b553cfd513c"><code>d644be2</code></a>
Compress embedded Python download metadata (<a
href="https://redirect.github.com/astral-sh/uv/issues/22126">#22126</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/0a41ee38ec6009877a77702265bcd18ceeece5ef"><code>0a41ee3</code></a>
Benchmark Python download catalog loading (<a
href="https://redirect.github.com/astral-sh/uv/issues/22125">#22125</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/cbf610678ba180054ce502ba803bc4403fac630e"><code>cbf6106</code></a>
Use Cargo warning policy for Clippy (<a
href="https://redirect.github.com/astral-sh/uv/issues/22122">#22122</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/60776645b718e5141a6969922c4d027008a9c2b9"><code>6077664</code></a>
Update Rust to 1.99 and MSRV to 1.97 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22121">#22121</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/69025fdd3b437447909dcf71e8e751652873b1b9"><code>69025fd</code></a>
Hide the <code>--offline</code> flag in <code>uv publish</code> (<a
href="https://redirect.github.com/astral-sh/uv/issues/22124">#22124</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/3f70ccf04396802654de142c40925bdad39311e9"><code>3f70ccf</code></a>
Defer cache format changes to 0.13 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22128">#22128</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/e71ab8f9b46398cc2d73f866dd4d1776e9969953"><code>e71ab8f</code></a>
Add <code>UV_PYTHON_ARCH</code> for requesting an interpreter
architecture (<a
href="https://redirect.github.com/astral-sh/uv/issues/22098">#22098</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/d62a205c091f12a90db2c77f596b3a53bca22051"><code>d62a205</code></a>
Hide the <code>--offline</code> flag for uv audit (<a
href="https://redirect.github.com/astral-sh/uv/issues/22114">#22114</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.12.19...0.12.22">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/uv&package-manager=docker&previous-version=0.12.19&new-version=0.12.22)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-02 22:38:05 -04:00
dependabot[bot] 3d85b610c0 build(deps): bump the npm-deps group in /src/frontend with 8 updates (#1414) 
Bumps the npm-deps group in /src/frontend with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [socket.io-client](https://github.com/socketio/socket.io) | `4.8.3` |
`4.8.4` |
|
[@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node)
| `26.6.2` | `26.6.3` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) |
`6.37.0` | `6.38.0` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) |
`0.70.0` | `0.71.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.85.0` | `1.86.0` |
| [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) |
`7.0.2002` | `7.0.2003` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) |
`8.3.0` | `8.3.1` |
|
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)
| `5.0.1` | `5.0.2` |

Updates `socket.io-client` from 4.8.3 to 4.8.4
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/socketio/socket.io/releases">socket.io-client's
releases</a>.</em></p>
<blockquote>
<h2>socket.io-client@4.8.4</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>types:</strong> export ExtendedError for connect_error event
(<a
href="https://redirect.github.com/socketio/socket.io/issues/5548">#5548</a>)
(<a
href="https://github.com/socketio/socket.io/commit/c0d54509fbe7dafd3ed8b5a2f3f74a12810da4a3">c0d5450</a>)</li>
<li><strong>types:</strong> export reserved event interfaces (<a
href="https://redirect.github.com/socketio/socket.io/issues/5533">#5533</a>)
(<a
href="https://github.com/socketio/socket.io/commit/03945df6b750dfa6379305ef29ea4235a424ca47">03945df</a>)</li>
</ul>
<h3>Dependencies</h3>
<ul>
<li><a
href="https://github.com/socketio/socket.io/releases/tag/engine.io-client%406.6.7"><code>engine.io-client@~6.6.1</code></a>
(no change)</li>
<li><a
href="https://github.com/websockets/ws/releases/tag/8.21.0"><code>ws@~8.21.0</code></a>
(<a
href="https://github.com/websockets/ws/compare/8.18.3...8.21.0">diff</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/socketio/socket.io/commit/11a6f561a757264c3231c3383c4cdbf37bcf52de"><code>11a6f56</code></a>
chore(release): socket.io-client@4.8.4</li>
<li><a
href="https://github.com/socketio/socket.io/commit/00e4e73a68505ff0c93d7d9ca8db5dd510428cf4"><code>00e4e73</code></a>
chore(release): engine.io-client@6.6.7</li>
<li><a
href="https://github.com/socketio/socket.io/commit/e387ab116f6904537ccef872ef570a6ef7936e9d"><code>e387ab1</code></a>
chore: use <code>@​rollup/plugin-terser</code> instead of
rollup-plugin-terser</li>
<li><a
href="https://github.com/socketio/socket.io/commit/973833304c7c195c2d0d99b72e4ac9f149e3ca94"><code>9738333</code></a>
chore(release): engine.io@6.6.11</li>
<li><a
href="https://github.com/socketio/socket.io/commit/fc9dd90e2ff26aa358d0cd27bc59ddc93458ae44"><code>fc9dd90</code></a>
docs(eio): rework README</li>
<li><a
href="https://github.com/socketio/socket.io/commit/da008a514ded71e3058a964c831c69abe417b2f5"><code>da008a5</code></a>
fix(eio): refresh ping timeout on incoming packets</li>
<li><a
href="https://github.com/socketio/socket.io/commit/3df3fed075fd2312e84481786235aa14d08b8fe7"><code>3df3fed</code></a>
fix(eio-client): restore default transport resolution</li>
<li><a
href="https://github.com/socketio/socket.io/commit/aaf2af36ec8ad05910f357a788e0e358bad32738"><code>aaf2af3</code></a>
test: upgrade WebdriverIO to v9</li>
<li><a
href="https://github.com/socketio/socket.io/commit/b5da079228666fcabd97166486d5f6a110826bc8"><code>b5da079</code></a>
refactor(sio): simplify packet handling switch</li>
<li><a
href="https://github.com/socketio/socket.io/commit/45873ca93e6e25ac55dc1ba5c9b87853bf19ffba"><code>45873ca</code></a>
docs(protocol): clarify namespace comma restriction for built-in parser
(<a
href="https://redirect.github.com/socketio/socket.io/issues/5545">#5545</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/socketio/socket.io/compare/socket.io-client@4.8.3...socket.io-client@4.8.4">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/node` from 26.6.2 to 26.6.3
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare
view</a></li>
</ul>
</details>
<br />

