mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-11-15 11:18:35 +00:00
46b9e7d8a3d9ff8526c5fc4c7204c87d0dc0c324
727
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 splitsec2
|
46b9e7d8a3 |
fix(library): match a shelf title against the full title when the search title is only the series (#1587)
Fixes #1584. Thanks to @joeRob2468 for the write-up, which pinned this down to the line. Hardcover cuts a title like "Mistborn: The Final Empire" down to "Mistborn" for searching when it can't tell the series prefix from a title prefix, and search results don't carry the series. The library check then matched the shelf title "Mistborn: The Final Empire" against "Mistborn", saw "final empire" as extra words and took it for a longer, different work (the "Dune" vs "Dune Messiah" rule), so the book got no In library badge. `match_entries` now tries the search title first as before and, if that finds nothing and the full title is different, tries the full title too. The full title is the more specific of the two so it should rarely add false positives. Another book in the same series still doesn't match, there is a test for that, and the Dune and Dune Messiah test passes unchanged. The matching loop moved into a small helper to run it twice, nothing in it changed. This only touches the library check. The same short search title also feeds release searches and auto-download matching, which I left alone here because loosening or tightening those changes what gets searched and downloaded for everyone. Tests fail on current main without the change. The library tests, ruff and basedpyright are clean. |
||
 Josh Theisen
|
e3fd7898f6 |
fix(user-notifications): simplify row key serialization in TableField and clean up UserNo… (#1583)
- simplify row key serialization in TableField - clean up userNotificationOverridesSection Previously, after typing a single character, the browser would lose focus due to the row keys changes on every new value. The fix makes the row key independent of the URL’s changing text. Additionally, fixed the per-user notification routes so that unchecking "All" clears all event selections. |
||
|
splitsec2
|
ac14e4dd24 |
fix(downloads): a swarm note change is not activity for the stall timer (#1572)
The torrent stall timer can be deferred for as long as the swarm keeps changing. Since #1494 the torrent handler appends a note to its progress message (`0% · 2 seeds`, and `· 0 seeds, giving up in 7m` while the no-seeders clock runs). `update_download_status` treats any changed message as activity, so a seed count that goes 2, 3, 1 between polls, or the give-up countdown ticking down every minute, refreshes `_last_activity` and the torrent never stalls. A torrent whose seed count stays constant still stalls, which is why this is easy to miss. `shelfmark/download/activity.py` already says what counts: a changed status event or a changed progress value, and a message that changes on a timer proves nothing. So `update_download_status` now compares messages through a small `activity_key()` that drops that trailing seed note. The card still gets every message and shows the live seed count, only the stall clock ignores a change in the note. A new progress percentage, a different client message or a status change still counts as activity. The handler builds the note in `_seed_note` and `activity_key` has to match it, so one test builds the note for a range of seed counts and countdowns and checks the key strips all of them. That also covers the gap #1494 left, where no test connected a handler's message to the orchestrator: the other two drive `update_download_status` with real notes and a fake clock. Without the change the note test fails and the key tests cannot even import `activity_key`. The other orchestrator test is a control that a progress or status change still counts. Full suite passes, and each new test also passes when run alone. |
||
  misko903andClaude Opus 5.5
|
d50440f6c2 |
fix(webshare): clear the "Resolving" status once the download starts (#1575)
## What
A Webshare.cz download shows "Resolving Webshare link" for its entire
duration, so a large download (e.g. a 1.3 GB audiobook archive) looks
stuck.
## Why
After the link was resolved, the handler called
`status_callback("downloading", None)`. `update_download_status` treats
a `None` message as "keep the current message", so the "Resolving
Webshare link" detail stayed in the activity panel. The HTTP handler
sends `""` for exactly this reason.
## How
- Report `downloading` with an empty message, which clears the resolving
text.
- When the download response has no `Content-Length`, use the release's
size (`task.size`, parsed with `parse_size_string`) as the total for
progress. Without it, progress never moved, and stall detection would
flag a healthy long download after 5 minutes.
## Testing
- New tests in `tests/webshare/test_handler.py`: the downloading status
clears the message, and progress is computed from the release size when
there is no Content-Length.
- `uv run pytest tests/webshare` is green (34 passed), and `ruff check`
and `ruff format --check` are clean.
Follow-up to #1543.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
|
||
|
splitsec2
|
525b094b57 |
fix(clients): hand a finished wrong-type directory on instead of polling out the timeout (#1573)
A torrent that finishes with the wrong kind of files in it holds the download for the whole completed-path timeout (60 seconds by default, up to an hour) and then fails with "Completed download has no stable supported files yet." An ebook task whose torrent holds only an `.m4b`, an audiobook task that got an `.epub`, or a `.pdf`-only release with the default format list all land here. In v1.4.0 these failed with the specific format error from post-processing, but the wait for the sync to settle (#1464) only counts files of the task's own type, so it keeps polling for files that are never going to appear. If the directory has no supported files, `_wait_for_completed_path` now looks for finished book or audio files that this task does not accept (the audiobook formats, the default ebook formats and pdf). When it finds some and they are the same on two polls in a row, it returns the path so post-processing can say what is wrong with the formats. Cover art and notes alone do not count, because that is what a directory looks like while the real files are still syncing over a remote mount, so those keep waiting as before. A wrong-type file that is still growing keeps waiting too. With no wait configured there is only one sample, and a wrong-type file is handed on straight away. The existing test that pins "no book files, no wait configured" uses a jpg, so it stays as it is. I extended the test helper to take a content type, which the wait tests never passed before. Four new cases fail without the change (a wrong-type directory for ebook, audiobook and pdf tasks), and two more check that sidecar-only and still-growing directories keep waiting. Full suite passes. |
||
|
splitsec2
|
47f0acdd31 |
fix(logging): mask userinfo and path-segment credentials, route stray loggers through the formatter (#1571)
Logs get pasted into issues, and the formatter from #1488 only masks `?key=value` query parameters. I went through what else commonly ends up in a log line and found these unmasked: - credentials in a URL's userinfo, like a proxy's `socks5://user:pass@host:1080` or `http://admin:secret@qbittorrent:8080` - a passkey as a path segment, like `/rss/<key>` or `/passkey/<key>/get.torrent`, which private trackers use - the token in a Telegram bot, Discord webhook or Slack webhook URL, which is what a notification URL looks like when it gets logged All three are masked now, in `redact_secrets`, so they apply to every handler. The path rule only fires after a segment that names a secret (`passkey`, `apikey`, `rsskey`, `authkey`, `token`, `secret`, `rss`, `torznab`) followed by 16 or more token characters. I left out generic words like `download` on purpose, because `/api/download/<md5>/cancel` appears in our own request log and the ids there are useful when debugging. That is the tradeoff: a passkey in a `/download/<passkey>/` path still gets through. Separately, four modules created their logger with plain `logging.getLogger`, so nothing they logged went through the formatter at all: `api/websocket.py`, `download/clients/__init__.py`, and the Jackett, Newznab and Prowlarr package inits. They use `setup_logger` now like everything else. Tests: ten cases, seven for the new shapes and three that must stay readable (an md5 route id, a short `/rss/latest`, an email address), plus two that check the stray modules now carry the redacting formatter. Nine of them fail without the change. Full suite passes. Not covered here: `/api/debug` still zips the existing log files as they are on disk, so anything logged before this change rides along in a bundle. That is a separate change in `genDebug.sh`. |
||
|
splitsec2
|
ef40a38546 |
fix: report a stopped download coordinator in /api/health (#1568)
If the download coordinator thread dies, every task sits at "Queued" and nothing says why. The rest of the app keeps answering, `/api/health` stays green and the container looks fine. #823 and #1166 were both that, and the loop's `except Exception` cannot catch everything that can end a thread. `/api/health` now reports it. The response gets a `coordinator` field, `running` or `stopped`, and when it is stopped the status is `error` and the HTTP code is 503. The Docker healthcheck in the Dockerfile and the one in the readme both use `curl -f`, so the container shows as unhealthy and anything watching health (Uptime Kuma, autoheal) can act on it. It needs no login, same as before, and shows no queue contents. That 503 is the one decision here. Keeping the 200 and only adding a `degraded` entry would not trip a status-code health check, which is the whole point, so I went with 503. Easy to flip if you would rather not. The orchestrator gets a small `coordinator_running()` that asks whether the thread is alive. `start()` already knows how to restart a dead thread, so restarting it automatically would be the true fix, but I would rather the failure be visible first and decide on that separately. Tests: three for the route (ok, 503, no login needed) and three for `coordinator_running` (never started, alive, dead). They fail without the change. One existing test hits `/api/health` through an app that never starts the coordinator, so it now patches that. The readme's health section has a sentence about the 503. Full suite passes, ruff and basedpyright are clean. |
||
|
splitsec2
|
973cf472a2 |
test(image-cache): flush window test no longer depends on float rounding (#1580)
`test_cache_hit_flushes_the_index_once_the_window_has_passed` (from #1544) failed on the first attempt of two of my PRs' Python Tests runs today (#1576, #1579) and passed on rerun, with nothing in either PR touching the image cache. The test sets the clock to exactly `last_saved + ACCESS_FLUSH_SECONDS` and expects a flush. `(now + 30) - now` isn't always 30.0 in floating point. For example `105.65207077218265 + 30 - 105.65207077218265` is `29.999999999999986`, so the `>=` check is false and the flush never happens. That only shows up when the monotonic value is small, which fits a freshly booted runner (on this box the uptime is in the millions of seconds and it never fails). I haven't been able to see the runner's actual uptime in the CI logs, so that part is an inference, but pinning `_last_saved` to that value reproduces the exact failure (`assert [] == [1]`) locally. The test now puts the clock one second past the window. The production check is fine, real elapsed time doesn't have this edge, so only the test changes. |
||
|
splitsec2
|
b248bcd536 |
fix(clients): import a qBittorrent torrent only when every listed file is on disk (#1577)
Fixes #1561, with thanks to @tmussche for the write-up, which had the cause and the fix. When the files reach Shelfmark through a sync (Resilio in the report), the wait for the completed path accepts the folder once two samples a few seconds apart look the same. A sync that copies in batches can pause longer than that, so 10 of 23 files were imported and some of those were still partial copies. For qBittorrent the client can say what the finished download holds, so the wait now checks that. `DownloadClient` gets an optional `get_expected_files()` that returns `ExpectedFile(name, size)` entries, or None when the client cannot say, which is the default and keeps every other client as it was. qBittorrent answers it from `/api/v2/torrents/files`, leaving out files the torrent does not download (priority 0), zero-byte entries and BEP 47 padding files. `_wait_for_completed_path` asks once, and while any of those files is missing or smaller than its final size it keeps waiting, using the same timeout as before. When the wait runs out the error now says how far it got, for example "Completed download is not fully on disk yet (10 of 23 files)." Once everything is there the existing stability check still runs, so nothing is accepted that was accepted before. Names from the client start with the torrent's top-level folder, so each file is looked up with and without it, which also covers a torrent saved without a subfolder. A single-file torrent is checked by size too, since a file that is still syncing exists at a smaller size. Two things I would like a second look at: the comparison is on exact size, so a setup where something rewrites the files after the torrent finishes would never match and would run into the timeout; and the file list is read once per wait, not on every poll. If the client does not answer, nothing changes. I also moved the nested authenticated GET in the path derivation into a `_get_with_auth` method so both calls share it, and added a sentence about this to `docs/configuration.md`. Tests: eight for the wait (partial folder, truncated file, files arriving during the wait, complete folder, no top-level folder, single file both ways, and a client without a list), and six for the qBittorrent file list. The wait tests that depend on the new behaviour fail on current main. Full suite passes. |
||
|
splitsec2
|
9011319ade |
refactor: one lookup for the supported formats, public names for two shared helpers (#1576)
Six places read the Supported Book Formats and Supported Audiobook Formats settings on their own: post-processing, the post-process scan, IRC, slskd, Prowlarr and direct download. For ebooks they already agreed, since they all fall back to `DEFAULT_EBOOK_FORMATS`. For audiobooks they did not. The settings registry and slskd fall back to every audio format plus zip and rar, while post-processing and IRC fell back to m4b and mp3 only. They now share `shelfmark/core/formats.py`, with `get_supported_formats`, `get_supported_audiobook_formats` and a content-type aware `get_supported_formats_for`, and a shared `DEFAULT_AUDIOBOOK_FORMATS` in `core/utils.py` next to the ebook one. `policy.py` re-exports the same functions, so nothing that imports them from there changes. It is not in `policy.py` itself because importing the `postprocess` package pulls in the router, which imports the release sources, so a source could not import from it without a cycle. One behaviour difference, and only in the fallback: with the audiobook setting unset, or emptied, post-processing and IRC used to accept m4b and mp3 and now accept the full default list like slskd and the settings page already did. A configured list is read exactly as before. Direct download's own helper used the raw configured list and now reads the same normalized one, which is identical for any list the settings page can save. Also public now: `parse_size` in the Prowlarr source (slskd and Newznab imported it with the underscore) and `coerce_completed_path_timeout_seconds` in the client base handler (slskd imported that too). Not changed on purpose: slskd's `_coerce_int` looks like a copy of `coerce_int` but is not. It reads `"12.0"` as 12 and `True` as 0, where `coerce_int` gives 0 and 1. And the `_parse_size` in the IRC source is a different function, string to bytes. Tests: a new set checks that post-processing, IRC and slskd all fall back to the shared defaults and that the settings default is the shared one, and the scan-archive and IRC tests now patch the shared config instead of the per-module copies. Full suite passes. |
||
|
splitsec2
|
606e94fde2 |
fix(settings): offer the seed settings for qBittorrent only (#1574)
The two seed settings, Give Up With No Seeders and Minimum Seeders, show up for every torrent client, but only qBittorrent reports a seed count. With Transmission, Deluge or rTorrent you can set both and nothing happens. The first one says "Only qBittorrent reports seed counts" at the end of its description, the second says nothing about it. Both are now shown only when qBittorrent is the selected client, the same `show_when` the other qBittorrent fields use, and Minimum Seeders gets the same sentence. A value someone already saved for another client stays in their config, it just is not shown, and it had no effect before either. `docs/environment-variables.md` is regenerated for the changed description, which is two lines. One test checks that both fields are tied to qBittorrent and say so, and it fails without the change. |
||
|
splitsec2
|
70fe4b8c89 |
fix(hardcover): keep the scheduler alive on an unreadable interval, share one history connection per sync (#1569)
These are the follow-ups from the review notes on #1516 and #1534 that I said I would do once the series had merged. The scheduler waits for the next cycle outside the try that guards the cycle itself, so an interval setting that raised would end the thread and nothing would sync again until a restart. It now logs the error and tries again after six hours. `docs/hardcover-sync.md` says so. The history check in the sync opened a new SQLite connection for every book on the shelf. It opens one per sync now and shares it, which adds up on a slow disk or a small board. The two test nits from #1534 are in as well: a `parametrize` with a single case, and an unused argument on a helper. The thread surviving a failed wait and the shared connection each have a test that fails without the change. Ruff, basedpyright and the backend suite pass (5297 passed). |
||
|
splitsec2
|
a63d9e3e21 |
docs: regenerate the environment variable reference (#1565)