Updates `knip` from 6.37.0 to 6.38.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webpro-nl/knip/releases">knip's
releases</a>.</em></p>
<blockquote>
<h2>Release 6.38.0</h2>
<ul>
<li>Include co-authors in docs contributor list
(0c334100df59d89a512ad598ec50e7f62f6da0c3)</li>
<li>Filter bots and agents from docs contributors
(617f70d8179c6b8668ca41fe5df77ced5e2b37c0)</li>
<li>Update Eve plugin conventions (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2049">#2049</a>)
(260dbb91a85f3a3bc2727e8f255d73df3737552c) - thanks <a
href="https://github.com/matchai"><code>@​matchai</code></a>!</li>
<li>Add <code>args</code> example to that doc page
(50b271b98fc930a05a3b045a2f691486f9f06528)</li>
<li>Add Turborepo plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2055">#2055</a>)
(e49d3db05f1d69ce7db3efcb8467a4af63c27379) - thanks <a
href="https://github.com/changbaebang"><code>@​changbaebang</code></a>!</li>
<li>Support <code>import-x/*</code> settings in ESLint plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2050">#2050</a>)
(1a34cf82a3d6a1202717ef910bedba55838e9dd9) - thanks <a
href="https://github.com/bytedoe"><code>@​bytedoe</code></a>!</li>
<li>Resolve file option in Mocha configuration files (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2051">#2051</a>)
(9b5c5f60468c8a92a3e74adca5c0931f008677af) - thanks <a
href="https://github.com/giaBaoJS"><code>@​giaBaoJS</code></a>!</li>
<li>Support oxlint extends (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2054">#2054</a>)
(a149a98219bb14b15f446fc5f8c4f815e28b2183) - thanks <a
href="https://github.com/matthewnitschke-wk"><code>@​matthewnitschke-wk</code></a>!</li>
<li>Fix import.meta handling in built-in compilers (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2059">#2059</a>)
(8b0c85076bf3dce15ef5f3c0c4e58bfefdf59ded) - thanks <a
href="https://github.com/vdavid"><code>@​vdavid</code></a>!</li>
<li>Fix tag hints for enum and namespace members (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2061">#2061</a>)
(8a8805e48945863248429d18b7f6c4e4b7dc9ebd) - thanks <a
href="https://github.com/devYRPauli"><code>@​devYRPauli</code></a>!</li>
<li>Flag unused member tags in tagged enums and namespaces
(584e53ff3e0846fbfe04fa5b5bfefe2420576a34)</li>
<li>feat: resolve MDX content mapper remarkPlugins (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2060">#2060</a>)
(34dbccf25359f9e9fefe9d0be6ef2ec0252223cc) - thanks <a
href="https://github.com/gioboa"><code>@​gioboa</code></a>!</li>
<li>Refactor and separate concerns w/ new typescript-content-mapper
plugin (11e94509bd0f350d747facf4003fc5b248d1b02d)</li>
<li>Resolve mdx content mapper providerImportSource
(7b5825117f97f2f87b7141509a254f88d0957cf7)</li>
<li>Fix config → entry in plop plugin
(25a380c9e1165b76583d69b48b5fa7cdf5db0ae2)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/webpro-nl/knip/commit/c0e42f83bda7664065465f2f3faca7af97c988ac"><code>c0e42f8</code></a>
Release knip@6.38.0</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/25a380c9e1165b76583d69b48b5fa7cdf5db0ae2"><code>25a380c</code></a>
Fix config → entry in plop plugin</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/7b5825117f97f2f87b7141509a254f88d0957cf7"><code>7b58251</code></a>
Resolve mdx content mapper providerImportSource</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/11e94509bd0f350d747facf4003fc5b248d1b02d"><code>11e9450</code></a>
Refactor and separate concerns w/ new typescript-content-mapper
plugin</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/34dbccf25359f9e9fefe9d0be6ef2ec0252223cc"><code>34dbccf</code></a>
feat: resolve MDX content mapper remarkPlugins (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2060">#2060</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/584e53ff3e0846fbfe04fa5b5bfefe2420576a34"><code>584e53f</code></a>
Flag unused member tags in tagged enums and namespaces</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/8a8805e48945863248429d18b7f6c4e4b7dc9ebd"><code>8a8805e</code></a>
Fix tag hints for enum and namespace members (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2061">#2061</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/8b0c85076bf3dce15ef5f3c0c4e58bfefdf59ded"><code>8b0c850</code></a>
Fix import.meta handling in built-in compilers (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2059">#2059</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/a149a98219bb14b15f446fc5f8c4f815e28b2183"><code>a149a98</code></a>
Support oxlint extends (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2054">#2054</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/9b5c5f60468c8a92a3e74adca5c0931f008677af"><code>9b5c5f6</code></a>
Resolve file option in Mocha configuration files (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2051">#2051</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/webpro-nl/knip/commits/knip@6.38.0/packages/knip">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxfmt` from 0.70.0 to 0.71.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxfmt's
releases</a>.</em></p>
<blockquote>
<h2>oxfmt v0.71.0</h2>
<h3>🚀 Features</h3>
<ul>
<li>e0b1f9f oxfmt: Bump bundled Prettier version to 3.9.9 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27002">#27002</a>)
(leaysgur)</li>
<li>342527d oxfmt: Bump bundled Prettier version to 3.9.8 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26999">#26999</a>)
(leaysgur)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>eeba1db formatter: Skip test-call layout when arguments have
comments (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27119">#27119</a>)
(leaysgur)</li>
<li>1f7b8ad oxfmt: Allow repeated CLI calls in the same process (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27051">#27051</a>)
(Liang)</li>
<li>7bcb807 formatter_markdown: Keep blank line between HTML and nested
list (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27112">#27112</a>)
(leaysgur)</li>
<li>10b10c5 formatter: Keep comments around <code>=</code> on their side
and line (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27041">#27041</a>)
(leaysgur)</li>
<li>9aad365 formatter: Keep comments deferred before an assignment
operator (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26997">#26997</a>)
(waltu)</li>
<li>8fbddb1 formatter/jsdoc: More alignment with original plugin (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27039">#27039</a>)
(leaysgur)</li>
<li>50be18e formatter: Keep trailing spaces on normal block comments (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27037">#27037</a>)
(leaysgur)</li>
<li>56d1880 formatter: Nestle adjacent block comments (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27036">#27036</a>)
(leaysgur)</li>
<li>3be5d94 formatter: Treat <code>/***</code> comments as JSDoc (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27035">#27035</a>)
(leaysgur)</li>
<li>cd45f71 formatter: Keep trailing double spaces on JSDoc lines (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26861">#26861</a>)
(John Costa)</li>
<li>fd695f4 formatter_markdown: Fix more mismatches found in
ecosystem-ci repos (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27003">#27003</a>)
(leaysgur)</li>
<li>4e77d59 formatter_markdown: Keep a math span after a kept line break
from opening a block (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27001">#27001</a>)
(leaysgur)</li>
<li>584b8b0 formatter_markdown: Keep a shape line after a multi-line
inline node or link title (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27000">#27000</a>)
(leaysgur)</li>
<li>b939645 formatter_markdown: Keep a line break before an inline
liquid tag under preserve (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26998">#26998</a>)
(leaysgur)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/2ae2939bb2fd98796393658b21556b2a2467e047"><code>2ae2939</code></a>
release(apps): oxlint v1.86.0 &amp;&amp; oxfmt v0.71.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27132">#27132</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/f158bff061a59d776fd695e4baf7f7497f895612"><code>f158bff</code></a>
chore(deps): update npm packages (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26865">#26865</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.71.0/npm/oxfmt">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.85.0 to 1.86.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.86.0</h2>
<h3>🚀 Features</h3>
<ul>
<li>9d80eed linter/react/only-export-components: Support
<code>allowCompoundComponents</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27117">#27117</a>)
(Kuroda Kayn)</li>
<li>e05b155 linter: Add typescript/no-generated-empty-object-type (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26958">#26958</a>)
(camc314)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>8306aa4
linter/typescript/no-unnecessary-parameter-property-assignment: Account
for parameter property reassignment (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26955">#26955</a>)
(camc314)</li>
<li>42dfbb5 linter/eslint/one-var: Keep <code>declare</code> when
splitting declarations (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27081">#27081</a>)
(Cheolhee Lee)</li>
<li>2ba7e33 linter/eslint/require-await: Count <code>await using</code>
as an await (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27080">#27080</a>)
(Cheolhee Lee)</li>
<li>611e4ed linter/plugins: Include executing selectors in JS plugin
rule timings (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27111">#27111</a>)
(overlookmotel)</li>
<li>2cac66f react-compiler: Handle recursive function expressions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26796">#26796</a>)
(Brennan Butler)</li>
<li>e996e6c react-compiler: Treat zero-argument new Date as impure (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26894">#26894</a>)
(Boshen)</li>
<li>571cfa3 oxlint: Skip type-aware lint rules in type-check-only mode
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27076">#27076</a>)
(camc314)</li>
<li>d0b2462 oxlint: Skip undefined children in CFG walker (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27075">#27075</a>)
(camc314)</li>
<li>5186328 parser: Handle HTML comment values (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/22933">#22933</a>)
(Boshen)</li>
<li>0b630e8 linter/typescript/unified-signatures: Align rule with
upstream (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26956">#26956</a>)
(camc314)</li>
<li>ebb22f1 linter/node/no-exports-assign: Change category from style to
suspicious (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26555">#26555</a>)
(Bartok)</li>
<li>cce28a0 linter/import/no-duplicates: Distinguish import attributes
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26936">#26936</a>)
(camc314)</li>
<li>feb733b linter/unicorn/prefer-spread: Stop checking string split
calls (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26935">#26935</a>)
(camc314)</li>
<li>929e154 linter/eslint/no-unused-vars: Honor ignore patterns inside
array rest bindings (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26923">#26923</a>)
(camc314)</li>
<li>5bdb9b8 linter/eslint/no-unused-vars: Recognize consumed update
expressions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26782">#26782</a>)
(camc314)</li>
<li>5c05bef linter/eslint/prefer-const: Ignore embedded assignments (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26920">#26920</a>)
(camc314)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>ded4c29 linter/eslint/no-unused-vars: Skip sequence checks when
absent (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26921">#26921</a>)
(camc314)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.86.0] - 2026-09-28</h2>