Sorry about this one. The environment variable references had also fallen well behind, and again I was a big part of that. A bunch of the gaps come from my own PRs (Hardcover sync, auto-download, the Audiobookshelf library check) where I charged ahead with the functionality and skipped the boring documentation part (did I mention that documentation is boring?). I again had Claude compare the docs to the code and generate the updates, so it would be good to have another human look this over before it merges. The doc diff is just the generator's output. The part worth a real read is the handful of new entries in `scripts/generate_env_docs.py`, since I wrote those descriptions from `entrypoint.sh` and `tor.sh` and not from a settings definition. What changed: - Regenerated `docs/environment-variables.md`. It had 287 variables and the generator now produces 311. The 21 that were missing are the Hardcover Sync tab (6), auto-download (11) and the Audiobookshelf library check (4). Nothing was removed and no existing default, type or option changed. - `SHELFMARK_API_KEY_READONLY` was only ever hand-edited into the doc, so the generator did not know it and a plain regeneration would have dropped the row. It is in the generator now. - Added `UMASK`, `TOR_CHECK_INTERVAL` and `TOR_MAX_FAILURES`. The code reads all three and no doc mentioned them. - The table of contents built its anchors by lowercasing and swapping spaces, so the Webshare.cz and Moly.hu links were already broken (GitHub drops the dots) and Soulseek (slskd) would have broken with the parentheses. They now follow GitHub's rule. Two tests cover the new entries and the anchors, and both fail without the generator change. To regenerate: `python scripts/generate_env_docs.py` on Python 3.14. A test that fails when the committed file differs from the generator output would have caught this drift, but then every PR that adds a setting has to regenerate the doc. I left that out, your call if you want it. |
||
|
splitsec2
|
e273e7b0ed |
docs(dev): bring the plugin guides in line with the current code (#1566)
This is the biggest of the docs batch, and this time I don't think it was my PRs that caused it. The plugin guides fell behind as the plugin API changed over several releases, and nobody updated them along the way. Same arrangement as the others: Claude compared the guides to the code and wrote the changes, so another human look before this merges would be good. Someone who knows the plugin API well would catch things I would not. These are the parts I would read first: the search plan table, the `SourceUnavailableError` advice in the error handling section, and the `locating` status row. What was wrong and is now fixed, all checked against the code: Release sources guide - `search` takes `(book, plan, *, expand_search, content_type)`. Every sample had the old one-argument signature, so a source written from the guide raised a TypeError on its first search. There is now a short table of the search plan fields. - A source is registered by adding its module to `_BUILTIN_SOURCE_MODULES`. The guide said to add an import at the bottom of `__init__.py`. - `get_column_config` is an instance method, not a classmethod, and `ColumnRenderType.SEEDERS` does not exist (the real members are listed). - `download` can return a `HandoffResult`. `list_available_sources` lists every source with an `enabled` flag, it does not filter. - `group="sources"` is gone, since only `direct_download` and `metadata_providers` exist. - Field lists for `Release`, `DownloadTask`, `BookMetadata`, `ColumnSchema` and `ReleaseColumnConfig` are brought up to date, with the protocol enum and the `locating` status. - The optional hooks that were not mentioned (`post_process_cleanup`, `build_retry_resolution_fields`, `list_authors`, `seed_complaints`, `get_record`, `get_destination_override`, `search_results_are_releases`) are documented. Plugin settings guide - The examples imported from `shelfmark.metadata_providers.base` and `shelfmark.release_sources.base`, which do not exist. The metadata example also skipped the abstract `search_by_isbn` and the kwargs factory. - Value priority now starts with the environment variable, and `search_mode` is listed next to `general` as using `settings.json`. The `metadata_providers` group order is 12, not 50. - Documented `TagListField`, `OrderableListField`, `TableField`, `env_var`, `env_supported`, `user_overridable`, `universal_only`, `filter_by_field`, `register_on_save` and the `current_values` argument for action callbacks. Also in here: `docs/dev/index.md` was a TODO stub and is now a short index linked from `docs/index.md`, a dead link in the metadata providers README is fixed, and the README table gains Databáze knih and Moly.hu. To check the samples were not just plausible, I ran the quick start and the full BookNet example against the real registry. Both register, instantiate and return their column config. The old BookNet example failed on import with a NameError, because the Test Connection callback was defined below the settings function that references it. The decorator calls that function straight away, so both settings snippets now define the callback first. |
||
|
splitsec2
|
20848a8774 |
docs: small fixes from a check of the docs against the code (#1567)
These are the leftovers from the docs check, the fixes that did not belong in the other three. Claude did the comparison and wrote the changes here too, so I would still like a human look before it merges. The one new piece of prose worth a read is `troubleshooting.md`. It was a TODO page that two other pages link to, so I filled it with only what I could confirm in the code: where the logs go, `LOG_LEVEL`, the `DEBUG=true` bundle from the bug report template, and reporting an issue. Happy to drop it back to a stub if you would rather write that one yourself. - `configuration.md`, `custom-scripts.md`, `users-and-requests.md`: Booklore is Grimmory in the UI now. The stored mode value is still `booklore`, and the custom script doc says so. The hardlink heading now matches the "Hardlink Book Torrents" and "Hardlink Audiobook Torrents" checkboxes. - `custom-scripts.md`: the email output runs scripts too (`phase=post_email`, `output.mode=email`, details under `output.details.email`). It was missing from the phase list. - `users-and-requests.md`: a delivery that fails with no retry available goes back to pending on its own, and the admin reopen action is for rejected requests. The page said an admin reopens a failed delivery. Also noted that rules cannot use Request Book. - `hardcover-sync.md`: added the missing `AUTO_DOWNLOAD_AUDIOBOOK_MIN_SIZE_PERCENT` row and a sentence in the ranking paragraph. - `api-access.md`: an admin session also reads `/api/stats`, and what the 403 says. - `installation.md`: points at the Lite, Tor and WireGuard variants. Docs only, no code touched. |
||
|
splitsec2
|
6b775cd9e8 |
refactor: move /api/stats into core/stats_routes.py (#1563)
The sample extraction from Discussion #1536: `/api/stats` moves out of `main.py` into `shelfmark/core/stats_routes.py`, registered with `register_stats_routes(app, ...)` like the other route modules. The route logic is the same, and no test changed. `main.py` passes two callables instead of values, one for the user database and one for the auth mode. They are called per request, so the tests that patch `main.user_db` and `main.get_auth_mode` after import still work. The read-only key allowlist in the middleware now uses the path constant from the new module, so the path lives in one place. This is only the shape. If it looks right I'll move the route groups from the 1.5.0 PRs the same way, one PR each. If you'd rather leave `main.py` as it is, close this and no harm done. |
||
|
splitsec2
|
61419451e4 |
docs(readme): bring the feature lists and project scope up to date (#1564)
Sorry, this one is overdue. The readme still describes Shelfmark as it was a few releases ago. Part of that is on me: Hardcover Sync, Library Check and a few other things I added came in through PRs where I charged ahead with the functionality and skipped the boring documentation part. The rest are features other people added (Jackett, Webshare.cz, DNB and so on) that never made it into the readme either. I had Claude compare the readme to the code and generate the updates, so it would be good to have another human look this over before it merges. The scope section in particular is your call, since it states what Shelfmark is for. What changed: - **Project Scope** said Shelfmark doesn't know what you own, doesn't integrate with library software and has no background automation. Library Check and Hardcover Sync ship exactly those things, so the list now says what is still true (it never edits your library, and Hardcover Sync is the one optional background job) and links both docs. I kept the four bullets and the "not missing features" line. - **Sources and providers** now include Jackett, Webshare.cz and OceanofPDF, and DNB, Databáze knih and Moly.hu. - **Features** gain Library Check and Hardcover Sync, both linking to their existing docs pages. - **Settings list** gets the download clients (including the four debrid services), Jackett and Webshare.cz, and the Library Link bullet mentions the audiobook library URL. Docs only, no code touched. Every name and link was checked against the code and the docs folder. |
||
|
splitsec2
|
d7a4b6b859 |
fix: keep exception text out of the status, config and release search responses (#1562)
Same idea as #1558, for three more places that hand `str(e)` to whoever is logged in. These are code scanning alerts 106, 142 and 143. `/api/status` and `/api/config` returned the raw exception text of an OSError, RuntimeError and so on with the 500. They now return "Could not read the download status" and "Could not load the configuration". The full error is still logged with its trace. For `/api/releases`, a source failing with an unexpected error put `source: <exception text>` into the error list that goes back to the caller. `search_source_releases` takes a new `include_error_detail` flag. The route passes True for admins (and when auth is off, where everyone is treated as an admin) and False for everyone else, who get `source: search failed`. The message of a `SourceUnavailableError` is written for the user, so it is kept either way, and the background auto-download caller keeps the default and sees the full text as before. Left alone on purpose: the `reason` in the release inspect response, since a test covers that it carries the error text and it looks intentional. Tests: two for the routes and two for the helper. All four fail without the change. Full suite passes (5295), ruff and basedpyright are clean. |
||
 
|
23b3b3a9d8 |
feat: add Jackett release source (#1521)
## Summary Adds Jackett as a separate release source (`jackett`), as requested in #1443. - New `shelfmark/release_sources/jackett/` package: API client, settings tab, source and handler. - Searches Jackett's Torznab endpoints: the `all` aggregate by default, or each selected indexer individually. Failed or timed-out searches raise `SourceUnavailableError` instead of reporting "no releases found". - Reuses Prowlarr code rather than duplicating it: the Torznab parser (now also reads `<jackettindexer>`), `_prowlarr_result_to_release` (new optional `source`/`source_id` args), the release cache, URL/protocol helpers, the timeout clamp and size-limit helper (new optional config-key args), and the handler's `list_files` / retry-restore logic. - Downloads use the existing shared torrent client settings. - `JACKETT_URL` is a trusted origin for `.torrent` fetching (it is usually on the LAN). Prowlarr's `X-Api-Key` is not sent to it. - Added a Jackett section to `docs/environment-variables.md`. ## Screenshots <img width="1117" height="936" alt="Screenshot 2026-10-21 at 13-45-34 Shelfmark" src="https://github.com/user-attachments/assets/00339999-72c7-4226-bd9a-df8b325a7e22" /> <img width="1117" height="938" alt="Screenshot 2026-10-21 at 13-50-38 Shelfmark" src="https://github.com/user-attachments/assets/3c9cd2b4-932a-4b5c-9e10-6ec22b5f987d" /> <img width="1117" height="937" alt="Screenshot 2026-10-21 at 13-50-57 Shelfmark" src="https://github.com/user-attachments/assets/9c4d0ed9-da2f-4323-b188-341b45066efd" /> ## Not included - First-run onboarding does not offer Jackett yet. - No Jackett-specific category settings; it uses the standard 7000 / 3030 categories. ## Testing - New unit tests in `tests/jackett/` (client, source, handler) using mocked responses. - Full suite passes except 11 `tests/e2e` tests that also fail on a clean tree here (cannot write `/var/log/shelfmark`). - Tested against a live Jackett instance. Closes #1443 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
 dependabot[bot]
|
b8e466cc64 |
build(deps-dev): bump prek from 0.5.5 to 0.5.6 in the python-deps group (#1548)
Bumps the python-deps group with 1 update: [prek](https://github.com/j178/prek). Updates `prek` from 0.5.5 to 0.5.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.5.6</h2> <h2>Release Notes</h2> <p>Released on 2026-10-19.</p> <h3>Enhancements</h3> <ul> <li>Add builtin hook <code>check-commit-trailers</code> (<a href="https://redirect.github.com/j178/prek/pull/2885">#2885</a>)</li> <li>Add builtin hook <code>check-signed-commit</code> (<a href="https://redirect.github.com/j178/prek/pull/2725">#2725</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Enable PGO for native release builds (<a href="https://redirect.github.com/j178/prek/pull/2890">#2890</a>)</li> <li>Reduce hook process launches with balanced batches (<a href="https://redirect.github.com/j178/prek/pull/2907">#2907</a>)</li> <li>Resolve hook commands before batching (<a href="https://redirect.github.com/j178/prek/pull/2840">#2840</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Accept UTF-8 BOM in <code>check-json</code> (<a href="https://redirect.github.com/j178/prek/pull/2879">#2879</a>)</li> <li>Preserve unquoted dotted revisions in <code>prek update</code> (<a href="https://redirect.github.com/j178/prek/pull/2853">#2853</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document standalone installer options (<a href="https://redirect.github.com/j178/prek/pull/2859">#2859</a>)</li> <li>Update benchmarks for prek 0.5.5 (<a href="https://redirect.github.com/j178/prek/pull/2786">#2786</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Enable ICF for release builds (<a href="https://redirect.github.com/j178/prek/pull/2891">#2891</a>)</li> <li>Update uv to 0.13.0 (<a href="https://redirect.github.com/j178/prek/pull/2856">#2856</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/ebuildy"><code>@ebuildy</code></a></li> <li><a href="https://github.com/j178"><code>@j178</code></a></li> <li><a href="https://github.com/shaanmajid"><code>@shaanmajid</code></a></li> </ul> <h2>Install prek 0.5.6</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1 | iex" </code></pre> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/main/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.5.6</h2> <p>Released on 2026-10-19.</p> <h3>Enhancements</h3> <ul> <li>Add builtin hook <code>check-commit-trailers</code> (<a href="https://redirect.github.com/j178/prek/pull/2885">#2885</a>)</li> <li>Add builtin hook <code>check-signed-commit</code> (<a href="https://redirect.github.com/j178/prek/pull/2725">#2725</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Enable PGO for native release builds (<a href="https://redirect.github.com/j178/prek/pull/2890">#2890</a>)</li> <li>Reduce hook process launches with balanced batches (<a href="https://redirect.github.com/j178/prek/pull/2907">#2907</a>)</li> <li>Resolve hook commands before batching (<a href="https://redirect.github.com/j178/prek/pull/2840">#2840</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Accept UTF-8 BOM in <code>check-json</code> (<a href="https://redirect.github.com/j178/prek/pull/2879">#2879</a>)</li> <li>Preserve unquoted dotted revisions in <code>prek update</code> (<a href="https://redirect.github.com/j178/prek/pull/2853">#2853</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Document standalone installer options (<a href="https://redirect.github.com/j178/prek/pull/2859">#2859</a>)</li> <li>Update benchmarks for prek 0.5.5 (<a href="https://redirect.github.com/j178/prek/pull/2786">#2786</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Enable ICF for release builds (<a href="https://redirect.github.com/j178/prek/pull/2891">#2891</a>)</li> <li>Update uv to 0.13.0 (<a href="https://redirect.github.com/j178/prek/pull/2856">#2856</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/ebuildy"><code>@ebuildy</code></a></li> <li><a href="https://github.com/j178"><code>@j178</code></a></li> <li><a href="https://github.com/shaanmajid"><code>@shaanmajid</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/ee8a6cce37fe70d21281910e673bceddc003cb40"><code>ee8a6cc</code></a> Bump version to 0.5.6 (<a href="https://redirect.github.com/j178/prek/issues/2909">#2909</a>)</li> <li><a href="https://github.com/j178/prek/commit/36116817569560119b2891e4dcf061dbdcc8f16a"><code>3611681</code></a> Reduce hook process launches with balanced batches (<a href="https://redirect.github.com/j178/prek/issues/2907">#2907</a>)</li> <li><a href="https://github.com/j178/prek/commit/1af6b80acdee193effce67850897560530663008"><code>1af6b80</code></a> Use PR head commits for CI change detection</li> <li><a href="https://github.com/j178/prek/commit/29455ef294ce0abf416da951e1249b03e18c4460"><code>29455ef</code></a> Update dependency zensical to >=0.0.69 (<a href="https://redirect.github.com/j178/prek/issues/2896">#2896</a>)</li> <li><a href="https://github.com/j178/prek/commit/1fd9308df9d9fec874e1aad556ddd2dfa3e97e0d"><code>1fd9308</code></a> Update dependency prefix-dev/pixi to v0.81.0 (<a href="https://redirect.github.com/j178/prek/issues/2905">#2905</a>)</li> <li><a href="https://github.com/j178/prek/commit/140ab6b9654f938b3c496a580a6a859a7616df06"><code>140ab6b</code></a> Update docker.io/astral/uv Docker tag to v0.13.0 (<a href="https://redirect.github.com/j178/prek/issues/2906">#2906</a>)</li> <li><a href="https://github.com/j178/prek/commit/3574ba305692928d223e0154f44853fb0bedd196"><code>3574ba3</code></a> Update dependency cargo-zigbuild to >=0.23.4 (<a href="https://redirect.github.com/j178/prek/issues/2895">#2895</a>)</li> <li><a href="https://github.com/j178/prek/commit/7c23eaeabcbdfdae0b56d37eaddc2061a51a7d8f"><code>7c23eae</code></a> Update Rust crate async_zip to 0.0.22 (<a href="https://redirect.github.com/j178/prek/issues/2898">#2898</a>)</li> <li><a href="https://github.com/j178/prek/commit/09f486de46bd02c94d928e434fed8cdb45b64198"><code>09f486d</code></a> Update Rust crate indoc to v2.0.8 (<a href="https://redirect.github.com/j178/prek/issues/2899">#2899</a>)</li> <li><a href="https://github.com/j178/prek/commit/4d677216f0bb073883b8ab45384df517d3197e49"><code>4d67721</code></a> Update Rust crate tokio-util to v0.7.20 (<a href="https://redirect.github.com/j178/prek/issues/2901">#2901</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.5.5...v0.5.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>v1.5.1 |
||
|
dependabot[bot]
|
aa72850eab |
build(deps): bump the npm-deps group in /src/frontend with 6 updates (#1551)
Bumps the npm-deps group in /src/frontend with 6 updates: | Package | From | To | | --- | --- | --- | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.41.0` | `6.42.1` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.72.0` | `0.74.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.87.0` | `1.89.0` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.4` | `5.0.5` | Updates `react` from 19.3.0 to 19.3.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.3.1 (October 14th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Improve transport protocol (<a href="https://redirect.github.com/facebook/react/pull/37845">#37845</a> by <a href="https://github.com/unstubbable"><code>@unstubbable</code></a> and <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/61aa00df822d0eb76d0362eb8b6fdd3527693efe"><code>61aa00d</code></a> [19.3.x][Flight] Improve transport protocol (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/37845">#37845</a>)</li> <li>See full diff in <a href="https://github.com/react/react/commits/v19.3.1/packages/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 19.3.0 to 19.3.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.3.1 (October 14th, 2026)</h2> <h2>React Server Components</h2> <ul> <li>Improve transport protocol (<a href="https://redirect.github.com/facebook/react/pull/37845">#37845</a> by <a href="https://github.com/unstubbable"><code>@unstubbable</code></a> and <a href="https://github.com/eps1lon"><code>@eps1lon</code></a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/61aa00df822d0eb76d0362eb8b6fdd3527693efe"><code>61aa00d</code></a> [19.3.x][Flight] Improve transport protocol (<a href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/37845">#37845</a>)</li> <li>See full diff in <a href="https://github.com/react/react/commits/v19.3.1/packages/react-dom">compare view</a></li> </ul> </details> <br /> Updates `knip` from 6.41.0 to 6.42.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpro-nl/knip/releases">knip's releases</a>.</em></p> <blockquote> <h2>Release 6.42.1</h2> <ul> <li>fix(semantic-release): resolve shareable configs from extends (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2159">#2159</a>) (4c4a5ece9148cf621f3a6e091fd3550b18f6e19a) - thanks <a href="https://github.com/giaBaoJS"><code>@giaBaoJS</code></a>!</li> <li>fix(jest): load projects entries as Jest configs (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2167">#2167</a>) (4c22593724460890e4492ba86119d0188127f2ba) - thanks <a href="https://github.com/Cayan"><code>@Cayan</code></a>!</li> <li>Update npmx.dev snapshot (4b19797b77a559f7190e9119b3a156e1ac6aef9f)</li> <li>fix(tailwind): track packages referenced from CSS url() (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2166">#2166</a>) (949da00abf419c1eeabdab1541ce7e5c312371b9) - thanks <a href="https://github.com/agustincastaing"><code>@agustincastaing</code></a>!</li> <li>Add .otf to foreign file extensions (fcff4db0b88d6282569743cd779aec5a5df99862)</li> <li>Match quoted SCSS url() values within a single line (2c5c2a2efab8f08be538bfe1f40982cb6f0fca3c)</li> <li>fix(bun): treat bun test arguments as path filters (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2165">#2165</a>) (5f3a7fb526d3eca7561aacfc9d0ac60056525206) - thanks <a href="https://github.com/jakeleventhal"><code>@jakeleventhal</code></a>!</li> <li>fix(vitest): use default test entries when config has no test key (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2170">#2170</a>) (7ee576ccd461f719b533e3783a5b58391ce89e91) - thanks <a href="https://github.com/fixfon"><code>@fixfon</code></a>!</li> </ul> <h2>Release 6.42.0</h2> <ul> <li>fix: add bun 1.4.3 check subcommand (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2131">#2131</a>) (09129b8aaa554ffae2ff8f42a5ff4d6994eb7759) - thanks <a href="https://github.com/NimmLor"><code>@NimmLor</code></a>!</li> <li>Detect pnpm workspaces correctly around <code>packages:</code> (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2133">#2133</a>, close <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2134">#2134</a>) (d1cc0928be54e6cac9668460d9f6a21e3a94f818)</li> <li>fix(github-actions): resolve working-directory nested under checkout path (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2136">#2136</a>) (87e051e45f12c107cc25ed08bba962b95bb23b51) - thanks <a href="https://github.com/kenny-ish"><code>@kenny-ish</code></a>!</li> <li>fix(nx): track local generator and executor entry points (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2117">#2117</a>) (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2121">#2121</a>) (558407f51b5fdf4460275b69950676e7bace35d5) - thanks <a href="https://github.com/DreamLongYT"><code>@DreamLongYT</code></a>!</li> <li>Update dependency bun to v1.4.3 (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2137">#2137</a>) (71f90bf6d5fb2675430f60416e403851f9cb2cfe) - thanks <a href="https://github.com/renovate"><code>@renovate</code></a>[bot]!</li> <li>docs(react-router): note to run react-router typegen before Knip (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2140">#2140</a>) (f21ce9a9f1e3264cad1b763cf31ec2c177fb8656) - thanks <a href="https://github.com/MannXo"><code>@MannXo</code></a>!</li> <li>fix: normalize scoped binary names (close <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2143">#2143</a>) (c8509c4e45e1c343da707c26877a0a6584f6bc11)</li> <li>Clarify plugin implementation boundaries (c5a67f59d351e8d26dc6ecbbd3c3193e313772a4)</li> <li>fix(jest): treat mocked and required dependencies as used (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2141">#2141</a>) (3eaf1ba16045a3ac22f0717c4f1252312298bb76) - thanks <a href="https://github.com/TkDodo"><code>@TkDodo</code></a>!</li> <li>fix: preserve root-only plugins for trailing-slash cwd (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2139">#2139</a>) (7f0db0e7670bfd18fab081b522a104f787829f7d) - thanks <a href="https://github.com/sean0407"><code>@sean0407</code></a>!</li> <li>fix(nx): resolve run-commands script paths from the target cwd (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2151">#2151</a>) (516bd9a324303653978528f582287c857846fcc8) - thanks <a href="https://github.com/JeanBeaurepaire"><code>@JeanBeaurepaire</code></a>!</li> <li>Resolve Nx run-commands loader paths from the target cwd (fa8ca13e1345115d30122900ab68db7339487502)</li> <li>Add <code>@solidjs/vite-plugin</code> plugin (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2144">#2144</a>) (579a88d306429694be43590efb50cb72067551ba) - thanks <a href="https://github.com/everton-dgn"><code>@everton-dgn</code></a>!</li> <li>feat: add filesystem-routing plugin (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2145">#2145</a>) (1abd9e1875bae36b0baf77f5864aab849d1528a8) - thanks <a href="https://github.com/everton-dgn"><code>@everton-dgn</code></a>!</li> <li>Support tags in line comments (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1924">#1924</a>) (5abef4846e20f09fd4d0ee8dc2513ce50b616cdb)</li> <li>Keep resolveFromAST to static values in plugin guide (4cd353fd9ecb780228a63069080586a46ba6a8f2)</li> <li>fix(solidjs-vite-plugin): keep entry overrides in production (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2155">#2155</a>) (e4b5f890787da07824cc174cb624396f2133ff06) - thanks <a href="https://github.com/everton-dgn"><code>@everton-dgn</code></a>!</li> <li>feat(angular): resolve styleUrl and styleUrls of <a href="https://github.com/Component"><code>@Component</code></a> (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2157">#2157</a>) (c20d4d720c586c9c5dc6e3d1a6ea60c557688bfa) - thanks <a href="https://github.com/Cayan"><code>@Cayan</code></a>!</li> <li>Update npmx.dev snapshot (59eb873f3beecf40b7aed9579bd29e1ab8b631f0)</li> <li>fix(next): recognize Turbopack alias targets (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2156">#2156</a>) (1d44f6a1a39c5557c1e215c7cf9db17937967344) - thanks <a href="https://github.com/jakeleventhal"><code>@jakeleventhal</code></a>!</li> <li>fix: preserve re-exports from framework entries (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2154">#2154</a>) (263ce20408a77b2473c555f304ad3b55c696b6a6) - thanks <a href="https://github.com/jakeleventhal"><code>@jakeleventhal</code></a>!</li> <li>feat(solidjs-vite-plugin): follow Solid's SSR and client mode entry rules (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2148">#2148</a>) (d711231eae14d8ecac562d73078125f3b30dc8fd) - thanks <a href="https://github.com/everton-dgn"><code>@everton-dgn</code></a>!</li> <li>feat(filesystem-routing): read route options from Vite configs (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2149">#2149</a>) (585f206ca52d54e30f2068c818e1b33b50085459) - thanks <a href="https://github.com/everton-dgn"><code>@everton-dgn</code></a>!</li> <li>feat(filesystem-routing): resolve routes from the Vite root (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2150">#2150</a>) (8cc0cb0c9ff09463cad30817c8cf78cbc48b7ed6) - thanks <a href="https://github.com/everton-dgn"><code>@everton-dgn</code></a>!</li> <li>fix: track namespace members in Promise.all imports (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2162">#2162</a>) (3f17cdfce7a0f90e2599a7074291c4c875fe8244) - thanks <a href="https://github.com/everton-dgn"><code>@everton-dgn</code></a>!</li> <li>Update a few dependencies (161dbed3ccffa574e3a9493ddb20842eefa26af8)</li> <li>Fix Solid setup fixture coverage (ebe4180785667f6ff85c1e6ce2a11226713b2d5a)</li> <li>Migrate shell script parsing to unbash v6 (f86044c6760ac4f27e564f15feeae907cba3d297)</li> <li>Add sponsors: <a href="https://github.com/pennylane-hq"><code>@pennylane-hq</code></a>, <a href="https://github.com/agentscore"><code>@agentscore</code></a>, <a href="https://github.com/oblique-security"><code>@oblique-security</code></a> (thank you!) (57ff23eb430aaece73e02574923cabc6016a920b)</li> <li>Stop pairing Promise.all imports and bindings after a spread (5bd2c64eaf92f82a316d8fa6551acdb1d6c48c32)</li> <li>Update some stats (dd02ddeb235dd516cf93db99dda2180b0eb09a97)</li> <li>fix(nx): read karmaConfig from target options (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2164">#2164</a>) (4e1e4bc18f6d2f2705d729c375a20bd1679b8c0f) - thanks <a href="https://github.com/Cayan"><code>@Cayan</code></a>!</li> <li>Add tsrs plugin (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2163">#2163</a>) (ba09126c023a2c408de8d7dae3bf6ab97e420966) - thanks <a href="https://github.com/jakeleventhal"><code>@jakeleventhal</code></a>!</li> <li>Drop redundant containingFilePath from plugin config inputs (ffb6caf02891d29eee41c7a0ecf147312dbe7205)</li> <li>Resolve Nx target option configs from the workspace root (52c5233aa905124c5b30c0bb7f9b0b25cd4260c6)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpro-nl/knip/commit/ee32ee6ca4c8826ca45f306041d9f8c5ffdaa335"><code>ee32ee6</code></a> Release knip@6.42.1</li> <li><a href="https://github.com/webpro-nl/knip/commit/7ee576ccd461f719b533e3783a5b58391ce89e91"><code>7ee576c</code></a> fix(vitest): use default test entries when config has no test key (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2170">#2170</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/5f3a7fb526d3eca7561aacfc9d0ac60056525206"><code>5f3a7fb</code></a> fix(bun): treat bun test arguments as path filters (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2165">#2165</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/2c5c2a2efab8f08be538bfe1f40982cb6f0fca3c"><code>2c5c2a2</code></a> Match quoted SCSS url() values within a single line</li> <li><a href="https://github.com/webpro-nl/knip/commit/fcff4db0b88d6282569743cd779aec5a5df99862"><code>fcff4db</code></a> Add .otf to foreign file extensions</li> <li><a href="https://github.com/webpro-nl/knip/commit/949da00abf419c1eeabdab1541ce7e5c312371b9"><code>949da00</code></a> fix(tailwind): track packages referenced from CSS url() (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2166">#2166</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/4c22593724460890e4492ba86119d0188127f2ba"><code>4c22593</code></a> fix(jest): load projects entries as Jest configs (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2167">#2167</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/4c4a5ece9148cf621f3a6e091fd3550b18f6e19a"><code>4c4a5ec</code></a> fix(semantic-release): resolve shareable configs from extends (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2159">#2159</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/8aa7d0e281ecba684c35acf4effd072e90a8862d"><code>8aa7d0e</code></a> Release knip@6.42.0</li> <li><a href="https://github.com/webpro-nl/knip/commit/52c5233aa905124c5b30c0bb7f9b0b25cd4260c6"><code>52c5233</code></a> Resolve Nx target option configs from the workspace root</li> <li>Additional commits viewable in <a href="https://github.com/webpro-nl/knip/commits/knip@6.42.1/packages/knip">compare view</a></li> </ul> </details> <br /> Updates `oxfmt` from 0.72.0 to 0.74.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxfmt's releases</a>.</em></p> <blockquote> <h2>oxfmt v0.74.0</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>e236de0 formatter_tests: Skip conformance spec calls with non-literal options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27957">#27957</a>) (leaysgur)</li> <li>782ab6e linter: Search string values without UTF-8 conversion (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26716">#26716</a>) (Dunqing)</li> <li>a5d8184 jsdoc: Parse code spans after quotes in descriptions (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27955">#27955</a>) (leaysgur)</li> <li>2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27948">#27948</a>) (leaysgur)</li> <li>4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27947">#27947</a>) (leaysgur)</li> <li>529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27946">#27946</a>) (leaysgur)</li> <li>c22a9b2 formatter: Treat static block with only empty statements as empty (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27945">#27945</a>) (leaysgur)</li> <li>d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27823">#27823</a>) (leaysgur)</li> <li>c4c1727 formatter/sort_imports: Keep comments after the last import (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27822">#27822</a>) (leaysgur)</li> <li>a64677e formatter: Print JSDoc embedded snippets with LF (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27821">#27821</a>) (leaysgur)</li> <li>2c1cc20 formatter: Keep comment only Vue bindings as-is (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27820">#27820</a>) (leaysgur)</li> <li>1bf236d formatter/sort_imports: Do not use comments as import source (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27819">#27819</a>) (leaysgur)</li> <li>52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27818">#27818</a>) (leaysgur)</li> <li>81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27814">#27814</a>) (leaysgur)</li> <li>a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27812">#27812</a>) (leaysgur)</li> <li>de110ce formatter: Keep more parens around <code>TSInstantiationExpression</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27811">#27811</a>) (leaysgur)</li> <li>8b02e90 formatter_json: Reject invalid JSON instead of dropping them (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27785">#27785</a>) (leaysgur)</li> <li>6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27780">#27780</a>) (leaysgur)</li> <li>5605362 oxfmt: Validate editorconfig as like oxfmtrc (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27778">#27778</a>) (leaysgur)</li> <li>5b2acb0 formatter_core: Report error position releative to CRLF source (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27777">#27777</a>) (leaysgur)</li> <li>c78e80e formatter_core: Report parse error positions relative to the BOM-headed source (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27776">#27776</a>) (leaysgur)</li> <li>3a980c9 formatter_toml: Handle BOM like other languages (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27775">#27775</a>) (leaysgur)</li> <li>97c9fc4 oxfmt: Handle BOM in config JSON (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27774">#27774</a>) (leaysgur)</li> <li>28eb4a7 oxfmt: Print trailing newline for <code>--list-different</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27773">#27773</a>) (leaysgur)</li> <li>d2bea21 formatter: Glue comments to an opener in empty for-head slots and array holes (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27737">#27737</a>) (leaysgur)</li> <li>6a95ec1 formatter: Keep comment position on holey array (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27730">#27730</a>) (leaysgur)</li> <li>54769da formatter: Break after dangling line comment in holey array (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27729">#27729</a>) (leaysgur)</li> <li>99077ef formatter_json: Reject unary expressions other than signed numbers (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27728">#27728</a>) (leaysgur)</li> <li>22cd4cd formatter_json: Handle holey array and comments (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27727">#27727</a>) (leaysgur)</li> <li>644ca1c formatter: Do not indent logical chains whose right sides all inline (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27667">#27667</a>) (leaysgur)</li> <li>a07a0fb formatter: Wrap comment-only JSX expression container in a group (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27666">#27666</a>) (leaysgur)</li> </ul> <h3>⚡ Performance</h3> <ul> <li>e220293 formatter: Check only the operator suppression mark in <code>is_quiet</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27952">#27952</a>) (leaysgur)</li> <li>e5fdc9c formatter_core: Write into one element stack through a concrete <code>Formatter</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27559">#27559</a>) (leaysgur)</li> <li>a342f7e formatter: Skip comment handling for nodes with no comment near them (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27557">#27557</a>) (leaysgur)</li> <li>d8ce750 formatter: Write string literals with swapped quotes into the arena (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27558">#27558</a>) (Yuji Sugiura)</li> <li>1c393c0 formatter_core: Skip scanning texts with nothing to rewrite (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27561">#27561</a>) (leaysgur)</li> <li>1d3ef10 formatter_core: Keep the embedded IR when nothing in it is rewritten (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27673">#27673</a>) (leaysgur)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>1325225 oxfmt: Update useless comment prefix (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27956">#27956</a>) (leaysgur)</li> <li>d0dd140 formatter: Note lossy cooked round-trip in template embeds (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27944">#27944</a>) (leaysgur)</li> <li>8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27824">#27824</a>) (leaysgur)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/07ed78f4abde4020ca7919381ffea4da8616b78a"><code>07ed78f</code></a> release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27961">#27961</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/6941b4ed45ead21c45bc2164cb80a180eed85b43"><code>6941b4e</code></a> release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27643">#27643</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/a495e8241e4927a65f77c5e97b9f4dee4dbff5aa"><code>a495e82</code></a> feat(oxfmt): support <code>associations</code> config to specify language over filepath ...