<h3>🚀 Features</h3>
<ul>
<li>9d80eed linter/react/only-export-components: Support
<code>allowCompoundComponents</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27117">#27117</a>)
(Kuroda Kayn)</li>
<li>e05b155 linter: Add typescript/no-generated-empty-object-type (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26958">#26958</a>)
(camc314)</li>
</ul>
<h2>[1.82.0] - 2026-09-07</h2>
<h3>🚀 Features</h3>
<ul>
<li>6a0e19c linter/eslint/no-unmodified-loop-condition: Support
<code>checkConditionalExpressions</code> option (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26249">#26249</a>)
(camc314)</li>
</ul>
<h2>[1.81.0] - 2026-08-31</h2>
<h3>📚 Documentation</h3>
<ul>
<li>d5be037 linter/typescript/switch-exhaustiveness-check: Clarify
default case comment pattern (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26100">#26100</a>)
(camc314)</li>
</ul>
<h2>[1.79.0] - 2026-08-18</h2>
<h3>💥 BREAKING CHANGES</h3>
<ul>
<li>8c4552d linter: [<strong>BREAKING</strong>] Split
react/react-compiler into per-category rules (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25500">#25500</a>)
(Boshen)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>228e8e0 linter: Resolve inactive React compiler rules (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25830">#25830</a>)
(Boshen)</li>
<li>aa49d86 linter: Allow spread rule options in config types (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25675">#25675</a>)
(ch3rry)</li>
<li>36f8451 linter/eslint/no-eval: Align indirect default with ESLint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25656">#25656</a>)
(camc314)</li>
<li>beb724d linter/eslint/no-unused-vars: Report bare underscore
parameters (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25663">#25663</a>)
(camc314)</li>
<li>4004c10 linter/eslint/no-irregular-whitespace: Check comments by
default (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25660">#25660</a>)
(camc314)</li>
<li>285820e linter/no-large-snapshots: Precompile and document allowed
snapshot matchers (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25611">#25611</a>)
(Mikhail Baev)</li>
<li>4df5835 linter: Allow capitalized built-in calls (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25516">#25516</a>)
(Boshen)</li>
</ul>
<h2>[1.78.0] - 2026-08-10</h2>
<h3>🚀 Features</h3>
<ul>
<li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)
(Mikhail Baev)</li>
<li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)
(Cole Ellison)</li>
<li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match
eslint (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)
(Cole Ellison)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>9573937 linter/typescript: Validate <code>ban-ts-comment</code>
description_format (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)
(Mikhail Baev)</li>
</ul>
<h2>[1.77.0] - 2026-08-03</h2>
<h3>🐛 Bug Fixes</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/2ae2939bb2fd98796393658b21556b2a2467e047"><code>2ae2939</code></a>
release(apps): oxlint v1.86.0 &amp;&amp; oxfmt v0.71.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27132">#27132</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9d80eeddbd1d84032e258cc3662182b7649b4161"><code>9d80eed</code></a>
feat(linter/react/only-export-components): support
<code>allowCompoundComponents</code> ...</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/e05b155a6d1e7467f58225628705573c34d3cded"><code>e05b155</code></a>
feat(linter): add typescript/no-generated-empty-object-type (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26958">#26958</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/88a009621499725d891780b04c41f23ebba09f30"><code>88a0096</code></a>
chore(oxlint): require tsgolint 7.0.2003 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27021">#27021</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.86.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint-tsgolint` from 7.0.2002 to 7.0.2003
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/tsgolint/releases">oxlint-tsgolint's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.2003</h2>
<h2>What's Changed</h2>
<ul>
<li>docs: update agent development instructions by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1210">oxc-project/tsgolint#1210</a></li>
<li>docs: refresh README benchmarks and wording by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1208">oxc-project/tsgolint#1208</a></li>
<li>chore(deps): update crate-ci/typos action to v1.50.2 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1213">oxc-project/tsgolint#1213</a></li>
<li>chore(deps): update taiki-e/install-action action to v2.87.14 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1216">oxc-project/tsgolint#1216</a></li>
<li>chore(deps): update dependency dprint-json to v0.24.0 by <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in
<a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1217">oxc-project/tsgolint#1217</a></li>
<li>feat(no-unnecessary-condition): implement suggestion by <a
href="https://github.com/baevm"><code>@​baevm</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1218">oxc-project/tsgolint#1218</a></li>
<li>fix(require-array-sort-compare): resolve string element constraints
by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1219">oxc-project/tsgolint#1219</a></li>
<li>fix(no-duplicate-type-constituents): allow undefined on optional
parameter properties by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1222">oxc-project/tsgolint#1222</a></li>
<li>test(no-unnecessary-type-assertion): cover Record alias assertions
by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1226">oxc-project/tsgolint#1226</a></li>
<li>fix(no-misused-spread): omit invalid WeakMap suggestions by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1227">oxc-project/tsgolint#1227</a></li>
<li>fix(no-meaningless-void-operator): allow void on assignments by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1228">oxc-project/tsgolint#1228</a></li>
<li>feat: add no-generated-empty-object-type rule by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1229">oxc-project/tsgolint#1229</a></li>
<li>fix(no-useless-default-assignment): use suggestions for undefined
defaults by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1231">oxc-project/tsgolint#1231</a></li>
<li>fix(unbound-method): treat Intl.Collator compare as bound by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1224">oxc-project/tsgolint#1224</a></li>
<li>fix(no-unnecessary-type-parameters): preserve suggestion type
precedence by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1232">oxc-project/tsgolint#1232</a></li>
<li>fix(no-unnecessary-condition): handle union keys in nullish
assignment by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1230">oxc-project/tsgolint#1230</a></li>
<li>fix: preserve expression syntax when removing await by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1233">oxc-project/tsgolint#1233</a></li>
<li>fix: match package specifiers on whole path components by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1225">oxc-project/tsgolint#1225</a></li>
<li>fix(no-useless-default-assignment): handle tuples with rest elements
by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1223">oxc-project/tsgolint#1223</a></li>
<li>fix(no-deprecated): detect deprecated aliases in object shorthand by
<a href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1235">oxc-project/tsgolint#1235</a></li>
<li>fix(no-unnecessary-condition): check nested logical expressions in
truthiness contexts by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1236">oxc-project/tsgolint#1236</a></li>
<li>perf: avoid singleton union type allocations in hot rules by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1237">oxc-project/tsgolint#1237</a></li>
<li>perf: speed up headless file-to-program assignment by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1239">oxc-project/tsgolint#1239</a></li>
<li>perf(no-unnecessary-type-assertion): reject incompatible types first
by <a href="https://github.com/tony-scio"><code>@​tony-scio</code></a>
in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1181">oxc-project/tsgolint#1181</a></li>
<li>refactor: extract checker workload scheduling by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1241">oxc-project/tsgolint#1241</a></li>
<li>perf: add experimental checker scheduling modes by <a
href="https://github.com/camc314"><code>@​camc314</code></a> in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1240">oxc-project/tsgolint#1240</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/baevm"><code>@​baevm</code></a> made
their first contribution in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1218">oxc-project/tsgolint#1218</a></li>
<li><a href="https://github.com/tony-scio"><code>@​tony-scio</code></a>
made their first contribution in <a
href="https://redirect.github.com/oxc-project/tsgolint/pull/1181">oxc-project/tsgolint#1181</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/oxc-project/tsgolint/compare/v7.0.2002...v7.0.2003">https://github.com/oxc-project/tsgolint/compare/v7.0.2002...v7.0.2003</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/eb9339115edde6811ca94c3433adf69ea9852880"><code>eb93391</code></a>
perf: add experimental checker scheduling modes (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1240">#1240</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/e3a79a5e04df2400066bbf3abcb707443652e5b1"><code>e3a79a5</code></a>
refactor: extract checker workload scheduling (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1241">#1241</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/1fdaa0db360f7e29209805389cd81fd11e56d74f"><code>1fdaa0d</code></a>
perf(no-unnecessary-type-assertion): reject incompatible types first (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1181">#1181</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/364b23979e1189a760799738dadc59212e35e899"><code>364b239</code></a>
perf: speed up headless file-to-program assignment (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1239">#1239</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/52500be212366860eb56155f6c3b7448feb4c140"><code>52500be</code></a>
perf: avoid singleton union type allocations in hot rules (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1237">#1237</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/22b148ad8f78fa2e444bdd6553ae251c6b7d2f6b"><code>22b148a</code></a>
fix(no-unnecessary-condition): check nested logical expressions in
truthiness...</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/356609fdb6c2f118b6e4be22728505631deee5e2"><code>356609f</code></a>
fix(no-deprecated): detect deprecated aliases in object shorthand (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1235">#1235</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/cbf39090fe63bed4a7283989995ea4fbf478ee46"><code>cbf3909</code></a>
fix(no-useless-default-assignment): handle tuples with rest elements (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1223">#1223</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/7bd5c1180dd1d0ab13b7ed8a5dc5064bba204724"><code>7bd5c11</code></a>
fix: match package specifiers on whole path components (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1225">#1225</a>)</li>
<li><a
href="https://github.com/oxc-project/tsgolint/commit/6f2588382b3f039a6a020020c282117260938e44"><code>6f25883</code></a>
fix: preserve expression syntax when removing await (<a
href="https://redirect.github.com/oxc-project/tsgolint/issues/1233">#1233</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/oxc-project/tsgolint/compare/v7.0.2002...v7.0.2003">compare
view</a></li>
</ul>
</details>
<br />

Updates `vite` from 8.3.0 to 8.3.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v8.3.1</h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23482">#23482</a>)
(<a
href="https://github.com/vitejs/vite/commit/3c752c8932bc0599465ba4a6d8f44aaf1e934c3d">3c752c8</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23537">#23537</a>)
(<a
href="https://github.com/vitejs/vite/commit/e8990c4d6101dfaca2654ed8ab4d0574ee920248">e8990c4</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23483">#23483</a>)
(<a
href="https://github.com/vitejs/vite/commit/9aecbbfa5fb5da4b9981c099cb9746a9fd210806">9aecbbf</a>)</li>
<li>handle <code>server.ws: false</code> in mergeConfig (<a
href="https://redirect.github.com/vitejs/vite/issues/23511">#23511</a>)
(<a
href="https://github.com/vitejs/vite/commit/f68c0d5a28c96555431413e3e2cbe644337b087f">f68c0d5</a>)</li>
<li>merge <code>build.rolldownOptions.output.comments</code> correctly
(<a
href="https://redirect.github.com/vitejs/vite/issues/23514">#23514</a>)
(<a
href="https://github.com/vitejs/vite/commit/4aba8d8720e82e4c5b694a4b7877755a3f84fc57">4aba8d8</a>)</li>
<li><strong>optimizer:</strong> don't skip imports whose binding starts
with type (<a
href="https://redirect.github.com/vitejs/vite/issues/23540">#23540</a>)
(<a
href="https://github.com/vitejs/vite/commit/39330f489a0ae08923557f0ce10a307d6662a3f5">39330f4</a>)</li>
<li><strong>optimizer:</strong> resolve pending discovered dep
processing on close before init (<a
href="https://redirect.github.com/vitejs/vite/issues/23567">#23567</a>)
(<a
href="https://github.com/vitejs/vite/commit/5f894339d27882fedc86bf6b1076fa6d92e404f3">5f89433</a>)</li>
<li><strong>server:</strong> avoid reinitializing watcher when adding
file after server close (<a
href="https://redirect.github.com/vitejs/vite/issues/23572">#23572</a>)
(<a
href="https://github.com/vitejs/vite/commit/6f831f9b58ebda77638b514042ad8d160edfb928">6f831f9</a>)</li>
<li><strong>sourcemap:</strong> skip URL source roots when injecting
sources content (<a
href="https://redirect.github.com/vitejs/vite/issues/23519">#23519</a>)
(<a
href="https://github.com/vitejs/vite/commit/04fc30a4b91870e65a436b3420620a2e02a94a41">04fc30a</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li>merge prereleases in changelog (<a
href="https://redirect.github.com/vitejs/vite/issues/23466">#23466</a>)
(<a
href="https://github.com/vitejs/vite/commit/99bd9d1d46153fa939f4a304cc0177db42e28776">99bd9d1</a>)</li>
<li><strong>optimizer:</strong> add debug log when waiting for dep
before init (<a
href="https://redirect.github.com/vitejs/vite/issues/23566">#23566</a>)
(<a
href="https://github.com/vitejs/vite/commit/63567c73ac132e6384fef384e6b9f7e8d5a37fff">63567c7</a>)</li>
<li>update <code>optimizeDeps.include</code> comment (<a
href="https://redirect.github.com/vitejs/vite/issues/23489">#23489</a>)
(<a
href="https://github.com/vitejs/vite/commit/6a84c72100da4e4be4badb2d9a0026279b4df136">6a84c72</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li>assets regexp use non-capture (<a
href="https://redirect.github.com/vitejs/vite/issues/23491">#23491</a>)
(<a
href="https://github.com/vitejs/vite/commit/f4b4431a2f9097fd9bbb7aaebbf1b63c4b54dea1">f4b4431</a>)</li>
<li>remove duplicate configurations (<a
href="https://redirect.github.com/vitejs/vite/issues/23532">#23532</a>)
(<a
href="https://github.com/vitejs/vite/commit/9abd99bfdd3117149d6faf87fc37bc9899b1c998">9abd99b</a>)</li>
<li>replace <code>find</code> with <code>some</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23554">#23554</a>)
(<a
href="https://github.com/vitejs/vite/commit/af7cdf6964f124f58d66037e808fe687654948e2">af7cdf6</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v8.3.0...v8.3.1">8.3.1</a>
(2026-09-24)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23482">#23482</a>)
(<a
href="https://github.com/vitejs/vite/commit/3c752c8932bc0599465ba4a6d8f44aaf1e934c3d">3c752c8</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23537">#23537</a>)
(<a
href="https://github.com/vitejs/vite/commit/e8990c4d6101dfaca2654ed8ab4d0574ee920248">e8990c4</a>)</li>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/23483">#23483</a>)
(<a
href="https://github.com/vitejs/vite/commit/9aecbbfa5fb5da4b9981c099cb9746a9fd210806">9aecbbf</a>)</li>
<li>handle <code>server.ws: false</code> in mergeConfig (<a
href="https://redirect.github.com/vitejs/vite/issues/23511">#23511</a>)
(<a
href="https://github.com/vitejs/vite/commit/f68c0d5a28c96555431413e3e2cbe644337b087f">f68c0d5</a>)</li>
<li>merge <code>build.rolldownOptions.output.comments</code> correctly
(<a
href="https://redirect.github.com/vitejs/vite/issues/23514">#23514</a>)
(<a
href="https://github.com/vitejs/vite/commit/4aba8d8720e82e4c5b694a4b7877755a3f84fc57">4aba8d8</a>)</li>
<li><strong>optimizer:</strong> don't skip imports whose binding starts
with type (<a
href="https://redirect.github.com/vitejs/vite/issues/23540">#23540</a>)
(<a
href="https://github.com/vitejs/vite/commit/39330f489a0ae08923557f0ce10a307d6662a3f5">39330f4</a>)</li>
<li><strong>optimizer:</strong> resolve pending discovered dep
processing on close before init (<a
href="https://redirect.github.com/vitejs/vite/issues/23567">#23567</a>)
(<a
href="https://github.com/vitejs/vite/commit/5f894339d27882fedc86bf6b1076fa6d92e404f3">5f89433</a>)</li>
<li><strong>server:</strong> avoid reinitializing watcher when adding
file after server close (<a
href="https://redirect.github.com/vitejs/vite/issues/23572">#23572</a>)
(<a
href="https://github.com/vitejs/vite/commit/6f831f9b58ebda77638b514042ad8d160edfb928">6f831f9</a>)</li>
<li><strong>sourcemap:</strong> skip URL source roots when injecting
sources content (<a
href="https://redirect.github.com/vitejs/vite/issues/23519">#23519</a>)
(<a
href="https://github.com/vitejs/vite/commit/04fc30a4b91870e65a436b3420620a2e02a94a41">04fc30a</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li>merge prereleases in changelog (<a
href="https://redirect.github.com/vitejs/vite/issues/23466">#23466</a>)
(<a
href="https://github.com/vitejs/vite/commit/99bd9d1d46153fa939f4a304cc0177db42e28776">99bd9d1</a>)</li>
<li><strong>optimizer:</strong> add debug log when waiting for dep
before init (<a
href="https://redirect.github.com/vitejs/vite/issues/23566">#23566</a>)
(<a
href="https://github.com/vitejs/vite/commit/63567c73ac132e6384fef384e6b9f7e8d5a37fff">63567c7</a>)</li>
<li>update <code>optimizeDeps.include</code> comment (<a
href="https://redirect.github.com/vitejs/vite/issues/23489">#23489</a>)
(<a
href="https://github.com/vitejs/vite/commit/6a84c72100da4e4be4badb2d9a0026279b4df136">6a84c72</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li>assets regexp use non-capture (<a
href="https://redirect.github.com/vitejs/vite/issues/23491">#23491</a>)
(<a
href="https://github.com/vitejs/vite/commit/f4b4431a2f9097fd9bbb7aaebbf1b63c4b54dea1">f4b4431</a>)</li>
<li>remove duplicate configurations (<a
href="https://redirect.github.com/vitejs/vite/issues/23532">#23532</a>)
(<a
href="https://github.com/vitejs/vite/commit/9abd99bfdd3117149d6faf87fc37bc9899b1c998">9abd99b</a>)</li>
<li>replace <code>find</code> with <code>some</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/23554">#23554</a>)
(<a
href="https://github.com/vitejs/vite/commit/af7cdf6964f124f58d66037e808fe687654948e2">af7cdf6</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/39ddf7ccf7e7469ff6a3ba37bca38c32ea804d6e"><code>39ddf7c</code></a>
release: v8.3.1 (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23573">#23573</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/f68c0d5a28c96555431413e3e2cbe644337b087f"><code>f68c0d5</code></a>
fix: handle <code>server.ws: false</code> in mergeConfig (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23511">#23511</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/6f831f9b58ebda77638b514042ad8d160edfb928"><code>6f831f9</code></a>
fix(server): avoid reinitializing watcher when adding file after server
close...</li>
<li><a
href="https://github.com/vitejs/vite/commit/04fc30a4b91870e65a436b3420620a2e02a94a41"><code>04fc30a</code></a>
fix(sourcemap): skip URL source roots when injecting sources content (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23519">#23519</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/5f894339d27882fedc86bf6b1076fa6d92e404f3"><code>5f89433</code></a>
fix(optimizer): resolve pending discovered dep processing on close
before ini...</li>
<li><a
href="https://github.com/vitejs/vite/commit/63567c73ac132e6384fef384e6b9f7e8d5a37fff"><code>63567c7</code></a>
chore(optimizer): add debug log when waiting for dep before init (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23566">#23566</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/e8990c4d6101dfaca2654ed8ab4d0574ee920248"><code>e8990c4</code></a>
fix(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23537">#23537</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/af7cdf6964f124f58d66037e808fe687654948e2"><code>af7cdf6</code></a>
refactor: replace <code>find</code> with <code>some</code> (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23554">#23554</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/39330f489a0ae08923557f0ce10a307d6662a3f5"><code>39330f4</code></a>
fix(optimizer): don't skip imports whose binding starts with type (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23540">#23540</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/9abd99bfdd3117149d6faf87fc37bc9899b1c998"><code>9abd99b</code></a>
refactor: remove duplicate configurations (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23532">#23532</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v8.3.1/packages/vite">compare
view</a></li>
</ul>
</details>
<br />