</li> <li><a href="https://github.com/oxc-project/oxc/commit/408d87f62893d5dc3eb3e0aa8a0b5e7e2eca32f3"><code>408d87f</code></a> docs(oxfmt): simplify oxfmtrc docs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27432">#27432</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/5db28facf7bfe71d36829381b176f1c611e816f0"><code>5db28fa</code></a> feat(oxfmt): support Astro via <code>prettier-plugin-astro@1.x</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27386">#27386</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/902e188b3518afede5fc2b9823e36d8a48af6fda"><code>902e188</code></a> docs(oxfmt): update how <code>embeddedLanguageFormatting</code> option works (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27362">#27362</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.74.0/npm/oxfmt">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.87.0 to 1.89.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxlint's releases</a>.</em></p> <blockquote> <h2>oxlint v1.89.0</h2> <h3>💥 BREAKING CHANGES</h3> <ul> <li>e3c1b11 ast: [<strong>BREAKING</strong>] Preserve lone surrogates in static property names (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27095">#27095</a>) (Dunqing)</li> <li>a0a987c ast: [<strong>BREAKING</strong>] Preserve lone surrogates in static member names (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26677">#26677</a>) (Dunqing)</li> </ul> <h3>🚀 Features</h3> <ul> <li>770ada4 linter: Mark vue 3 rules as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27717">#27717</a>) (Cam McHenry)</li> <li>ba38c1d linter: Mark react/react-hooks rules as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27701">#27701</a>) (Cam McHenry)</li> <li>d85a3ba linter: Mark promise rules as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27693">#27693</a>) (Cam McHenry)</li> <li>e71c88a linter: Mark node rule as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27692">#27692</a>) (Cam McHenry)</li> <li>7213f61 linter: Mark nextjs rules as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27691">#27691</a>) (Cam McHenry)</li> <li>d7c6b26 linter: Mark jsx-a11y rules as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27690">#27690</a>) (Cam McHenry)</li> <li>199dfdc linter: Mark jsdoc rules as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27689">#27689</a>) (Cam McHenry)</li> <li>780bff3 linter: Mark jest/vitest rules as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27672">#27672</a>) (Cam McHenry)</li> <li>6ae6859 linter: Mark import rules as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27671">#27671</a>) (Cam McHenry)</li> <li>b7a1df3 linter: Mark unicorn rules as recommended (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27670">#27670</a>) (Cam McHenry)</li> <li>c44a355 linter: Mark typescript rules as recommended from upstream (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27634">#27634</a>) (Cam McHenry)</li> <li>6b49dba linter: Mark eslint rules as recommended from upstream (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27632">#27632</a>) (Cam McHenry)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>7c47246 linter: Check module specifiers and string values that contain lone surrogates (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26717">#26717</a>) (Dunqing)</li> <li>782ab6e linter: Search string values without UTF-8 conversion (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26716">#26716</a>) (Dunqing)</li> <li>326904f linter/unicorn/no-useless-undefined: Allow <code>undefined</code> in <code>React.useRef</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25027">#25027</a>) (Chris Dokurno)</li> <li>f9cf165 linter/unicorn/prefer-spread: Ignore super method calls (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27868">#27868</a>) (camc314)</li> <li>00484e1 linter/eslint/prefer-const: Report destructuring assignments inside blocks (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27856">#27856</a>) (camc314)</li> <li>9c35461 linter/eslint/sort-vars: Report every out-of-order declaration (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27767">#27767</a>) (camc314)</li> <li>01e1c5e linter/unicorn/prefer-string-replace-all: Resolve regex variables (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27769">#27769</a>) (camc314)</li> <li>7f474d5 linter/eslint/no-loop-func: Detect writes after the loop (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27754">#27754</a>) (camc314)</li> <li>4b7fea6 linter/eslint/block-scoped-var: Ignore declarations without writes (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27760">#27760</a>) (camc314)</li> <li>2947917 linter/eslint/no-lonely-if: Check final else blocks in else-if chains (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27759">#27759</a>) (camc314)</li> <li>fc039b5 linter/eslint/sort-imports: Check imports after other statements (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27749">#27749</a>) (camc314)</li> <li>1acba97 linter/unicorn/prefer-at: Report slice index reads once (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27762">#27762</a>) (camc314)</li> <li>6190e26 linter/eslint/prefer-arrow-callback: Ignore functions used as conditional tests (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27533">#27533</a>) (Anzal Husain Abidi)</li> <li>b3cdaaf linter/eslint/sort-keys: Check computed identifier names (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27748">#27748</a>) (camc314)</li> <li>170e608 linter/unicorn/prefer-native-coercion-functions: Check object methods and function properties (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27750">#27750</a>) (camc314)</li> <li>9261df7 linter/unicorn/prefer-string-raw: Check object property values (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27758">#27758</a>) (camc314)</li> <li>ddea86b linter/eslint/prefer-template: Report separate nested concatenations (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27764">#27764</a>) (camc314)</li> <li>2c67197 linter/eslint/no-unused-vars: Count conditional calls in sequences as uses (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27755">#27755</a>) (camc314)</li> <li>7f22fa0 linter/unicorn/prefer-regexp-test: Check logical operands in boolean contexts (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27761">#27761</a>) (camc314)</li> <li>3c44398 linter/eslint/class-methods-use-this: Count this in parameter defaults (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27756">#27756</a>) (camc314)</li> <li>d85923f linter/eslint/no-param-reassign: Report rest parameter writes (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27765">#27765</a>) (camc314)</li> <li>8ea47bb linter/unicorn/prefer-type-error: Handle parenthesized type checks (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27766">#27766</a>) (camc314)</li> <li>e96856c linter/unicorn/catch-error-name: Check unused underscore-prefixed names (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27751">#27751</a>) (camc314)</li> <li>d8ca399 linter/unicorn/no-array-callback-reference: Ignore callback factory calls (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27763">#27763</a>) (camc314)</li> <li>1267ab8 linter/eslint/max-params: Count rest parameters (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27757">#27757</a>) (camc314)</li> <li>9ff25c3 linter/eslint/no-useless-assignment: Report dead stores to function parameters (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27735">#27735</a>) (camc314)</li> <li>ee5e730 linter/eslint/no-setter-return: Check setters in property descriptors (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27731">#27731</a>) (camc314)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's changelog</a>.</em></p> <blockquote> <h2>[1.89.0] - 2026-10-19</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27699">#27699</a>) (camc314)</li> </ul> <h2>[1.88.0] - 2026-10-13</h2> <h3>🚀 Features</h3> <ul> <li>3c361a7 linter/unicorn/prefer-query-selector: Add <code>allowWithVariables</code> option (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27346">#27346</a>) (Mikhail Baev)</li> </ul> <h2>[1.86.0] - 2026-09-28</h2> <h3>🚀 Features</h3> <ul> <li>9d80eed linter/react/only-export-components: Support <code>allowCompoundComponents</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27117">#27117</a>) (Kuroda Kayn)</li> <li>e05b155 linter: Add typescript/no-generated-empty-object-type (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26958">#26958</a>) (camc314)</li> </ul> <h2>[1.82.0] - 2026-09-07</h2> <h3>🚀 Features</h3> <ul> <li>6a0e19c linter/eslint/no-unmodified-loop-condition: Support <code>checkConditionalExpressions</code> option (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26249">#26249</a>) (camc314)</li> </ul> <h2>[1.81.0] - 2026-08-31</h2> <h3>📚 Documentation</h3> <ul> <li>d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26100">#26100</a>) (camc314)</li> </ul> <h2>[1.79.0] - 2026-08-18</h2> <h3>💥 BREAKING CHANGES</h3> <ul> <li>8c4552d linter: [<strong>BREAKING</strong>] Split react/react-compiler into per-category rules (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25500">#25500</a>) (Boshen)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>228e8e0 linter: Resolve inactive React compiler rules (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25830">#25830</a>) (Boshen)</li> <li>aa49d86 linter: Allow spread rule options in config types (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25675">#25675</a>) (ch3rry)</li> <li>36f8451 linter/eslint/no-eval: Align indirect default with ESLint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25656">#25656</a>) (camc314)</li> <li>beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25663">#25663</a>) (camc314)</li> <li>4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25660">#25660</a>) (camc314)</li> <li>285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25611">#25611</a>) (Mikhail Baev)</li> <li>4df5835 linter: Allow capitalized built-in calls (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25516">#25516</a>) (Boshen)</li> </ul> <h2>[1.78.0] - 2026-08-10</h2> <h3>🚀 Features</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/07ed78f4abde4020ca7919381ffea4da8616b78a"><code>07ed78f</code></a> release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27961">#27961</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/9a424c209ea0df16becbf3141d63bcc293ede237"><code>9a424c2</code></a> fix(oxlint,oxfmt): correct Node.js TypeScript support range (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27699">#27699</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/6941b4ed45ead21c45bc2164cb80a180eed85b43"><code>6941b4e</code></a> release(apps): oxlint v1.88.0 && oxfmt v0.73.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27643">#27643</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/3c361a7fb5c9fbbe940e489f2e315a187a19b565"><code>3c361a7</code></a> feat(linter/unicorn/prefer-query-selector): add <code>allowWithVariables</code> option (...</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.89.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Updates `vitest` from 5.0.4 to 5.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v5.0.5</h2> <h3> 🐞 Bug Fixes</h3> <ul> <li>Keep vite default <code>fs.deny</code> with api token file - by <a href="https://github.com/hi-ogawa"><code>@hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>Claude Opus 5.5</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11578">vitest-dev/vitest#11578</a> <a href="https://github.com/vitest-dev/vitest/commit/28dc1edfb"><!-- raw HTML omitted -->(28dc1)<!-- raw HTML omitted --></a></li> <li>Handle quoted file names in <code>--changed</code> - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11583">vitest-dev/vitest#11583</a> <a href="https://github.com/vitest-dev/vitest/commit/14921e962"><!-- raw HTML omitted -->(14921)<!-- raw HTML omitted --></a></li> <li>Add <code>data</code> to the <code>import.meta.hot</code> stub - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11590">vitest-dev/vitest#11590</a> <a href="https://github.com/vitest-dev/vitest/commit/3a8289ac3"><!-- raw HTML omitted -->(3a828)<!-- raw HTML omitted --></a></li> <li>Set <code>skip</code> in <code>skipIf</code>, ignore <code>undefined</code> options - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11591">vitest-dev/vitest#11591</a> <a href="https://github.com/vitest-dev/vitest/commit/d523a15f2"><!-- raw HTML omitted -->(d523a)<!-- raw HTML omitted --></a></li> <li>Skip builtin loading in async leak detector - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11598">vitest-dev/vitest#11598</a> <a href="https://github.com/vitest-dev/vitest/commit/fe86a64c6"><!-- raw HTML omitted -->(fe86a)<!-- raw HTML omitted --></a></li> <li>Keep the import frame in native loader errors - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11599">vitest-dev/vitest#11599</a> <a href="https://github.com/vitest-dev/vitest/commit/9697b3894"><!-- raw HTML omitted -->(9697b)<!-- raw HTML omitted --></a></li> <li>Run hook cleanups when a later hook fails - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11605">vitest-dev/vitest#11605</a> <a href="https://github.com/vitest-dev/vitest/commit/6c5a44720"><!-- raw HTML omitted -->(6c5a4)<!-- raw HTML omitted --></a></li> <li>Release mocks of finished test files - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11607">vitest-dev/vitest#11607</a> <a href="https://github.com/vitest-dev/vitest/commit/e9c3d72f0"><!-- raw HTML omitted -->(e9c3d)<!-- raw HTML omitted --></a></li> <li>Abort all running tests on cancel - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11606">vitest-dev/vitest#11606</a> <a href="https://github.com/vitest-dev/vitest/commit/6621a72d6"><!-- raw HTML omitted -->(6621a)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: <ul> <li>Ignore synthetic pagehide events - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11582">vitest-dev/vitest#11582</a> <a href="https://github.com/vitest-dev/vitest/commit/ca0813584"><!-- raw HTML omitted -->(ca081)<!-- raw HTML omitted --></a></li> <li>Run plugin buildStart on server creation - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11593">vitest-dev/vitest#11593</a> <a href="https://github.com/vitest-dev/vitest/commit/ea611e44c"><!-- raw HTML omitted -->(ea611)<!-- raw HTML omitted --></a></li> <li>Drop late connections of closed sessions - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11600">vitest-dev/vitest#11600</a> <a href="https://github.com/vitest-dev/vitest/commit/f161e6df2"><!-- raw HTML omitted -->(f161e)<!-- raw HTML omitted --></a></li> <li>Wait 30s for the browser to close - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11601">vitest-dev/vitest#11601</a> <a href="https://github.com/vitest-dev/vitest/commit/6498b666a"><!-- raw HTML omitted -->(6498b)<!-- raw HTML omitted --></a></li> <li>Run global setup once with instances - by <a href="https://github.com/sheremet-va"><code>@sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11596">vitest-dev/vitest#11596</a> <a href="https://github.com/vitest-dev/vitest/commit/8dd67c262"><!-- raw HTML omitted -->(8dd67)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>reporter</strong>: <ul> <li>End reason <code>&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);</code> on worker crash - by <a href="https://github.com/AriPerkkio"><code>@AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11568">vitest-dev/vitest#11568</a> <a href="https://github.com/vitest-dev/vitest/commit/6ae8e89ff"><!-- raw HTML omitted -->(6ae8e)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h5> <a href="https://github.com/vitest-dev/vitest/compare/v5.0.4...v5.0.5">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/7a825db43e2beca0b219d2eadaec334cb81af0c7"><code>7a825db</code></a> chore: release v5.0.5 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11609">#11609</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/6621a72d6ed371e43f80ff327f5063693bd6b1ad"><code>6621a72</code></a> fix: abort all running tests on cancel (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11606">#11606</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/e9c3d72f0c8d6867de06a3df43ea28a05eeec444"><code>e9c3d72</code></a> fix: release mocks of finished test files (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11607">#11607</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/8dd67c2625943d824e257b87ae57a14094e90eed"><code>8dd67c2</code></a> fix(browser): run global setup once with instances (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11596">#11596</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/6c5a447203a29a0708fbc5de4fb91ea501bdc395"><code>6c5a447</code></a> fix: run hook cleanups when a later hook fails (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11605">#11605</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/9697b3894f456b85db91f3824ebe833449305c04"><code>9697b38</code></a> fix: keep the import frame in native loader errors (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11599">#11599</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/6498b666a3ae8961f6f2a8abdc89015b6fd0b3aa"><code>6498b66</code></a> fix(browser): wait 30s for the browser to close (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11601">#11601</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/f161e6df2b3c0bc84982d374094379139e380791"><code>f161e6d</code></a> fix(browser): drop late connections of closed sessions (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11600">#11600</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/fe86a64c6c6aa75481bffe5880b5c4e35ea67927"><code>fe86a64</code></a> fix: skip builtin loading in async leak detector (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11598">#11598</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/6ae8e89ff0734cf476e30186a83aebe6771aa330"><code>6ae8e89</code></a> fix(reporter): end reason <code>'failed'</code> on worker crash (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11568">#11568</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