Updates `vitest` from 5.0.1 to 5.0.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">vitest's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.2</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li>Bind <code>process</code> in case global is overwritten  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11343">vitest-dev/vitest#11343</a>
<a href="https://github.com/vitest-dev/vitest/commit/0b79231ad"><!-- raw
HTML omitted -->(0b792)<!-- raw HTML omitted --></a></li>
<li><strong>detect-async-leaks</strong>:
<ul>
<li>Ignore <code>process.stdio</code> handles  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11333">vitest-dev/vitest#11333</a>
<a href="https://github.com/vitest-dev/vitest/commit/0fd6b9790"><!-- raw
HTML omitted -->(0fd6b)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>expect</strong>:
<ul>
<li>Fix <code>toMatchObject</code> with asymmetric matchers  -  by <a
href="https://github.com/ShreeBohara"><code>@​ShreeBohara</code></a>,
<strong>Claude Opus 5</strong>, <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>Codex (GPT-5)</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11100">vitest-dev/vitest#11100</a>
<a href="https://github.com/vitest-dev/vitest/commit/42523289e"><!-- raw
HTML omitted -->(42523)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>jsdom</strong>:
<ul>
<li>Fix <code>Request</code> with <code>Blob</code> body on jsdom 28+
 -  by <a
href="https://github.com/harshit-d3v"><code>@​harshit-d3v</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11295">vitest-dev/vitest#11295</a>
<a href="https://github.com/vitest-dev/vitest/commit/d1c3ecc93"><!-- raw
HTML omitted -->(d1c3e)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>reporter</strong>:
<ul>
<li><code>agent</code> to respect <code>--silent</code>  -  by <a
href="https://github.com/Raj4478"><code>@​Raj4478</code></a> and <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11271">vitest-dev/vitest#11271</a>
<a href="https://github.com/vitest-dev/vitest/commit/5b95efb6d"><!-- raw
HTML omitted -->(5b95e)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>reporters</strong>:
<ul>
<li>Handle concurrent <code>createReport</code> calls  -  by <a
href="https://github.com/7rulnik"><code>@​7rulnik</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11278">vitest-dev/vitest#11278</a>
<a href="https://github.com/vitest-dev/vitest/commit/e8e556ff7"><!-- raw
HTML omitted -->(e8e55)<!-- raw HTML omitted --></a></li>
<li><code>hanging-process</code> to use ESM entrypoint  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11316">vitest-dev/vitest#11316</a>
<a href="https://github.com/vitest-dev/vitest/commit/4e91e5668"><!-- raw
HTML omitted -->(4e91e)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>spy</strong>:
<ul>
<li>Fix stack overflow when spying <code>Set.prototype.add</code>  -  by
<a href="https://github.com/fengmk2"><code>@​fengmk2</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11299">vitest-dev/vitest#11299</a>
<a href="https://github.com/vitest-dev/vitest/commit/a0a939653"><!-- raw
HTML omitted -->(a0a93)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>ui</strong>:
<ul>
<li>Persist authentication cookie beyond current browser session  -  by
<a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>OpenCode
(gpt-5.6-sol)</strong> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11066">vitest-dev/vitest#11066</a>
<a href="https://github.com/vitest-dev/vitest/commit/f88195e16"><!-- raw
HTML omitted -->(f8819)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5>    <a
href="https://github.com/vitest-dev/vitest/compare/v5.0.1...v5.0.2">View
changes on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/428e2e5043c64635b6b157358bde2fdeaa7b6b3a"><code>428e2e5</code></a>
chore: release v5.0.2 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11357">#11357</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/0b79231ad7897f03de17940ef16684b63aa217fe"><code>0b79231</code></a>
fix: bind <code>process</code> in case global is overwritten (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11343">#11343</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/597df569aba3e8b24c9ad231aacd3cf641ac3bdf"><code>597df56</code></a>
docs: correct stale config defaults (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11354">#11354</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/ea1c44fb581978421f9f0901ce8c635970ea72fb"><code>ea1c44f</code></a>
docs: <code>sequence.setupFiles</code> default is <code>'list'</code>
(<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11351">#11351</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/0fd6b97902bc828d489385e0a28b82515f57b7cf"><code>0fd6b97</code></a>
fix(detect-async-leaks): ignore <code>process.stdio</code> handles (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11333">#11333</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/4e91e56687de43427fbb664d86a63438ca73b681"><code>4e91e56</code></a>
fix(reporters): <code>hanging-process</code> to use ESM entrypoint (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11316">#11316</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/1a57929a49fb6fb2db02b47e56c4677ca5ae1704"><code>1a57929</code></a>
docs(browser): fix locators.exact default (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11338">#11338</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/5b95efb6dfe378dc6fc8380f5b1e96832f019a5d"><code>5b95efb</code></a>
fix(reporter): <code>agent</code> to respect <code>--silent</code> (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11271">#11271</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/f58a209779ffd3007006481d0c9da0099d5226e6"><code>f58a209</code></a>
docs: correct benchmark.exclude and watch defaults (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11268">#11268</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/d1c3ecc932dcb4cd50420c54aa1f7fa3051deac7"><code>d1c3ecc</code></a>
fix(jsdom): fix <code>Request</code> with <code>Blob</code> body on
jsdom 28+ (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11295">#11295</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitest-dev/vitest/commits/v5.0.2/packages/vitest">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-02 22:37:49 -04:00
dependabot[bot] b7d04a1c3e build(deps): bump the gh-actions group with 3 updates (#1415) 
Bumps the gh-actions group with 3 updates:
[github/codeql-action/init](https://github.com/github/codeql-action),
[github/codeql-action/autobuild](https://github.com/github/codeql-action)
and
[github/codeql-action/analyze](https://github.com/github/codeql-action).

Updates `github/codeql-action/init` from 4.38.1 to 4.38.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.38.2</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2"><code>2892aa5</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4168">#4168</a>
from github/update-v4.38.2-a6ef2c96f</li>
<li><a
href="https://github.com/github/codeql-action/commit/8ad03a333eb88de8ad6833eda208d0fc51a9c571"><code>8ad03a3</code></a>
Trigger workflows</li>
<li><a
href="https://github.com/github/codeql-action/commit/98af865db5041cee73c7185896319367f8c0adf2"><code>98af865</code></a>
Update changelog for v4.38.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/a6ef2c96fc0e37d0b44fb2bd0b32db4bcb89ae24"><code>a6ef2c9</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4156">#4156</a>
from github/mario-campos/fix-validate-cmd</li>
<li><a
href="https://github.com/github/codeql-action/commit/1ef28a1b7603ca158fd774d1ab328cbd6a40b84b"><code>1ef28a1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4166">#4166</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/26cb08bab0037de74cc66ad9ec0dca31d6d9e8a7"><code>26cb08b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4163">#4163</a>
from github/mbg/fix-getCommitOid-stubs</li>
<li><a
href="https://github.com/github/codeql-action/commit/f035ce3a985a1223a9f59fb719542598640160b2"><code>f035ce3</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4165">#4165</a>
from github/dependabot/npm_and_yarn/npm-minor-8eaed9...</li>
<li><a
href="https://github.com/github/codeql-action/commit/5e4e2550b48d7f3de205c9d752eb5176bf07f6d9"><code>5e4e255</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/b13f5f47d5398d0fb982942ced6fdfc4e3951804"><code>b13f5f4</code></a>
Bump ruby/setup-ruby</li>
<li><a
href="https://github.com/github/codeql-action/commit/c87fe5756c0c0bcd5e0005d2169945cfee9a232f"><code>c87fe57</code></a>
Rebuild</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/autobuild` from 4.38.1 to 4.38.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's
releases</a>.</em></p>
<blockquote>
<h2>v4.38.2</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2"><code>2892aa5</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4168">#4168</a>
from github/update-v4.38.2-a6ef2c96f</li>
<li><a
href="https://github.com/github/codeql-action/commit/8ad03a333eb88de8ad6833eda208d0fc51a9c571"><code>8ad03a3</code></a>
Trigger workflows</li>
<li><a
href="https://github.com/github/codeql-action/commit/98af865db5041cee73c7185896319367f8c0adf2"><code>98af865</code></a>
Update changelog for v4.38.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/a6ef2c96fc0e37d0b44fb2bd0b32db4bcb89ae24"><code>a6ef2c9</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4156">#4156</a>
from github/mario-campos/fix-validate-cmd</li>
<li><a
href="https://github.com/github/codeql-action/commit/1ef28a1b7603ca158fd774d1ab328cbd6a40b84b"><code>1ef28a1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4166">#4166</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/26cb08bab0037de74cc66ad9ec0dca31d6d9e8a7"><code>26cb08b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4163">#4163</a>
from github/mbg/fix-getCommitOid-stubs</li>
<li><a
href="https://github.com/github/codeql-action/commit/f035ce3a985a1223a9f59fb719542598640160b2"><code>f035ce3</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4165">#4165</a>
from github/dependabot/npm_and_yarn/npm-minor-8eaed9...</li>
<li><a
href="https://github.com/github/codeql-action/commit/5e4e2550b48d7f3de205c9d752eb5176bf07f6d9"><code>5e4e255</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/b13f5f47d5398d0fb982942ced6fdfc4e3951804"><code>b13f5f4</code></a>
Bump ruby/setup-ruby</li>
<li><a
href="https://github.com/github/codeql-action/commit/c87fe5756c0c0bcd5e0005d2169945cfee9a232f"><code>c87fe57</code></a>
Rebuild</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.38.1 to 4.38.2
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.38.2</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<h2>4.37.6 - 04 Aug 2026</h2>
<ul>
<li>Changed the default filepath for the new remote file address format
that was introduced in CodeQL Action 4.37.0 / 3.37.0 to
<code>.github/codeql-config.yml</code> to align it with the suggested
path that is used elsewhere. <a
href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li>
</ul>
<h2>4.37.5 - 03 Aug 2026</h2>
<ul>
<li>Fixed a bug where a network error while streaming the download of
the CodeQL bundle could terminate the <code>init</code> Action instead
of falling back to downloading the bundle before extracting it. <a
href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li>
</ul>
<h2>4.37.4 - 29 Jul 2026</h2>
<ul>
<li>This version of the CodeQL Action adds support for the
<code>tools</code> input for the <code>codeql-action/init</code> step to
be specified using a <code>github-codeql-tools</code> <a
href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository
property</a>. This feature will gradually be rolled out following the
release of this version. Once rolled out, this allows for the CodeQL CLI
version that is used in GitHub-managed workflows, such as Default Setup,
to be set to a custom value. For example, customers who run into issues
with rate limits when a new CodeQL CLI version is released can set the
value to <code>toolcache</code> to always use the CodeQL CLI version
that is available in the runner toolcache. For Advanced Setup workflows,
the value provided for <code>tools</code> in the workflow definition
always takes precedence unless the value of the repository property
starts with <code>!</code>. <a
href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li>
</ul>
<h2>4.37.3 - 22 Jul 2026</h2>
<p>No user facing changes.</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2"><code>2892aa5</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4168">#4168</a>
from github/update-v4.38.2-a6ef2c96f</li>
<li><a
href="https://github.com/github/codeql-action/commit/8ad03a333eb88de8ad6833eda208d0fc51a9c571"><code>8ad03a3</code></a>
Trigger workflows</li>
<li><a
href="https://github.com/github/codeql-action/commit/98af865db5041cee73c7185896319367f8c0adf2"><code>98af865</code></a>
Update changelog for v4.38.2</li>
<li><a
href="https://github.com/github/codeql-action/commit/a6ef2c96fc0e37d0b44fb2bd0b32db4bcb89ae24"><code>a6ef2c9</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4156">#4156</a>
from github/mario-campos/fix-validate-cmd</li>
<li><a
href="https://github.com/github/codeql-action/commit/1ef28a1b7603ca158fd774d1ab328cbd6a40b84b"><code>1ef28a1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4166">#4166</a>
from github/dependabot/github_actions/dot-github/wor...</li>
<li><a
href="https://github.com/github/codeql-action/commit/26cb08bab0037de74cc66ad9ec0dca31d6d9e8a7"><code>26cb08b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4163">#4163</a>
from github/mbg/fix-getCommitOid-stubs</li>
<li><a
href="https://github.com/github/codeql-action/commit/f035ce3a985a1223a9f59fb719542598640160b2"><code>f035ce3</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4165">#4165</a>
from github/dependabot/npm_and_yarn/npm-minor-8eaed9...</li>
<li><a
href="https://github.com/github/codeql-action/commit/5e4e2550b48d7f3de205c9d752eb5176bf07f6d9"><code>5e4e255</code></a>
Rebuild</li>
<li><a
href="https://github.com/github/codeql-action/commit/b13f5f47d5398d0fb982942ced6fdfc4e3951804"><code>b13f5f4</code></a>
Bump ruby/setup-ruby</li>
<li><a
href="https://github.com/github/codeql-action/commit/c87fe5756c0c0bcd5e0005d2169945cfee9a232f"><code>c87fe57</code></a>
Rebuild</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/1c5b675653bb5c22dbe9b12b556ec555138e09fd...2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-02 22:36:26 -04:00
CaliBrain 119d3374e3 fix(downloads): reconcile downloads a restart interrupted (#1423) 2026-10-02 22:35:09 -04:00
HeihoffJandClaude Opus 5.5 95d9f1da57 fix(sabnzbd): prefetch NZBs served from the indexer's own domain (#1416) 
Indexers often serve NZB downloads from a different host than their API
(e.g. file.indexer.example for indexer.example/api). The exact-origin
check added in #967 rejected those, so SABnzbd silently fell back to
addurl.