1c2eb4efec |
build(deps): bump the gh-actions group with 3 updates (#1552)
[//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps the gh-actions group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.38.3 to 4.39.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.39.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a> from github/update-v4.39.0-d63383a73</li> <li><a href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a> Update changelog for v4.39.0</li> <li><a href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a> from github/mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a> Rename <code>path</code> to <code>result</code> in tests</li> <li><a href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a> Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a> from github/mario-campos/automate-changenotes-assemble</li> <li><a href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a> from github/mbg/add-missing-changenotes</li> <li><a href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li> <li><a href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.38.3 to 4.39.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.39.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a> from github/update-v4.39.0-d63383a73</li> <li><a href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a> Update changelog for v4.39.0</li> <li><a href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a> from github/mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a> Rename <code>path</code> to <code>result</code> in tests</li> <li><a href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a> Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a> from github/mario-campos/automate-changenotes-assemble</li> <li><a href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a> from github/mbg/add-missing-changenotes</li> <li><a href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li> <li><a href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.39.0</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.39.1 - 21 Oct 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li> </ul> <h2>4.39.0 - 15 Oct 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.20.7. <a href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li> <li>The <code>codeql-action/analyze</code> step now validates that a correct argument for the <code>checkout_path</code> input has been provided. The <code>checkout_path</code> input must be set to the path where the repository that is being analyzed is checked out at on the runner, if that path is something other than the workspace root. If the path does not point to a repository checkout or is different from the path that was used by <code>codeql-action/init</code>, then the CodeQL Action now produces a warning. <a href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li> <li>Resolved an issue with third-party caching implementations that prevented caches from being restored correctly. <a href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li> <li>The <code>codeql-action/start-proxy</code> step that is used in Code Scanning Default Setup now finds CodeQL releases using the same logic as <code>codeql-action/init</code>. This primarily benefits customers who are using GitHub instances other than <code>github.com</code> where the <code>codeql-action/start-proxy</code> step may previously have been unable to locate recent releases and ended up using outdated versions of the private registry authentication proxy as a result. <a href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li> </ul> <h2>4.38.3 - 08 Oct 2026</h2> <ul> <li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier were discontinued on 24 September 2026 alongside GitHub Enterprise Server 3.17, and will be unsupported by the next minor release of the CodeQL Action. Added a deprecation warning for customers using these versions of CodeQL. <a href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li> <li>Fixed a bug where the decision of whether to use a per-language bundle did not account for custom configurations that reference queries outside of compiled CodeQL packs. This issue was caught during internal testing and did not affect any customer repositories. We will resume the roll out of per-language bundles in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li> </ul> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a> from github/update-v4.39.0-d63383a73</li> <li><a href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a> Trigger workflows</li> <li><a href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a> Update changelog for v4.39.0</li> <li><a href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a> from github/mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a> Rename <code>path</code> to <code>result</code> in tests</li> <li><a href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a> Merge remote-tracking branch 'origin/main' into mbg/start-proxy/report-version</li> <li><a href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a> from github/mario-campos/automate-changenotes-assemble</li> <li><a href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a> from github/mbg/add-missing-changenotes</li> <li><a href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li> <li><a href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a> Add change note for <a href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
3ff6d88681 |
build(deps): bump astral-sh/uv from 0.12.24 to 0.13.5 in the docker-base-image-digests group (#1550)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.12.24 to 0.13.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.13.5</h2> <h2>Release Notes</h2> <p>Released on 2026-10-21.</p> <p>Following <a href="https://github.com/astral-sh/uv/releases/tag/0.13.4">uv 0.13.4</a>, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to <a href="https://github.com/astral-sh/python-build-standalone/releases/tag/20261021">python-build-standalone 20261021</a>, including the CPython <a href="https://www.python.org/downloads/release/python-3151/">3.15.1</a>, <a href="https://www.python.org/downloads/release/python-3149/">3.14.9</a>, and <a href="https://www.python.org/downloads/release/python-31317/">3.13.17</a> security patch releases. These builds include <a href="https://pip.pypa.io/en/stable/news/#v26-2-2">pip 26.2.2</a> both preinstalled in the managed interpreter and bundled with <code>ensurepip</code>, which installs pip by default when you run <code>python -m venv</code>. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run <code>uv python upgrade</code> to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.</p> <p>Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.</p> <h3>Enhancements</h3> <ul> <li>Report incompatible self-dependencies directly in resolution errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21845">#21845</a>)</li> </ul> <h3>Python</h3> <ul> <li>Add CPython 3.15.1, 3.14.9, and 3.13.17 (<a href="https://redirect.github.com/astral-sh/uv/pull/22802">#22802</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with <code>wheel-variants</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22535">#22535</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22536">#22536</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22687">#22687</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22688">#22688</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce peak memory use when resolving dependencies across multiple environments (<a href="https://redirect.github.com/astral-sh/uv/pull/22769">#22769</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22770">#22770</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22784">#22784</a>)</li> <li>Speed up exports with complex transitive extras by resolving activation across the dependency graph (<a href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li> <li>Reduce uv's binary size by keeping additional error formatters out of line (<a href="https://redirect.github.com/astral-sh/uv/pull/22775">#22775</a>)</li> <li>Reduce overhead when parsing custom build cache keys (<a href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Lock packages distributed only as Android wheels without a source distribution (<a href="https://redirect.github.com/astral-sh/uv/pull/22806">#22806</a>)</li> <li>Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (<a href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li> <li>Reject invalid custom build cache keys instead of silently falling back to the defaults (<a href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li> </ul> <h3>Security</h3> <ul> <li>Reject certificate chains containing compromised eMudhra intermediate keys via <code>rustls-webpki</code> 0.103.16 (<a href="https://redirect.github.com/astral-sh/uv/pull/22777">#22777</a>)</li> <li>Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (<a href="https://redirect.github.com/astral-sh/uv/pull/22773">#22773</a>)</li> </ul> <h2>Install uv 0.13.5</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.5/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code></tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.13.5</h2> <p>Released on 2026-10-21.</p> <p>Following <a href="https://github.com/astral-sh/uv/releases/tag/0.13.4">uv 0.13.4</a>, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to <a href="https://github.com/astral-sh/python-build-standalone/releases/tag/20261021">python-build-standalone 20261021</a>, including the CPython <a href="https://www.python.org/downloads/release/python-3151/">3.15.1</a>, <a href="https://www.python.org/downloads/release/python-3149/">3.14.9</a>, and <a href="https://www.python.org/downloads/release/python-31317/">3.13.17</a> security patch releases. These builds include <a href="https://pip.pypa.io/en/stable/news/#v26-2-2">pip 26.2.2</a> both preinstalled in the managed interpreter and bundled with <code>ensurepip</code>, which installs pip by default when you run <code>python -m venv</code>. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run <code>uv python upgrade</code> to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.</p> <p>Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.</p> <h3>Enhancements</h3> <ul> <li>Report incompatible self-dependencies directly in resolution errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21845">#21845</a>)</li> </ul> <h3>Python</h3> <ul> <li>Add CPython 3.15.1, 3.14.9, and 3.13.17 (<a href="https://redirect.github.com/astral-sh/uv/pull/22802">#22802</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with <code>wheel-variants</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22535">#22535</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22536">#22536</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22687">#22687</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22688">#22688</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce peak memory use when resolving dependencies across multiple environments (<a href="https://redirect.github.com/astral-sh/uv/pull/22769">#22769</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22770">#22770</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22784">#22784</a>)</li> <li>Speed up exports with complex transitive extras by resolving activation across the dependency graph (<a href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li> <li>Reduce uv's binary size by keeping additional error formatters out of line (<a href="https://redirect.github.com/astral-sh/uv/pull/22775">#22775</a>)</li> <li>Reduce overhead when parsing custom build cache keys (<a href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Lock packages distributed only as Android wheels without a source distribution (<a href="https://redirect.github.com/astral-sh/uv/pull/22806">#22806</a>)</li> <li>Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (<a href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li> <li>Reject invalid custom build cache keys instead of silently falling back to the defaults (<a href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li> </ul> <h3>Security</h3> <ul> <li>Reject certificate chains containing compromised eMudhra intermediate keys via <code>rustls-webpki</code> 0.103.16 (<a href="https://redirect.github.com/astral-sh/uv/pull/22777">#22777</a>)</li> <li>Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (<a href="https://redirect.github.com/astral-sh/uv/pull/22773">#22773</a>)</li> </ul> <h2>0.13.4</h2> <p>Released on 2026-10-20.</p> <h3>Preview features</h3> <ul> <li>Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under <code>wheel-variants</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22512">#22512</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Update the bundled Mozilla root certificates via <code>webpki-root-certs</code> 1.0.10 (<a href="https://redirect.github.com/astral-sh/uv/pull/22760">#22760</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/46776a95d6686ac0160c10611327ce491e6b202f"><code>46776a9</code></a> Use checked-in Python metadata for trampoline checks (<a href="https://redirect.github.com/astral-sh/uv/issues/22811">#22811</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/5babfa90b420ea12a611554f8cbbb41d433534be"><code>5babfa9</code></a> Use checked-in Python download metadata for releases (<a href="https://redirect.github.com/astral-sh/uv/issues/22810">#22810</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/06fbc976b1462d56bc83609e1c26250740e9c656"><code>06fbc97</code></a> Reject Cargo.lock changes from forks (<a href="https://redirect.github.com/astral-sh/uv/issues/22381">#22381</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/b3c01fd5745ab459863b83380dbd79621073a797"><code>b3c01fd</code></a> Prepare 0.13.5 (<a href="https://redirect.github.com/astral-sh/uv/issues/22809">#22809</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a02d446bcddd8a00c98084709b6bdccbc9a8208f"><code>a02d446</code></a> Update to include Python 3.15.1, 3.14.9, 3.13.17 (<a href="https://redirect.github.com/astral-sh/uv/issues/22802">#22802</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0ee565f1d755dfa5d7ba78db287ed342ec3e4d4b"><code>0ee565f</code></a> Reproduce local-version marker rendering panic (<a href="https://redirect.github.com/astral-sh/uv/issues/22807">#22807</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e3810e1e6daf06095ac58a27dd422eb095ea4ed6"><code>e3810e1</code></a> Infer platform markers from Android wheel tags (<a href="https://redirect.github.com/astral-sh/uv/issues/22806">#22806</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/75698b1ed23dd410421de4656304077351641fa7"><code>75698b1</code></a> Update rustup in Docker builders (<a href="https://redirect.github.com/astral-sh/uv/issues/22803">#22803</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/1765e51d67f43299d8fbd37b302b773a80c8499d"><code>1765e51</code></a> Replace actions/attest-build-provenance action with actions/attest v4.2.2 (<a href="https://redirect.github.com/astral-sh/uv/issues/2">#2</a>...</li> <li><a href="https://github.com/astral-sh/uv/commit/0abe802a1a07417f5163e57549c93c132cd7db3f"><code>0abe802</code></a> Update Rust crate test-log to v0.2.21 (<a href="https://redirect.github.com/astral-sh/uv/issues/19721">#19721</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.24...0.13.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
eb84426890 |
build(deps): bump werkzeug from 3.1.8 to 3.1.9 (#1553)
Bumps [werkzeug](https://github.com/pallets/werkzeug) from 3.1.8 to 3.1.9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pallets/werkzeug/releases">werkzeug's releases</a>.</em></p> <blockquote> <h2>3.1.9</h2> <p>This is the Werkzeug 3.1.9 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.</p> <p>PyPI: <a href="https://pypi.org/project/Werkzeug/3.1.9/">https://pypi.org/project/Werkzeug/3.1.9/</a> Changes: <a href="https://werkzeug.palletsprojects.com/page/changes/#version-3-1-9">https://werkzeug.palletsprojects.com/page/changes/#version-3-1-9</a> Milestone: <a href="https://github.com/pallets/werkzeug/milestone/46?closed=1">https://github.com/pallets/werkzeug/milestone/46?closed=1</a></p> <ul> <li><code>safe_join</code> on Windows does not allow special devices names with empty ADS markers on NTFS. <a href="https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m">https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m</a></li> <li><code>ProfilerMiddleware</code> uses <code>profiling.tracing</code> on Python 3.15. <a href="https://redirect.github.com/pallets/werkzeug/issues/3207">#3207</a></li> <li><code>uri_to_iri</code> and <code>iri_to_uri</code> preserve empty username, password, and port 0. <a href="https://redirect.github.com/pallets/werkzeug/issues/3189">#3189</a></li> <li>Improve performance of <code>parse_options_header</code>. <a href="https://redirect.github.com/pallets/werkzeug/issues/3231">#3231</a></li> <li>Improve performance of <code>parse_etags</code>. <a href="https://redirect.github.com/pallets/werkzeug/issues/3231">#3231</a></li> <li>Improve performance of <code>parse_cookie</code>. <a href="https://redirect.github.com/pallets/werkzeug/issues/3231">#3231</a></li> <li><code>get_host</code> also checks that the port is in the valid range. <a href="https://redirect.github.com/pallets/werkzeug/issues/3236">#3236</a></li> <li>The <code>int</code> URL converter returns a 404 instead of 500 error when the value is longer than <code>sys.get_int_max_str_digits()</code>. <a href="https://redirect.github.com/pallets/werkzeug/issues/3237">#3237</a></li> <li>Improve debugger PIN generation from cgroup data inside Podman. <a href="https://redirect.github.com/pallets/werkzeug/issues/3245">#3245</a></li> <li><code>Authorization</code> parsing <code>basic</code> auth disallows non-base64 characters. <a href="https://redirect.github.com/pallets/werkzeug/issues/3248">#3248</a></li> <li><code>application/x-www-form-urlencoded</code> form data is no longer limited to <code>max_form_memory_size</code>, only <code>max_content_length</code>. <a href="https://redirect.github.com/pallets/werkzeug/issues/3251">#3251</a></li> <li><code>LimitedStream.readinto</code> does not resize the buffer when it reads less than the remaining size. <a href="https://redirect.github.com/pallets/werkzeug/issues/3253">#3253</a></li> <li>Rules with 10 or more converters in a single part assign matched values correctly. <a href="https://redirect.github.com/pallets/werkzeug/issues/3254">#3254</a></li> <li>The invalid <code>Range</code> suffix length <code>-0</code> is no longer accepted. <a href="https://redirect.github.com/pallets/werkzeug/issues/3255">#3255</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pallets/werkzeug/blob/main/CHANGES.rst">werkzeug's changelog</a>.</em></p> <blockquote> <h2>Version 3.1.9</h2> <p>Released 2026-09-27</p> <ul> <li><code>safe_join</code> on Windows does not allow special devices names with empty ADS markers on NTFS. :ghsa:<code>g6x2-hccm-hh4m</code></li> <li><code>ProfilerMiddleware</code> uses <code>profiling.tracing</code> on Python 3.15. :issue:<code>3207</code></li> <li><code>uri_to_iri</code> and <code>iri_to_uri</code> preserve empty username, password, and port 0. :issue:<code>3189</code></li> <li>Improve performance of <code>parse_options_header</code>. :pr:<code>3231</code></li> <li>Improve performance of <code>parse_etags</code>. :pr:<code>3231</code></li> <li>Improve performance of <code>parse_cookie</code>. :pr:<code>3231</code></li> <li><code>get_host</code> also checks that the port is in the valid range. :pr:<code>3236</code></li> <li>The <code>int</code> URL converter returns a 404 instead of 500 error when the value is longer than <code>sys.get_int_max_str_digits()</code>. :issue:<code>3237</code></li> <li>Improve debugger PIN generation from cgroup data inside Podman. :issue:<code>3245</code></li> <li><code>Authorization</code> parsing <code>basic</code> auth disallows non-base64 characters. :pr:<code>3248</code></li> <li><code>application/x-www-form-urlencoded</code> form data is no longer limited to <code>max_form_memory_size</code>, only <code>max_content_length</code>. :pr:<code>3251</code></li> <li><code>LimitedStream.readinto</code> does not resize the buffer when it reads less than the remaining size. :pr:<code>3253</code></li> <li>Rules with 10 or more converters in a single part assign matched values correctly. :pr:<code>3254</code></li> <li>The invalid <code>Range</code> suffix length <code>-0</code> is no longer accepted. :pr:<code>3255</code></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pallets/werkzeug/commit/6604c3b8784ecc7cf5ac0b7412d916989b4c7d45"><code>6604c3b</code></a> release version 3.1.9</li> <li><a href="https://github.com/pallets/werkzeug/commit/a78b30ac0cafe53a4f252ffbf827bf6da7591341"><code>a78b30a</code></a> update dependencies</li> <li><a href="https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6"><code>8d77320</code></a> disallow special name with ads (<a href="https://redirect.github.com/pallets/werkzeug/issues/3309">#3309</a>)</li> <li><a href="https://github.com/pallets/werkzeug/commit/b2a2c09730086ab2d375f0b069c821d4edf526b7"><code>b2a2c09</code></a> disallow special name with ads</li> <li><a href="https://github.com/pallets/werkzeug/commit/4efac9df7ebabe13f82ab0823d5ca0109db20bc3"><code>4efac9d</code></a> add links</li> <li><a href="https://github.com/pallets/werkzeug/commit/400c23e01953311bb0959586f7194191732b18bc"><code>400c23e</code></a> Allow flit_core 4.x (<a href="https://redirect.github.com/pallets/werkzeug/issues/3261">#3261</a>)</li> <li><a href="https://github.com/pallets/werkzeug/commit/7132a19c26320ae01076d2743df42b9913bbe1d7"><code>7132a19</code></a> allow flit_core 4</li> <li><a href="https://github.com/pallets/werkzeug/commit/6fba87c311e55b4afcef71393a1733498b16676f"><code>6fba87c</code></a> only accept ASCII digits</li> <li><a href="https://github.com/pallets/werkzeug/commit/263f5caf2e26ebd85e38f899628c22f6813c7a2f"><code>263f5ca</code></a> disallow range -0 (<a href="https://redirect.github.com/pallets/werkzeug/issues/3255">#3255</a>)</li> <li><a href="https://github.com/pallets/werkzeug/commit/0c419f951f3206c89e7c95155f0bd771b02a961f"><code>0c419f9</code></a> disallow range -0</li> <li>Additional commits viewable in <a href="https://github.com/pallets/werkzeug/compare/3.1.8...3.1.9">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/calibrain/shelfmark/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
splitsec2
|
67a969d953 |
ci(codeql): skip the tests directory (#1557)
CodeQL scans `tests/`, which only runs in CI and the e2e docker stack. That is where the open `py/full-ssrf` (critical) and the two `py/reflective-xss` alerts come from, all in the e2e mock server, plus four `py/incomplete-url-substring-sanitization` alerts on URL asserts. None of them can reach a running instance. This adds `.github/codeql/codeql-config.yml` with `paths-ignore: tests` and points the init step at it. It closes those seven and hides nothing in `shelfmark/` or the frontend. The rest of the open alerts are unchanged. @calibrain I know I have ability to merge this, but wanted you to be the one for this. It clears the test alerts and leaves the rest, and prevents you from having to clear them manually. Just a little QoL. |
||
|
dependabot[bot]
|
193351c5a0 |
build(deps): bump certifi from 2026.7.22 to 2026.10.19 (#1554)
Bumps [certifi](https://github.com/certifi/python-certifi) from 2026.7.22 to 2026.10.19. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914"><code>662df63</code></a> Restore unaffected emSign roots (<a href="https://redirect.github.com/certifi/python-certifi/issues/439">#439</a>) (<a href="https://redirect.github.com/certifi/python-certifi/issues/440">#440</a>)</li> <li><a href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8"><code>5cb238c</code></a> Remove emsign (<a href="https://redirect.github.com/certifi/python-certifi/issues/437">#437</a>)</li> <li><a href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6"><code>69494a7</code></a> Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a href="https://redirect.github.com/certifi/python-certifi/issues/436">#436</a>)</li> <li><a href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536"><code>029c7b0</code></a> Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a href="https://redirect.github.com/certifi/python-certifi/issues/435">#435</a>)</li> <li><a href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6"><code>9d0a8f1</code></a> Add support for Python 3.15 (<a href="https://redirect.github.com/certifi/python-certifi/issues/432">#432</a>)</li> <li><a href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c"><code>db472ab</code></a> Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a href="https://redirect.github.com/certifi/python-certifi/issues/431">#431</a>)</li> <li>See full diff in <a href="https://github.com/certifi/python-certifi/compare/2026.07.22...2026.10.19">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/calibrain/shelfmark/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
splitsec2
|
e33803cac2 |
build(deps): update socket.io-parser, ws and baseline-browser-mapping in the lockfiles (#1560)
Dependabot has four open npm alerts and no PRs for them, since they are all transitive. This updates the lockfiles only, no package.json change. | Package | From | To | Alert | |---|---|---|---| | socket.io-parser | 4.2.6 | 4.2.7 | zero-attachment memory exhaustion (high) | | ws | 8.18.3 | 8.21.3 | memory exhaustion DoS (high) and uninitialized memory disclosure (medium) | | engine.io-client | 6.6.4 | 6.6.7 | needed to get ws past its `~8.18` range | | baseline-browser-mapping | 2.9.19 | 2.11.31 | process termination on invalid input (medium, dev only) | I think the practical risk was low to begin with, since ws is only used by engine.io-client under Node and the built bundle doesn't include it. Still, it clears the alerts and the bumps are small. Done with npm 11 so the `libc` fields in the lockfile stay as they were. A clean `npm ci` from the new lockfile gives 0 vulnerabilities, and `tsc`, `vitest` (241 tests) and `vite build` all pass. |
||
|
dependabot[bot]
|
00c03e3058 |
build(deps): bump oauthlib from 3.3.1 to 4.0.0 (#1556)
Bumps [oauthlib](https://github.com/oauthlib/oauthlib) from 3.3.1 to 4.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oauthlib/oauthlib/releases">oauthlib's releases</a>.</em></p> <blockquote> <h2>4.0.0</h2> <h2>Introduction</h2> <p>The release 4.0.0 defines the foundation that enables AI contributions and will improve the maintenance of oauthlib by using AI agents, skills, code for both contributors and maintainers. It includes devcontainer, skills and cleanup of instructions.</p> <h2>What's Changed</h2> <p><strong>Important</strong>: this release contains 2 breaking changes. See CHANGELOG.rst for details:</p> <ul> <li>Removed JSONP support from token revocation endpoint (<a href="https://redirect.github.com/oauthlib/oauthlib/issues/951">#951</a>)</li> <li>Client authentication validation reorganized across grants (<a href="https://redirect.github.com/oauthlib/oauthlib/issues/919">#919</a>, <a href="https://redirect.github.com/oauthlib/oauthlib/issues/920">#920</a>): the <code>grant_type</code> parameter is now validated before client authentication.</li> </ul> <ul> <li>Replace pyenv with uv in documentation and tooling by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/910">oauthlib/oauthlib#910</a></li> <li>Improve github action to publish package by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/915">oauthlib/oauthlib#915</a></li> <li>Add pre-commit to run linters, formatters, etc. on code changes by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/918">oauthlib/oauthlib#918</a></li> <li>Fix client authentication for DeviceCodeGrant when getting a token by <a href="https://github.com/hekhuisk"><code>@hekhuisk</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/920">oauthlib/oauthlib#920</a></li> <li>Add project URLs to this project's PyPI page by <a href="https://github.com/Flimm"><code>@Flimm</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/921">oauthlib/oauthlib#921</a></li> <li>Fix a typo in ServiceApplicationClient docstring. by <a href="https://github.com/rafalkrupinski"><code>@rafalkrupinski</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/923">oauthlib/oauthlib#923</a></li> <li>Correct grammar in function help by <a href="https://github.com/verhovsky"><code>@verhovsky</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/924">oauthlib/oauthlib#924</a></li> <li>Add Python 3.14 to the testing by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/925">oauthlib/oauthlib#925</a></li> <li>Initial python/uv/tox devcontainer by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/930">oauthlib/oauthlib#930</a></li> <li>Fix ruff checks about unused variables by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/931">oauthlib/oauthlib#931</a></li> <li>Drop EOL Python 3.8 from CI by <a href="https://github.com/auvipy"><code>@auvipy</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/932">oauthlib/oauthlib#932</a></li> <li>Set Open Collective username to 'oauthlib' by <a href="https://github.com/auvipy"><code>@auvipy</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/933">oauthlib/oauthlib#933</a></li> <li>pre-commit autoupdate 2026_02_21 by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/934">oauthlib/oauthlib#934</a></li> <li>Remove a trailing whitespace fo fix failing pre-commit by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/935">oauthlib/oauthlib#935</a></li> <li>Fix typos discovered by typos by <a href="https://github.com/cclauss"><code>@cclauss</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/938">oauthlib/oauthlib#938</a></li> <li>Add <code>resource</code> to Request._params by <a href="https://github.com/juannyG"><code>@juannyG</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/942">oauthlib/oauthlib#942</a></li> <li>Release 3.4.0: Add OAuthLib Maintainer agent by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/950">oauthlib/oauthlib#950</a></li> <li>Remove JSONP support from token revocation by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/951">oauthlib/oauthlib#951</a></li> <li>Improve PKCE code comparison by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/963">oauthlib/oauthlib#963</a></li> <li>Release 4.0.0: bump and update changelog by <a href="https://github.com/JonathanHuot"><code>@JonathanHuot</code></a> in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/976">oauthlib/oauthlib#976</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/hekhuisk"><code>@hekhuisk</code></a> made their first contribution in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/920">oauthlib/oauthlib#920</a></li> <li><a href="https://github.com/Flimm"><code>@Flimm</code></a> made their first contribution in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/921">oauthlib/oauthlib#921</a></li> <li><a href="https://github.com/verhovsky"><code>@verhovsky</code></a> made their first contribution in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/924">oauthlib/oauthlib#924</a></li> <li><a href="https://github.com/juannyG"><code>@juannyG</code></a> made their first contribution in <a href="https://redirect.github.com/oauthlib/oauthlib/pull/942">oauthlib/oauthlib#942</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/oauthlib/oauthlib/compare/v3.3.1...v4.0.0">https://github.com/oauthlib/oauthlib/compare/v3.3.1...v4.0.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oauthlib/oauthlib/blob/master/CHANGELOG.rst">oauthlib's changelog</a>.</em></p> <blockquote> <h2>4.0.0 (2026-09-28):</h2> <p>OAuth2.0 Provider:</p> <ul> <li><strong>Breaking</strong>: <a href="https://redirect.github.com/oauthlib/oauthlib/issues/951">#951</a>: Removed JSONP support from token revocation endpoint. JSONP has been superseded by CORS for cross-origin requests. The <code>enable_jsonp</code> parameter has been removed from <code>RevocationEndpoint</code> and the <code>callback</code> parameter has been removed from <code>prepare_token_revocation_request</code>.</li> <li><strong>Breaking</strong>: <a href="https://redirect.github.com/oauthlib/oauthlib/issues/919">#919</a>, <a href="https://redirect.github.com/oauthlib/oauthlib/issues/920">#920</a>: Fixed <code>DeviceCodeGrant.validate_token_request</code> trying to authenticate public clients. Client authentication validation has been reorganized and is now shared across <code>AuthorizationCodeGrant</code>, <code>DeviceCodeGrant</code>, <code>RefreshTokenGrant</code> and <code>ResourceOwnerPasswordCredentialsGrant</code>: the <code>grant_type</code> parameter is validated before client authentication, so requests missing <code>grant_type</code> now return <code>400 invalid_request</code> instead of <code>401 invalid_client</code>.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/963">#963</a>: Improved PKCE code comparison</li> </ul> <p>Misc:</p> <ul> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/904">#904</a>: Stop installing <code>examples</code> into <code>site-packages</code>.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/930">#930</a>: Add devcontainer, Add Python3.14, Python3.14t.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/931">#931</a>: Fix ruff checks about unused variables.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/932">#932</a>: Dropped EOL Python 3.8 from CI.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/934">#934</a>: Pre-commit hooks autoupdate.</li> <li><a href="https://redirect.github.com/oauthlib/oauthlib/issues/938">#938</a>: Fix typos discovered by typos.</li> <li>Add OAuthLib Maintainer agent for automated issue/PR triage and release management.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oauthlib/oauthlib/commit/145a9a4690cb4d9de30d15fcc2984e34c49df741"><code>145a9a4</code></a> Release 4.0.0: clarify changelog breaking changes and reformat entries</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/c8344d61492c7ae708cf378ecabab7ee6ab62812"><code>c8344d6</code></a> Update CHANGELOG.rst</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/e172830efd66a2dc1bb34b3bbbf8ee53036a9dac"><code>e172830</code></a> Release 4.0.0: bump version to 4.0.0 and update changelog</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950"><code>40b0ab5</code></a> Merge pull request <a href="https://redirect.github.com/oauthlib/oauthlib/issues/963">#963</a> from oauthlib/ft/pkcecode</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/1b68ceaae02fe62aeaaa3468a8f8082c73830a3a"><code>1b68cea</code></a> Merge pull request <a href="https://redirect.github.com/oauthlib/oauthlib/issues/920">#920</a> from hekhuisk/validate-client-authentication</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d"><code>c951a1d</code></a> Organized validate_client functions for all grant to avoid mistake in grnat i...</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0"><code>74664d3</code></a> Improve PKCE code comparison</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/9859b057ecc5d1ad42711af7d58ee471d708ea36"><code>9859b05</code></a> Merge pull request <a href="https://redirect.github.com/oauthlib/oauthlib/issues/950">#950</a> from oauthlib/feature/3.4.0-maintainer-agent</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/9bf9b974e0797d2d03cba05854f46e314c730ba6"><code>9bf9b97</code></a> Merge branch 'master' into feature/3.4.0-maintainer-agent</li> <li><a href="https://github.com/oauthlib/oauthlib/commit/1ba7429ad79019289540fd7be27866d7e59f2564"><code>1ba7429</code></a> Clarify agent instructions</li> <li>Additional commits viewable in <a href="https://github.com/oauthlib/oauthlib/compare/v3.3.1...v4.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/calibrain/shelfmark/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
splitsec2
|
3633dd3d97 |
fix: keep file links and API keys out of AllDebrid logs, fix Newznab debug log (#1559)
Two log fixes in the same area, both found while going through the open
code scanning alerts.