Trust any host in the configured indexer's registrable domain, using the
Public Suffix List so shared suffixes like co.uk or duckdns.org never
widen trust. Scheme and port must still match, IP literals and
single-label hosts still require an exact match, and the Prowlarr API
key header is unchanged.

This closes this issue:
https://github.com/calibrain/shelfmark/issues/1411 

Disclaimer: Implemented by Claude and Co-Authored by me. Tested and
verified by me alone (Why is it always this way around and not the
other)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-02 22:25:36 -04:00
splitsec2andCaliBrain 8392b43dd3 fix(downloads): reconcile downloads a restart interrupted (#1409) 
I found this while grabbing new books and working on my fork. I
redeployed the container while downloads were running, and it left a
mess in my queue. It's an edge case, but a few rows were stuck until I
cleared them by hand.

The download queue lives in memory, so stopping the process with a
download in flight leaves its history row "active" and its request
"queued", with nothing working on either. The activity API shows that
row as "Interrupted" when it's read, but nothing is stored and nothing
looks at it again. Upstream only reopens an errored request when no
manual retry is offered, and an interrupted row always offers one, so
the request just sits there.

This closes those rows out once at startup, before the coordinator
starts, as an error with the message "Interrupted". The retry payload
stays, so the manual retry still works. A request whose download was
queued in the last 24 hours goes back to pending through
`reopen_failed_request`. Older ones get closed out but their requests
are left alone, because I didn't think a startup should reopen a backlog
or fill an admin's approval queue with old requests. A request that
already arrived is left alone, and running it twice changes nothing.

It assumes a single worker process, which `entrypoint.sh` already sets.

On my install the first start after deploying it closed 53 rows that had
been orphaned for nine days. Tests are in
`tests/core/test_startup_reconcile.py`, and the full suite passes
locally.

If the 24 hour window feels off, or you'd rather handle this another
way, I'm happy to change it or drop the PR.

Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-02 22:23:28 -04:00
Evan KazakinandEvan Kazakin 7888217380 feat(download): add Remove & Delete Files torrent completion action (#1401) 
Closes #1027

## Summary

- add a **Remove & Delete Files** (`remove_and_delete`) option to the
Torrent Completion Action setting
- after a successful import, remove the torrent and ask the client to
delete its downloaded data (`delete_files=True`), matching what the
usenet "move" flow already does
- clarify the setting description so it says **Remove** keeps the
downloaded files (raised in the issue comments)
- regenerate the `PROWLARR_TORRENT_ACTION` entry in
`docs/environment-variables.md`

## Behavior

The deletion runs from `post_process_cleanup`, the same place as the
existing Remove and Change Category actions, so it only happens after
output transfer and post-processing have succeeded. At that point every
file has already been copied or hardlinked into the library, and
transfer size checks have passed. A failed import never removes or
deletes anything. The torrent client deletes its own data, so Shelfmark
does not delete paths itself and remote path mappings are not involved.
Keep, Remove, and Change Category behave as before, and Keep is still
the default.

If a request matched a completed torrent that was already in the client,
this option deletes that torrent's data too. That is the same scope the
existing Remove action already applies to.

## Validation

- `make python-checks` (ruff check, ruff format, basedpyright on backend
and tests, vulture): passed
- `make python-test`: 3363 passed, 5 skipped, 9 failed. All 9 are in
`tests/config/test_entrypoint_permissions.py` and happen because macOS
`/bin/bash` 3.2 does not support `${1,,}` in `entrypoint.sh`. They do
not touch this change.
- new tests in `tests/prowlarr/test_handler.py`:
- Remove passes `delete_files=False` and Remove & Delete Files passes
`delete_files=True`
  - a failed import with Remove & Delete Files does not call the client
  - the delete case fails without the handler change
- manual smoke run: `PROWLARR_TORRENT_ACTION=remove_and_delete` set
through real config loading, with a stub client that deletes its folder.
The torrent folder was deleted and the hardlinked library file stayed
intact.
- pre-commit hooks (prek) passed

---------

Co-authored-by: Evan Kazakin <evan@Evans-MacBook-Pro.local>
 2026-10-02 22:15:17 -04:00
splitsec2 d99e9d7c4f fix(download): remove a cancelled torrent that never started (#1421) 
Cancelling a torrent download leaves the torrent in the client.
`_safe_remove_download` documents the rule: "torrents: never remove or
delete client data (avoid breaking seeding)". That makes sense for a
torrent that has data. A torrent that is still at 0% has nothing to seed
and nothing to resume, and leaving it behind holds a download slot in
qBittorrent's queue or sits there as a dead entry.

I hit this on a qBittorrent that is shared with Sonarr, Radarr and
Lidarr and has a download limit. Shelfmark cancelled downloads that were
queued (#1420) and left them in the client. Three torrents that never
fetched metadata held every active slot, and each torrent added after
them waited behind them. Removing those by hand freed the slots.

This removes the torrent and its files when a download is cancelled,
Shelfmark added the torrent, and the client reports 0% progress. A
torrent with any data is left alone as before. So is one that was
already in the client when the download started, since Shelfmark didn't
add it. If the removal fails it is logged and the cancel carries on.

Tests cover removal at 0% for a queued and a downloading torrent,
leaving one that has data, leaving one the user already had, and a
failing removal. The full suite passes, and I broke each rule on purpose
to check a test catches it.

This changes a rule you wrote down, so I've kept it apart from the queue
fix. If you'd rather have it as a setting, or only remove a torrent that
is still queued or fetching metadata, I'm happy to rework it.
 2026-10-02 22:12:51 -04:00
splitsec2 88f73e3bc3 fix(download): do not cancel a queued torrent as stalled (#1420) 
qBittorrent only runs a few downloads at once (`max_active_downloads`
defaults to 3) and holds the rest as `queuedDL`. Shelfmark's stall timer
cancels a download after five minutes without a changed status or
progress. A queued torrent reports "Queued" on every poll, so it looks
idle, and Shelfmark cancels a download that was only waiting for a slot.

I run Shelfmark against the same qBittorrent that Sonarr, Radarr and
Lidarr use, which I assume is a common setup. Their torrents and
Shelfmark's share one limit, so anything that fills the slots makes
Shelfmark's torrent wait. In my case three torrents that never fetched
metadata held every slot. I'd expect a busy Sonarr queue to hold them
the same way, but I haven't reproduced that. Once the stall timer had
cancelled the waiting downloads they stayed in the client, still queued
behind the same blockers. On my instance 10 AudioBookBay downloads were
cancelled while qBittorrent still had them queued.

This changes the torrent poll loop. When the client reports a queued
torrent, it asks for an activity grace (the mechanism `html_get_page`
already uses for protection bypasses) and releases it as soon as the
torrent leaves the queue. The grace is renewed every ten minutes and
stops at two hours, so a queue that never moves still ends. A torrent
that is downloading and moving is timed as before until the new window
below applies.