AllDebrid: the unlock path logged the file link in full. The last-resort
fallback appends `apikey=` to the link and returns it, and the "Failed
to download from ..." error carries that same link into
`logger.exception`, so the key could land in the log and the traceback.
The links are now logged through `_safe_url` (scheme, host and path
only). The GET unlock fallback also logged the exception text at debug
level, and requests puts the request URL in that message, which includes
`apikey=`. That one now logs the exception type only. This covers code
scanning alert 124.
Newznab: `logger.debug("Newznab API: GET %s params=%s", url, *params)`
star-expands the dict keys into the log arguments, so with debug logging
on it raises `TypeError: not all arguments converted during string
formatting` and the line never prints. Logging `params` as is would
print the API key, so it now logs the sorted parameter names.
Tests: the Newznab one formats the logged line and checks the key is
absent. The AllDebrid ones check the fallback and failure paths log no
query string and that the fallback still returns the link with the key.
All three fail without the change. Ruff and basedpyright are clean,
`tests/newznab` and `tests/prowlarr` pass.
|
||
|
splitsec2
|
4f97fc9bec |
fix: keep server paths and URLs out of an error response and a debug log (#1558)
Two small leaks from going through the open CodeQL alerts (code scanning alerts 100 and 123). The local download route returned `str(e)` on an OSError, and for a missing or unreadable file that text is the file's path on the server (`[Errno 2] No such file or directory: '/audiobooks/Author/Title.epub'`). #1422 cuts a non-admin's download path down to the file name everywhere else, so this put it back. The route now answers "Could not read the file" and the detail stays in the log. `should_bypass_proxy` logged the whole request URL at debug when it could not be parsed. URLs can carry credentials, so it logs only the exception now. Each change has a test that fails without it. The full non-e2e suite, ruff and basedpyright pass. |
||
|
dependabot[bot]
|
003df0b686 |
build(deps): bump cryptography from 46.0.7 to 50.0.0 (#1555)
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.7 to 50.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>50.0.0 - 2026-07-31</p> <pre><code> * **SECURITY ISSUE**: :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der` and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in :rfc:`3218`. Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247** * Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm. * Added ``xof()`` class methods to :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing algorithm instances configured for use with :class:`~cryptography.hazmat.primitives.hashes.XOFHash`. * The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now considered stable and are subject to our API stability policy. * Added the :doc:`/cobblestone` recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP chunked-encryption specification <https://c2sp.org/chunked-encryption>`_ for streaming authenticated encryption of large messages. * Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them. * Added support for using :class:`~cryptography.x509.Name` as a field type in the :doc:`/hazmat/asn1/index` module. * Loading a public key or an EC private key now rejects DER where the ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero number of unused bits, instead of silently ignoring it. * Parsing a CRL entry's ``InvalidityDate`` extension now rejects a ``GeneralizedTime`` that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field. * :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request or response whose ``version`` field is not ``v1``, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs. * :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported when building against AWS-LC. * HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC. * Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported when building against AWS-LC. </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/dcb7050b807b00392fa9fe2eac7cb362fcf355cc"><code>dcb7050</code></a> Prepare for 50.0.0 release (<a href="https://redirect.github.com/pyca/cryptography/issues/15372">#15372</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"><code>53fccd9</code></a> Don't leak how PKCS#7 encryptedKey decryption failed (<a href="https://redirect.github.com/pyca/cryptography/issues/15369">#15369</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/d472f978470fbefa521b86d98b2ecccbbb4d1dd8"><code>d472f97</code></a> Add <code>from __future__ import annotations</code> to all src/ Python files (<a href="https://redirect.github.com/pyca/cryptography/issues/15371">#15371</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/908773d53829fb1466c6db364b31321c3cd8eb9a"><code>908773d</code></a> Bump downstream dependencies in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/15368">#15368</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/2cc07cc948948211899bcb0cddd1fddf86e95812"><code>2cc07cc</code></a> Bump BoringSSL, OpenSSL, AWS-LC in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/15367">#15367</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/c94ede9f040fa44942f7139772603419000acf66"><code>c94ede9</code></a> chore(deps): bump ruff from 0.16.0 to 0.16.1 (<a href="https://redirect.github.com/pyca/cryptography/issues/15366">#15366</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/67a8308dc9ea4cce6056e0f1438f903c208c3f35"><code>67a8308</code></a> chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (<a href="https://redirect.github.com/pyca/cryptography/issues/15365">#15365</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/95018ffcdbbc510fd92fc872e3a3e80aa6e58596"><code>95018ff</code></a> Release the GIL in one-shot AEAD encrypt/decrypt (<a href="https://redirect.github.com/pyca/cryptography/issues/15361">#15361</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/6954733eaf55a0074abf88f06f7242dfca3a5d02"><code>6954733</code></a> Release the GIL during DH and DSA parameter generation (<a href="https://redirect.github.com/pyca/cryptography/issues/15364">#15364</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/6893b94c33e948f6240082461424cfb5da2dacc6"><code>6893b94</code></a> Import _serialization instead of serialization in x509/extensions (<a href="https://redirect.github.com/pyca/cryptography/issues/15363">#15363</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/46.0.7...50.0.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/calibrain/shelfmark/network/alerts). </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
splitsec2
|
86fff32297 |
feat(hardcover): owned books, simpler queries, dead sources and failed releases (#1535)
A request whose book turns out to be in the library is closed with the note `[auto] Already in the library.` instead of sitting in Needs Review. A request an admin handled by hand while a pass was running is skipped. A series label in front of a Calibre title no longer hides an owned book, and a Calibre title marked as another edition (full cast, dramatized, GraphicAudio) is not the book. When no source matches, up to three simpler forms of the title are tried on each source under the same strict match. Optionally (off by default), an unmatched audiobook request is looked up on Audible US and UK through Audiobookshelf's metadata search and the request says what the store answered. It never declines anything. A Soulseek peer whose recent transfers all failed, and an AudiobookBay post whose comments say it has no seeders, are tried after the other matches and never excluded. A failed or stalled release is kept out for AUTO_DOWNLOAD_RETRY_FAILED_RELEASE_DAYS and then tried again, and a torrent that died for one request is not offered to another. A request stuck on queued or downloading is settled from the download history. Optionally (off by default) a failed download is retried with another release within minutes. |
||
|
splitsec2
|
9d5b47d17b |
feat(hardcover): retries, error counting and a back-off for requests nothing matches (#1534)
A synced request whose download failed, was interrupted by a restart, or was cancelled by the stall timer goes back to pending after AUTO_DOWNLOAD_RETRY_DAYS (7 by default, 0 turns it off), a few per pass, oldest first. Only what never arrived is retried, the failed release is remembered, and a request is given up on after three failed retries. Downloads cancelled by a person and rejected requests are never retried. Errors count as errors: a search that failed in one source no longer reads as no match, a throttled Hardcover lookup is an error and not a skip, and a request that blows up doesn't abort the pass. Both summaries carry the error count. A request for the same Hardcover book and format is skipped when the history already has a finished or running download for it. A request that finds nothing is searched once a day after three no-match passes, then every two days, up to AUTO_DOWNLOAD_BACKOFF_MAX_DAYS (3 by default, 0 turns it off). |
||
|
splitsec2
|
4389548deb |
feat(hardcover): ebooks, audiobooks or both, and stricter matching for automatic downloads (#1533)
A shelf book can be requested as an ebook, an audiobook or both (one request per format), and each request is checked against its own library, source priority list and format guard. Ranking within a source prefers the most downloaded copy, then size, and one m4b is preferred to a set of chapter files unless it is much smaller than the other copies. Soulseek peers are ranked by free slot, queue length and speed. Automatic downloads refuse multi-book packs, sequels and other works named in the title, study guides, abridged or dramatised versions, two-in-one titles, releases in a language the requester didn't ask for, and an archive for an audiobook request. Matching folds accents on both sides, drops an alternate title for the search and the match, and reads small numbers the same in any form. AudiobookBay releases with no author in the listing title are judged on the authors credited on the detail page. |
||
|
splitsec2
|
ea69db3f8e |
feat(library): Audiobookshelf library check, and the sync fails closed when a library cannot be read (#1519)
Adds an Audiobookshelf provider for the library check, next to the Calibre one. It reads the server over its REST API (title, author, ISBN and ASIN per item), answers for audiobooks, and has its settings in General with a test button that uses the unsaved form values. Read only. The Hardcover sync and automatic downloads now fail closed when an enabled library cannot be read: the sync skips its cycle and an automatic download holds the request. A library that listed items at the last index and now lists none counts as a failed read. Badges still fail open. |
||
 ProcyonX1
|
99a6aa206b |
feat(metadata): add Deutsche Nationalbibliothek (DNB) metadata provider (#1547)
## feat(metadata): add Deutsche Nationalbibliothek (DNB) metadata provider This adds the Deutsche Nationalbibliothek (DNB) as a metadata provider. It covers German editions far better than the existing providers. No API key, disabled by default, and the same pattern as the other providers. It uses DNB's public SRU interface and parses MARC21-XML. Thats one reason why this needs more code than the Google Books or Open Library providers. The others are the search (DNB has no relevance ranking) and the language filter, see below. ### Notes - **Search box.** Search-box text goes from precise to loose until a stage has hits: the complete title, then the title as a phrase, then every word in a title or a person's name, last without German articles. - **"Only show editions in my book languages"** (optional, on by default). DNB also catalogs a lot of translations. DNB filters by the searching user's Default Book Languages, else the system default. - **No covers.** DNB's cover service is behind Anubis bot protection, so the provider returns no cover URLs. - **Proxy support** already included like Open Library since #1526 ### Changes outside the provider - DNB is in the onboarding dropdown. - Calibre's `dnb-idn` identifier is mapped, so DNB results show library ownership - In the env-var docs I added only the DNB section. Regenerating the whole file on main currently also reorders unrelated sections and drops `SHELFMARK_API_KEY_READONLY` (and the Databáze knih section sits inside the Moly.hu block). ### Ideas - **Deduplication.** DNB lists every edition. Kafka's "Die Verwandlung" has around 200 German editions of the same text. Grouping them would touch the API, the frontend and release search. - **Language-aware metadata search** for all providers. The other providers ignore Default Book Languages in metadata search. The `user_id` added here could serve them too. |
||
|
|
2007384058 |
feat(sources): add Webshare.cz as a release source (#1543)
## What Adds [Webshare.cz](https://webshare.cz), the Czech file host, as a release source for ebooks and audiobooks. It follows the Libgen source: disabled by default, with a settings tab for credentials and a **Test Login** button that reports whether the account is VIP. ## Why Webshare is one of the main places Czech and Slovak ebooks and audiobooks are shared, and none of the existing sources reach it. Together with the Databáze knih metadata provider (#1479), this lets Universal mode find Czech and Slovak titles end to end. ## How - **API client** (`webshare/api.py`): Webshare's XML API (`POST /api/<endpoint>/`). Login is the salted exchange the API documents: fetch the salt, send `SHA1(MD5_CRYPT(password, salt))` plus an MD5 digest. Python dropped the `crypt` module in 3.13, so md5-crypt is a small pure-Python port, checked against `openssl passwd -1`. The session token is cached per account and refreshed once when an authenticated call fails. File-level errors (`FILE_LINK_FATAL_*`) are not retried. XML is parsed with `defusedxml`. - **Search** (`webshare/source.py`): Webshare matches file names only, so the file name becomes the release title and its extension the format. Queries are title + author, then title only, or the manual query. Results are filtered to the configured `SUPPORTED_FORMATS` / `SUPPORTED_AUDIOBOOK_FORMATS`, plus `zip`/`rar` for audiobooks, since they are usually uploaded as archives. Password-protected files are skipped. The language is guessed from tags in the name (`CZ`, `SK`, `ENG`, ...), and the vote balance is a sortable column. API failures raise `SourceUnavailableError`. - **Download** (`webshare/handler.py`): resolves a time-limited link per attempt with `file_link`, then streams it into `TMP_DIR` with progress and cancel support. Large audiobook archives are not buffered in memory. - **Settings**: `WEBSHARE_ENABLED`, `WEBSHARE_USERNAME`, `WEBSHARE_PASSWORD` (a `PasswordField`, already covered by the `_PASSWORD` redaction in `genDebug.sh`), and `WEBSHARE_MAX_RESULTS`. The `docs/environment-variables.md` section was added. ## Testing - `tests/webshare/`: 31 offline tests. They cover md5-crypt vectors, password hashing, XML parsing, token reuse and re-login, non-retried file errors, availability gating, format filtering, query fallback, release mapping, language guessing, and the handler's streaming, small-file rejection, link errors and cancel. - `ruff check` and `ruff format --check` are clean. The rest of the unit suite fails the same way with and without this change: Windows-only tests on my machine. - Verified live against webshare.cz: search parsing and the salt endpoint's error path. - Still a draft: I haven't yet verified login and download with a real account. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
48ae3dbef4 |
feat: optional Hardcover wishlist sync with automated downloading (1 of 5) (#1516)
This replaces #1047, which @InfiniteAvenger opened and calibrain offered to re-review. It is Caleb's feature commit with his authorship kept, rebased onto current main, with small fixes, tests and a docs page on top. Everything is opt-in and off by default, so nothing changes for anyone who doesn't turn it on. What it adds is a **Settings, Hardcover Sync** tab with three parts that can be switched on separately: - **Shelf sync**: a Hardcover shelf (Want to Read by default) is pulled into requests on a schedule, or with a Sync now button. Requests carry the Hardcover metadata and cover. - **Automatic downloads**: synced requests are approved and a release is picked from a source priority list. A strict title, author and format match (plus a seeder minimum for torrents) decides, so anything without a confident match stays pending for manual review. - **Skip books you already own**: sync and automatic downloads ask whichever libraries are enabled under Library Check (Calibre today) and skip a book that is already there. On top of Caleb's commit I made the request owner a lookup instead of assuming user id 1, sent synced cover URLs through the proxy when the request is created, got ruff and basedpyright clean, and added tests and `docs/hardcover-sync.md`. His commit also had its own Audiobookshelf settings and a Test library connection button, written before the library check was split into providers. The button would have raised a TypeError against the current `test_connection`, so those settings are gone from this tab and an Audiobookshelf provider comes as a separate PR, which is the part of #1047 that is missing here (for now anyways...). I've run this daily for about a couple of weeks. Ruff, basedpyright and the backend suite pass (4426 passed). This is 1 of 5. As calibrain suggested, the rest are stacked on this one, each saying which number it is. Closes https://github.com/calibrain/shelfmark/pull/1047#issuecomment-6302071588 --------- Co-authored-by: InfiniteAvenger <calebewest02@gmail.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