The second commit sets the stall message before the cancel runs. The
terminal hook copies the message into the history row, and it was set
afterwards, so a download the timer ended was recorded with the last
poll's "Queued". That left no way to tell it apart from a person
cancelling.

The last two commits are about slow torrents. The timer only counts a
change in progress, so a torrent that needs more than five minutes to
fetch metadata or find its first peer is cancelled before it has any
progress to count, and one that moves a few megabytes at a time can be
cancelled between bursts. I hit this with a torrent that had a single
peer. A torrent now gets one 15 minute window the first time it is seen
outside the queue, and each step forward in progress renews it. One that
makes no progress for 15 minutes is still cancelled, so a dead torrent
now takes about 15 minutes to end instead of five. That trade is the
part I'm least sure about, so the number is easy to change.

Tests cover the grace being requested once, released when the torrent
starts, renewed, and capped, the order of the message and the cancel,
and the start and movement windows. The full suite passes, and I broke
each rule on purpose to check a test catches it.

The two hour ceiling is a guess. If you'd rather have a setting for it,
or a different number, I'm happy to change it.
 2026-10-02 22:12:25 -04:00
CaliBrain bac0b93566 fix: keep https:// for qBittorrent and hide release sources from non-admins (#1422) 
qBittorrent over HTTPS (#1417)

qbittorrent-api ignores the scheme in `host` and probes HTTP and HTTPS
itself. When the HTTPS probe fails, for instance on a certificate
Shelfmark doesn't trust, it falls back to plain HTTP against the TLS
port, and a reverse proxy answers "400 The plain HTTP request was sent
to HTTPS port". The download client and the Test Connection button now
pass FORCE_SCHEME_FROM_HOST for https:// URLs, so the configured scheme
is used as-is and a certificate problem is reported as one. http:// and
bare host:port URLs keep the probe: normalization adds http:// to a bare
host, and the probe follows a proxy's redirect to HTTPS.

Release sources leaked to non-admins (#1418)

A download queued from an approved request carries the release an admin
picked, and the requester could read it from their own activity feed:
the request's release_data (source_id, indexer, info URL, torrent
attributes), the download's full server path, and the download id
itself, which for Prowlarr is "<indexer id>:<guid>" and for a private
tracker is a URL into it. That id keys every status payload, the
/api/localdownload query and the cover proxy URL, so hiding
release_data alone would not have closed the leak.

For non-admin viewers:
- request rows keep only the release fields the activity cards display
- download_path is reduced to the file name, which the browser download
  reveals anyway
- request-linked downloads are addressed by an opaque id (a keyed HMAC
  of the task id) in the snapshot, history, /api/status, queue order,
  active downloads, dismissed keys, cover URLs and the websocket status
  and progress events. Routes that take a download id translate it
  back, searching only the caller's own downloads.

Downloads a user queued directly keep their real id: the user picked
that release from search results that already showed it, and the
release list matches its buttons to the queue by that id. Admin views
are unchanged. The activity sidebar now links a fulfilled request to
its download by request_id instead of release_data.source_id.

Closes #1417
Closes #1418
 2026-10-02 20:38:58 -04:00
splitsec2andMichael Ngo fcdc2dfb69 perf(docker): stop shipping build-only content in the runtime image (#1404) 
While checking why each build took so much disk on my server, I looked
at what's actually in the runtime image. A good share of it is there for
the build and never used after.

**The C toolchain.** The base stage installs `gcc`, `g++`, `libffi-dev`
and `python3-dev` for building C extensions, and they stay in both the
full and lite images, which is 290 MB installed. Nothing gets compiled
any more. Every compiled dependency in `uv.lock` (cffi, gevent,
greenlet, zope-interface) ships a cp314 manylinux wheel for both amd64
and arm64, and the packages that only have an sdist are pure Python.
`python3-dev` was also pulling Debian's `libpython3.13` into a 3.14
image.

**The build context.** `COPY . .` puts the whole context into `/app`, so
`tests/`, `docs/` and the frontend source ship too. `.dockerignore` now
leaves out the trees nothing reads at runtime. `src/` can't go in
`.dockerignore` because the frontend-builder stage needs it, so both
final stages remove it after the built dist is copied. The venv's own
`pip` goes as well, since uv seeds one and nothing installs at runtime.
This part is @DrNgo's work from his fork, and the commit carries his
name.

Measured by building both targets on native amd64 and arm64 runners:

|  | amd64 full | amd64 lite | arm64 full | arm64 lite |
|---|---|---|---|---|
| before | 1,532 MB | 589 MB | 1,528 MB | 619 MB |
| after | 1,238 MB | 295 MB | 1,251 MB | 342 MB |

Compressed, the full image goes from 617 MB to 504 MB on amd64.

On both architectures the image builds, reaches healthy, and Chromium
starts the same way the bypasser starts it (xvfb,
`_get_browser_args()`). The Python suite passes too. It's also running
on my own install now.

If a dependency ever needs compiling again, the clean fix is a builder
stage that builds the wheel and copies it in, rather than putting the
toolchain back in the runtime image. Happy to add that now if you'd
rather have it in place.

---------

Co-authored-by: Michael Ngo <michaeln56@gmail.com>
 2026-10-02 16:30:10 -04:00
vansh 41a4df01c4 fix: hand DiamWall 513 challenges to the bypasser (#1400) 
## Summary
Recognize DiamWall interstitials in both the HTTP retry path and the
internal browser helper. HTTP 513 challenge responses go directly to the
configured bypasser, while ordinary 513 responses keep the existing
error behavior.

Fixes #1386

## Testing
- `uv run --frozen --extra browser pytest -q -n 0
tests/download/test_http_challenge_513.py
tests/bypass/test_internal_bypasser.py`: 27 passed
- Ruff lint and format checks passed
 2026-10-02 16:26:04 -04:00
CaliBrain d2b4a0290e fix(ui): contain the result count added in #1362 (#1363) 
Two regressions from the Anna's Archive search stats feature.

The release modal's count block declared flex-1, so it competed with the
tab strip's own flex-1 and took half the row - including on tabs whose
source reports no total, where it renders nothing at all (only
direct_download exposes total_results). Measured on a 1024px modal with
six sources, the scrollable tab strip fell from 846px to 423px against
601px of tabs; at 375px with two sources it fell from 197px to 44px. It
is now flex-none, and hidden below sm: the label alone is ~150px, which
the full-screen mobile modal cannot spare. Remeasured at 693px on
desktop and back to the pre-feature 197px on mobile.

directTotalResults is only ever written on the direct-mode branch, and
neither the universal branch nor App's resetSearchResultsState cleared
it, so a count from an earlier direct search survived a mode switch and
rendered over unrelated universal results. Both universal-branch reset
blocks now clear it.
v1.4.0 		2026-09-25 21:22:42 -04:00
CaliBrain 893f7bdb92 fix(mam): keep the session ID on MAM and rerun Prowlarr's exact search (#1399) 
Follow-up to #1390.

- The origin came from each result's infoUrl, matched by a regex that
did
  not check the host, and the mam_id cookie had no domain. Any Prowlarr
  indexer returning a URL like https://evil.example?myanonamouse.net/t/1
  sent the session ID to evil.example. Requests now always go to
https://www.myanonamouse.net (Prowlarr's only MAM URL), with the cookie
  as a header and redirects off. Only results from Prowlarr's
  MyAnonamouse indexer are looked up, and their URLs must be on
  myanonamouse.net.
- The lookup searched every category and read one page, so for common
  titles most of Prowlarr's results were missed (a "Dune" audiobook
  search: 56 audiobooks on the first 100 of 328 matches). It now reruns
  Prowlarr's exact search: the same query clean-up, the MAM main
  categories behind the Torznab categories searched (13/15/16 for
  audiobooks, 14 for e-books, all once expanded), and the MAM indexer's
  own search type, search-in options and languages. Further pages are
  read while IDs are missing, page 1 of every title first, at most 4
  requests per search.
- Failed requests back off for 1, 2, 4 ... up to 30 minutes. The 10th
  consecutive failure stops enrichment until Test MAM Session passes,
  the session ID changes, or Shelfmark restarts.
- The detail cache prunes expired entries instead of growing for as long
  as Shelfmark runs.
 2026-09-25 21:21:54 -04:00