splitsec2andCaliBrain
|
72b5d04939 |
perf: cut repeated work on the status and activity paths (#1545)
Two small cuts to work that repeats on every poll or request. The delivery-state sync behind /api/status and the activity snapshot listed every fulfilled request (SELECT * plus a JSON parse of book_data and release_data per row) before it looked at the queue. That history is never purged, so an idle instance paid for it on every poll. It now returns straight away when no queue bucket holds a task, since nothing could map to a request then. Results and emitted updates are unchanged. The activity snapshot gains less from this, because its status merges download history rows, so it is usually not empty. In proxy auth mode the before-request hook looked the user up by name and by session id on every API call, cover images included, each on a new SQLite connection. UserDB.get_user_cached answers repeat lookups from memory for up to five seconds, bounded at 256 entries. create_user, update_user and delete_user drop the cache as soon as they commit, and a lookup that overlaps a write is not stored, so a role change or deletion made in the app applies on the next request. Changes made outside that UserDB instance (another process, or the separate instances some helpers open) show within the five seconds. Only the middleware uses the cached path; every other get_user caller is unchanged. Each change has a test that failed before it: one counts list_requests calls for an empty queue, the others count get_user calls across repeated lookups and middleware runs, check expiry with a patched clock, and check that writes and caller mutations do not leave a stale row behind. The full suite passes (4432 passed, 48 skipped, e2e excluded), as do ruff and basedpyright on the changed files. I also looked at throttling the full status_update broadcast when only the progress message changes during torrent and usenet polling, and left it out. Those handlers poll every 2 seconds and DOWNLOAD_PROGRESS_UPDATE_INTERVAL defaults to 1 second, so a throttle on that interval would skip nothing at the default setting. A longer window would slow the speed and ETA text in the UI, and without a trailing flush it would hide the last message of a quick burst, such as "Waiting for bot response" arriving just after "Requesting file from bot", for the whole wait that follows. --------- Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
splitsec2andCaliBrain
|
237ddd53a2 |
fix(redaction): a non-admin's status message loses the links it quotes (#1541)
#1422 hid `source_id` and the download path from non-admins but left the status message alone. A failed add stores the client's exception text there, for example `401 Client Error: Unauthorized for url: <full url>`, and for a requests error that URL carries the path and query: an indexer key, a tracker passkey, a peer name. It reached the owner through `/api/status`, `/api/activity` and the `status_update` socket event. `redact_download_payload` now replaces every link in `status_message` with `(link removed)`. That covers the live queue, the socket push and the history snapshot, since all three go through it. Messages without a link are unchanged and admins still see the full text. Tests cover the payload, a whole status snapshot, and messages that must stay as they are. They fail on main and pass here. Found in a Claude pass over 1.5.0. --------- Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
splitsec2
|
a430341a93 |
perf: cut repeated work on search and cover paths (#1544)
I went through what Shelfmark does per search and per cover and measured the pieces that showed up. Four of them are cheap to fix, so this is one PR. Shelfmark runs on a single gevent worker, so any of these blocks every other request while it runs, and I'm assuming a lot of people run it on small hardware (a Pi, say). Cover cache. Every cache hit rewrote the whole `cache_index.json` just to bump the entry's last-access time. On my box that is 3.7 ms of CPU per hit at 500 entries and about 100 ms at 15,000 (2.2 MB written each time), and a results page asks for around 40 covers. The access time now stays in memory and the index is written at most every 30 seconds, or whenever something else saves it. A crash inside that window loses some access times, which only changes eviction order. Settings reload. `config.refresh()` rebuilt the cache by reading and parsing a tab's JSON file once per field, so about 250 parses per refresh, 100 ms of CPU, and the metadata search, providers and config routes each trigger it. It now reads each file once per rebuild (several tabs share `settings.json`, so the memo is keyed on the file path). Library match. When the library check is on, each search result is compared against every library entry, and the title was split into words again for every entry. The words are now computed once per result. I measured 33 ms per result at 5,000 library entries and 106 ms at 20,000, which is a second or more per page of 40 results. The matching itself is unchanged. Cover URL probe. `is_covers_cache_enabled()` creates and deletes a file in the config directory to check it is writable, and it runs for every cover, queue task and history row. The answer is remembered for 60 seconds. The probe is 0.045 ms on its own, but it is called a few hundred times per request in the worst case. Each change has a test that fails without it (call counts on the index saves, file opens during a refresh, tokenisation calls, and probe calls). Ruff, basedpyright on the changed files and the non-e2e suite pass. The timings are from a dev machine with an empty config, so the real numbers depend on cache and library size. |
||
|
splitsec2
|
2668705bfa |
perf: reuse connections and cache Anna's Archive download counts (#1546)
Two small changes that stop Shelfmark from opening a new HTTPS connection for requests that go to the same host over and over. Anna's Archive download counts. Every search result gets its count from `/dyn/md5/inline_info/<md5>`, and each of those was a bare `requests.get`, so a search with 50 results opened 50 TCP and TLS connections to the mirror. `search_books` also runs once per title variant, and the variants of one book mostly find the same files, so the same md5 was looked up again for every variant that found it, and again when the release list was reopened. The lookups now share one `requests.Session`, and a successful count is kept for five minutes in a bounded `CacheService` (the same class the metadata cache uses, as its own instance, so it does not depend on the metadata cache toggle). A lookup that fails or comes back without a count is not cached, so it is retried on the next search just like today. The URL, headers and 5 second timeout are unchanged. Debrid clients. Real-Debrid, AllDebrid, Debrid-Link and TorBox also used the bare `requests` helpers. The download handler polls `get_status` every two seconds for each active job, so every poll was a fresh TLS handshake with the debrid API. Each of those modules now keeps one `requests.Session` and sends its API calls through it, the way the qBittorrent, Deluge, Prowlarr and Newznab clients already do. Headers, timeouts, `verify` and error handling are still passed per call exactly as before. The existing tests that patched `<module>.requests.get/post/request` now patch `<module>._session.<verb>` instead; nothing else in them changed. How I checked it: each change has a test that fails on main and passes here. They count the requests that reach `requests.Session.request` and the sessions built while doing it, with no network. On main, three polls of each debrid client build three sessions, and two overlapping batches of AA results look `bbb` up twice. There are also tests for the count cache expiring (with a faked clock) and for a failed lookup not being cached. Full suite: 4432 passed, 48 skipped. ruff and basedpyright are clean on the changed files. I also looked at caching `/api/releases` on the server and left it out. The release modal already caches each book's results per source and content type in the browser for five minutes (longer for IRC and slskd through `cache_ttl_seconds`), and that cache survives closing and reopening the modal, so reopening it does not run a new search today. A server cache would only help after a page reload, and it would quietly undo the modal's "apply filters" and manual search refetches, which drop the browser cache on purpose, unless the frontend also learned to send a bypass. That did not seem worth it for this PR. |
||
|
splitsec2
|
08fdb7ea87 |
fix(startup): the reconcile guard catches the same errors the rest of main.py does (#1540)
The start-up reconcile runs at import, before the coordinator starts, inside a try that named five exception types and left out `TypeError`. `main.py` already defines `_IMPORT_OPERATIONAL_ERRORS` for this shape and the other module-level guards use it, so this switches to it. An unexpected `TypeError` from the reconcile would otherwise fail the import of `shelfmark.main`, and the worker would fail to boot on every restart. I didn't use `except Exception` because BLE001 is on and nothing in main.py does. The test reloads main with the reconcile raising `TypeError`, and with `OSError` as the control (that one already passes on main). Full non-e2e suite passes, ruff and basedpyright are clean. Found in a Claude pass over 1.5.0. |
||
|
splitsec2
|
f560b31ee4 |
fix(db): wait up to 30 s for a busy writer instead of SQLite's 5 s default (#1539)
The users, download history and activity view-state databases open their connections with SQLite's default busy timeout of 5 seconds. A start-up migration, the restart reconcile, or any statement that overlaps a backup or a second process raised "database is locked" after 5 seconds, and the reconcile finished only part of its work. One shared `DB_BUSY_TIMEOUT_SECONDS` (30) in `core/utils.py`, used by all three. The test reads SQLite's `busy_timeout` pragma back from each connection, so it doesn't need a real lock fight. I left `UserDB.initialize()` without a guard on purpose. With 30 seconds the wait covers a backup, and swallowing a schema failure there would hide a worker that can't run. Found in a Claude pass over 1.5.0. |
||
|
splitsec2
|
2d9491e063 |
docs(settings): say that the per-source limit replaces Max Concurrent Downloads (#1542)
With Max Concurrent Downloads Per Source above 0 the download pool is sized per source and a task is admitted when its own source is below the limit. Max Concurrent Downloads isn't read at all in that mode, so 3 per source across 3 busy sources runs 9 at once. Neither description said so. The per-source text now says it replaces the global limit and what the total can be, and the global one says it isn't used while the per-source limit is set. Text only, no behaviour change. I changed the two rows in `docs/environment-variables.md` by hand. Running `scripts/generate_env_docs.py` on main today also drops the `SHELFMARK_API_KEY_READONLY` entries and changes the slskd anchor, so the file looks hand-edited since it was last generated, and I didn't want to fold that into this. The two rows match what the generator produces for them. Found in a Claude pass over 1.5.0. |
||
|
splitsec2
|
e27fed1d40 |
fix(queue): a late progress update no longer reopens a finished task (#1538)
#1429 made the first terminal status win, but the guard only refused terminal to terminal changes. A worker's poll that reports DOWNLOADING after a cancel still overwrote CANCELLED (the poll loop calls the status callback before it waits on the cancel flag), and the COMPLETE or ERROR that followed was then accepted as a first terminal status, so the terminal hook ran a second time. This refuses any status change away from a terminal status. `add()` and `enqueue_existing()` reset the status themselves, so retries are unaffected. The new test cancels a downloading task, sends DOWNLOADING and then COMPLETE, and expects CANCELLED and one hook call. It fails on main and passes here. Full non-e2e suite passes, ruff and basedpyright are clean. Found in a Claude pass over 1.5.0, same as my other small fixes from it. |
||
|
splitsec2
|
395c331b4a |
fix(search): give each provider its own slice of the search budget (#1537)
Fixes #1531. All Direct Download providers share the one search budget (`RELEASE_SEARCH_TIMEOUT`, 300s). Anna's Archive runs first, and when its bypass keeps failing the retries use up the whole budget. OceanofPDF then sees an expired deadline, skips its queries, and the search raises Anna's Archive's error even though OceanofPDF never got a turn. I didn't split the budget evenly, since the deadline module itself says a cold-start Anna's Archive solve can legitimately take 60 to 120s and a 150s or 37s slice would break setups that work today. Instead `search_deadline.unit_deadline(waiting=n)` opens a child deadline for one unit of work. It gets the parent's remaining time minus 30s for each unit still waiting, never less than 30s and never more than the parent has left. A single provider still gets everything, a fast provider's unused time rolls on to the next, and a stuck one stops at its own limit with the reserve intact. It's used in the provider loop in `DirectDownloadSource.search`, and in the source loop in `/api/releases` since it's the same shape and four lines. With several sources enabled the first one now gets 30s less per source behind it, which is still well above a cold solve for the usual two or three. Tests: a stuck first provider no longer starves the second (fails on main, passes here), a lone provider gets the full budget, and a child never outlives its parent. Two existing tests in `test_releases_api_budget.py` tripped the deadline in force from inside the source, which is now the child, so they use a short request budget instead. ruff, basedpyright on the changed files and the non-e2e suite are clean. OceanofPDF is inactive on my own instance (no mirror URL set), so I haven't reproduced this live. It's verified by reading the code and by the tests. I had Claude do the pass on this one. |
||
|
splitsec2
|
8e425da527 |
refactor: one default and one reader for the Supported Book Formats list (#1532)
The default for Supported Book Formats (`epub, mobi, azw3, fb2, djvu, cbz, cbr`) was written out in five places: the settings registry, `postprocess/policy.py`, `irc/parser.py`, Prowlarr's `source.py` (added in #1490) and slskd's `source.py` (added in #1428). Both of those two arrived in 1.5.0, and both are mine, so this is cleaning up after myself as much as anything. The setting was also read three different ways. Post-processing split on commas only. slskd split on commas and spaces and stripped a leading dot. IRC split on commas and kept the dot. Prowlarr split on commas and kept `""` as a format when the value was an empty string. So `.epub` or `epub mobi` worked in one source and not another. This puts `DEFAULT_EBOOK_FORMATS` and `normalize_format_list` in `core/utils.py` next to `AUDIOBOOK_FORMATS`, and the registry, post-processing, IRC, Prowlarr and slskd all use them. I took the most lenient reading of the three (comma or space split, leading dot dropped, empties ignored, default when nothing is left), so no existing config gets stricter. I put the reader in `core/utils.py` and not in `policy.py` because the release sources can't import `policy` without pulling in the whole post-processing package. A config with a sensible list reads exactly as before. The only differences are for malformed values: an emptied setting or an empty string now falls back to the default in every place, where IRC used to filter everything out and Prowlarr treated `""` as a format. The audiobook default is a separate story and I left it alone: the registry and slskd default to every processable audiobook format plus the archives, while post-processing and IRC fall back to `m4b, mp3`. They only differ when the setting is unset or emptied, but they do differ, and I'd rather ask which one you want than pick one here. Ruff, basedpyright on the changed files and the backend suite pass (4400 passed, e2e not run). New tests cover the reader and the two fallbacks. |
||
 Amalkrishna A SandCaliBrain
|
a11a63a29e |
feat(notifications): add {User}/{Email} placeholders to per-user routes (#1499)
Closes #1130. Per-user notification route URLs can now use `{Email}` and `{User}`, filled in from each user's account at send time, the same way `{User}` already works in destination paths. One default route like `mailtos://user:pass@smtp.example.com?to={Email}` now reaches every user at their own address, with no per-user setup. - Values are URL-encoded (`alice+books@example.com` keeps its `+`); placeholders are case-insensitive. - A route that needs a value the user doesn't have (e.g. no email on file) is skipped for that user; other routes still send. - The user lookup only runs when a route contains a placeholder. - The personal "Test notification" button expands the placeholders too, so testing a `{Email}` route works. - Added to the routes setting help, `docs/users-and-requests.md`, and tests. @calibrain ready for review. --------- Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
dependabot[bot]
|
182e80f894 |
build(deps): bump publicsuffixlist from 1.1.0.20261017 to 1.1.0.20261018 (#1527)
Bumps [publicsuffixlist](https://github.com/ko-zu/psl) from 1.1.0.20261017 to 1.1.0.20261018. <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/ko-zu/psl/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |