starred/shelfmark
1
0
Fork 0
mirror of https://github.com/calibrain/shelfmark.git synced 2026-09-24 19:50:29 +01:00
Code Issues Packages Projects Releases 10 Wiki Activity
553 Commits 5 Branches 48 Tags
83f86242b435afd3b4949389c6f7f6fc800399d3
Commit Graph
66 Commits
Author SHA1 Message Date
dependabot[bot] 83f86242b4 build(deps): bump the docker-base-image-digests group with 2 updates (#1348) 
> [!WARNING]
> Cooldown could not be applied because no publication date was
available from the registry.
>

Bumps the docker-base-image-digests group with 2 updates: node and
[astral-sh/uv](https://github.com/astral-sh/uv).

Updates `node` from `50c8e8c` to `ebfe2f9`

Updates `astral-sh/uv` from 0.12.13 to 0.12.16
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases">astral-sh/uv's
releases</a>.</em></p>
<blockquote>
<h2>0.12.16</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-17.</p>
<h3>Python</h3>
<ul>
<li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a
href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Verify downloaded wheels and source distributions against hashes
supplied by package indexes (<a
href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li>
<li>Allow <code>build-constraint-dependencies</code> entries to include
hashes for verifying downloaded build dependencies (<a
href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li>
<li>Honor Darwin <code>platform_release</code> markers in
<code>required-environments</code> using macOS wheel deployment targets
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li>
<li>Reject unsupported Git URL schemes while parsing lockfiles instead
of panicking during frozen exports (<a
href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Support <code>lock-without-metadata</code> across all dependency
types while retaining <code>package.metadata</code> for remote URL
dependencies to enable offline validation (<a
href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li>
<li>Honor configured and command-line index settings, including
credentials, in <code>uv upgrade</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li>
<li>Allow <code>uv check</code> to run in projects that are not managed
by uv and outside workspaces (<a
href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li>
<li>Respect <code>--python</code> and <code>UV_PYTHON</code> when
selecting the Python version for <code>uv check</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Redact Azure shared access signatures from displayed and logged URLs
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li>
<li>Check archive sizes from <code>pylock.toml</code> before reusing
cached distributions (<a
href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li>
<li>Keep user-authored local dependency paths relative in lockfiles when
backend metadata reports absolute paths (<a
href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li>
<li>Use the bundled <code>uv_build</code> backend only when its version
matches active version pins (<a
href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li>
<li>Handle malformed index URLs without panicking when credentials are
configured (<a
href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li>
<li>Report a configuration error instead of panicking for proxy URLs
without a host (<a
href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li>
<li>Return a credential-redacted error instead of panicking when a URL
cannot be converted to a path (<a
href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li>
</ul>
<h2>Install uv 0.12.16</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c &quot;irm
https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1
| iex&quot;
</code></pre>
<h2>Download uv 0.12.16</h2>
<p>|  File  | Platform | Checksum |</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's
changelog</a>.</em></p>
<blockquote>
<h2>0.12.16</h2>
<p>Released on 2026-09-17.</p>
<h3>Python</h3>
<ul>
<li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a
href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Verify downloaded wheels and source distributions against hashes
supplied by package indexes (<a
href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li>
<li>Allow <code>build-constraint-dependencies</code> entries to include
hashes for verifying downloaded build dependencies (<a
href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li>
<li>Honor Darwin <code>platform_release</code> markers in
<code>required-environments</code> using macOS wheel deployment targets
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li>
<li>Reject unsupported Git URL schemes while parsing lockfiles instead
of panicking during frozen exports (<a
href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Support <code>lock-without-metadata</code> across all dependency
types while retaining <code>package.metadata</code> for remote URL
dependencies to enable offline validation (<a
href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li>
<li>Honor configured and command-line index settings, including
credentials, in <code>uv upgrade</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li>
<li>Allow <code>uv check</code> to run in projects that are not managed
by uv and outside workspaces (<a
href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li>
<li>Respect <code>--python</code> and <code>UV_PYTHON</code> when
selecting the Python version for <code>uv check</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Redact Azure shared access signatures from displayed and logged URLs
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li>
<li>Check archive sizes from <code>pylock.toml</code> before reusing
cached distributions (<a
href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li>
<li>Keep user-authored local dependency paths relative in lockfiles when
backend metadata reports absolute paths (<a
href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li>
<li>Use the bundled <code>uv_build</code> backend only when its version
matches active version pins (<a
href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li>
<li>Handle malformed index URLs without panicking when credentials are
configured (<a
href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li>
<li>Report a configuration error instead of panicking for proxy URLs
without a host (<a
href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li>
<li>Return a credential-redacted error instead of panicking when a URL
cannot be converted to a path (<a
href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li>
</ul>
<h2>0.12.15</h2>
<p>Released on 2026-09-15.</p>
<h3>Performance</h3>
<ul>
<li>Speed up cold-cache resolution and HTTP cache revalidation by
batching cache writes (<a
href="https://redirect.github.com/astral-sh/uv/pull/21675">#21675</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Fix regressions in <code>0.12.14</code> when installing to symlinked
destinations or using <code>uv pip install --target .</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21699">#21699</a>)</li>
</ul>
<h2>0.12.14</h2>
<p>Released on 2026-09-15.</p>
<h3>Enhancements</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/761ff1379b3b79f61fc8d421dfe4fe064834e084"><code>761ff13</code></a>
Bump version to 0.12.16 (<a
href="https://redirect.github.com/astral-sh/uv/issues/21809">#21809</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/a2f820ad0cebb7118f7686be3619d48df5121f6e"><code>a2f820a</code></a>
Assign release pull requests to the workflow initiator (<a
href="https://redirect.github.com/astral-sh/uv/issues/21808">#21808</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/6dffe7e03898409c04e2f46436bffa60abbae465"><code>6dffe7e</code></a>
Ignore <code>UV_NATIVE_TLS</code> when <code>UV_SYSTEM_CERTS</code> is
set (<a
href="https://redirect.github.com/astral-sh/uv/issues/21805">#21805</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/7bc36767ae3ea0d45e3cc6f219765fdec2992a33"><code>7bc3676</code></a>
Avoid warning when both <code>native-tls</code> and
<code>system-certs</code> are configured (<a
href="https://redirect.github.com/astral-sh/uv/issues/21806">#21806</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/07b838a33179967b87d513825b02504a75b21b3a"><code>07b838a</code></a>
Avoid warning when both <code>UV_NATIVE_TLS</code> and
<code>UV_SYSTEM_CERTS</code> are set (<a
href="https://redirect.github.com/astral-sh/uv/issues/21788">#21788</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/5d64ede21e9e835e59ecd85329ebefd43faa8211"><code>5d64ede</code></a>
Remove Hash API (<a
href="https://redirect.github.com/astral-sh/uv/issues/21786">#21786</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/9ddc4308551335e9c2ab6571ea0cf529eccf3e76"><code>9ddc430</code></a>
Move shared thread initialization into uv-threads (<a
href="https://redirect.github.com/astral-sh/uv/issues/21746">#21746</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/ef1e0689b4612796d7781ebeae7866028c6c9e82"><code>ef1e068</code></a>
Make Git stamping opt-in for development builds (<a
href="https://redirect.github.com/astral-sh/uv/issues/21750">#21750</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/6ce09770cec30b30cdc66c3595517dce2b112562"><code>6ce0977</code></a>
Avoid panics for non-base index URLs (<a
href="https://redirect.github.com/astral-sh/uv/issues/21784">#21784</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/47f19ec154f325ade7d6045c4e785531c24635f7"><code>47f19ec</code></a>
Return an error for failed VerbatimUrl path conversions (<a
href="https://redirect.github.com/astral-sh/uv/issues/21783">#21783</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.12.13...0.12.16">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-19 23:18:59 -04:00
dependabot[bot] 9eb47989ec build(deps): bump the docker-base-image-digests group with 2 updates (#1328) 
> [!WARNING]
> Cooldown could not be applied because no publication date was
available from the registry.
>

Bumps the docker-base-image-digests group with 2 updates: node and
[astral-sh/uv](https://github.com/astral-sh/uv).

Updates `node` from `e67514e` to `50c8e8c`

Updates `astral-sh/uv` from 0.12.9 to 0.12.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases">astral-sh/uv's
releases</a>.</em></p>
<blockquote>
<h2>0.12.13</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-10.</p>
<h3>Python</h3>
<ul>
<li>Add GraalPy 3.13.0 (<a
href="https://redirect.github.com/astral-sh/uv/pull/21431">#21431</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Verify hashes when downloading PEP 658 metadata sidecars (<a
href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Respect <code>ty</code> exclusions when <code>uv check</code>
automatically selects members of a virtual workspace (<a
href="https://redirect.github.com/astral-sh/uv/pull/21555">#21555</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid full wheel downloads during resolution by reusing supported
hashes from direct URL fragments when metadata is available separately
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21279">#21279</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Edit Windows entry-point launcher resources in memory to support
Nano Server and reduce antivirus contention (<a
href="https://redirect.github.com/astral-sh/uv/pull/18713">#18713</a>)</li>
<li>Prefer <code>core-metadata</code> over legacy aliases in JSON index
responses (<a
href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li>
</ul>
<h2>Install uv 0.12.13</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c &quot;irm
https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1
| iex&quot;
</code></pre>
<h2>Download uv 0.12.13</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td>
<td>x86 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td>
<td>x64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td>
<td>ARM64 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's
changelog</a>.</em></p>
<blockquote>
<h2>0.12.13</h2>
<p>Released on 2026-09-10.</p>
<h3>Python</h3>
<ul>
<li>Add GraalPy 3.13.0 (<a
href="https://redirect.github.com/astral-sh/uv/pull/21431">#21431</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Verify hashes when downloading PEP 658 metadata sidecars (<a
href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Respect <code>ty</code> exclusions when <code>uv check</code>
automatically selects members of a virtual workspace (<a
href="https://redirect.github.com/astral-sh/uv/pull/21555">#21555</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Avoid full wheel downloads during resolution by reusing supported
hashes from direct URL fragments when metadata is available separately
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21279">#21279</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Edit Windows entry-point launcher resources in memory to support
Nano Server and reduce antivirus contention (<a
href="https://redirect.github.com/astral-sh/uv/pull/18713">#18713</a>)</li>
<li>Prefer <code>core-metadata</code> over legacy aliases in JSON index
responses (<a
href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li>
</ul>
<h2>0.12.12</h2>
<p>Released on 2026-09-09.</p>
<p>The executables in our macOS and Windows release archives and
<code>uv</code> and <code>uv_build</code> wheels are now code-signed.
macOS executables are signed with an Apple Developer ID certificate and
notarized by Apple. Windows executables have timestamped Authenticode
signatures from Azure Artifact Signing. This enables verification of the
release publisher and binary integrity, supports publisher-based
allowlisting, and should reduce security warnings and antivirus false
positives.</p>
<h3>Bug fixes</h3>
<ul>
<li>Exclude distributions uploaded after the <code>exclude-newer</code>
cutoff from lockfiles and generated requirement hashes (<a
href="https://redirect.github.com/astral-sh/uv/pull/21539">#21539</a>)</li>
</ul>
<h2>0.12.11</h2>
<p>Released on 2026-09-08.</p>
<h3>Preview features</h3>
<ul>
<li>Generate missing artifact hashes when exporting
<code>pylock.toml</code> files to ensure they conform to PEP 751 (<a
href="https://redirect.github.com/astral-sh/uv/pull/20146">#20146</a>)</li>
<li>Warn when <code>pylock.toml</code> artifact hash tables are empty,
which will be rejected in a future uv release (<a
href="https://redirect.github.com/astral-sh/uv/pull/21462">#21462</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Speed up installs that overwrite existing files by eliminating
per-file temporary directories for atomic hard-link, symlink, and
reflink replacements (<a
href="https://redirect.github.com/astral-sh/uv/pull/21478">#21478</a>)</li>
<li>Speed up installs that merge copied wheels into existing
environments by replacing per-file temporary directories with adjacent
temporary files (<a
href="https://redirect.github.com/astral-sh/uv/pull/21468">#21468</a>)</li>
<li>Speed up local wheel installs by replacing the shared ZIP cursor
lock with positioned reads (<a
href="https://redirect.github.com/astral-sh/uv/pull/21500">#21500</a>)</li>
<li>Speed up local wheel installs by reusing ZIP readers and buffers
across extracted files (<a
href="https://redirect.github.com/astral-sh/uv/pull/21499">#21499</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/0ebbd9274a55a8a53a13970be3b97e4209598e17"><code>0ebbd92</code></a>
Bump version to 0.12.13 (<a
href="https://redirect.github.com/astral-sh/uv/issues/21594">#21594</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/17ccae34815e249c66e53abe21916c3c0b6413e5"><code>17ccae3</code></a>
Use separate Depot projects for Docker development builds (<a
href="https://redirect.github.com/astral-sh/uv/issues/21591">#21591</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/8c18e15bd36dff0e17509cc68c3721798ae1ec2b"><code>8c18e15</code></a>
Use the workflow revision for PR security review configuration (<a
href="https://redirect.github.com/astral-sh/uv/issues/21592">#21592</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/9ebb1f6a72db257a689049ee060b7cf93638aada"><code>9ebb1f6</code></a>
Clarify release pipeline job names (<a
href="https://redirect.github.com/astral-sh/uv/issues/21561">#21561</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/d87450d82b3941507e48ac8b57f72a9d00709289"><code>d87450d</code></a>
Omit unused <code>exclude-newer-package</code> entries from script locks
(<a
href="https://redirect.github.com/astral-sh/uv/issues/21589">#21589</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/911f3a208c104b07b2f4da3a2283564d9a95c403"><code>911f3a2</code></a>
Refactor release artifact handling (<a
href="https://redirect.github.com/astral-sh/uv/issues/21556">#21556</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/a712e811024933ec441667659d6df73c04f5b678"><code>a712e81</code></a>
Separate Docker release builds from publishing (<a
href="https://redirect.github.com/astral-sh/uv/issues/21586">#21586</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/4196dae60a0cc542bd43c0188f8b4c6dbfa0df98"><code>4196dae</code></a>
Use xhigh effort for PR security review (<a
href="https://redirect.github.com/astral-sh/uv/issues/21530">#21530</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/a51624b4791456260f72068ae878796233f72809"><code>a51624b</code></a>
Reduce PR security review reporting work (<a
href="https://redirect.github.com/astral-sh/uv/issues/21528">#21528</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/63e28b69821b4b55b90287d799cbf97ff6ba0f74"><code>63e28b6</code></a>
Use <code>editpe</code> for trampoline resource edits (<a
href="https://redirect.github.com/astral-sh/uv/issues/18713">#18713</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.12.9...0.12.13">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-11 02:07:12 -04:00
dependabot[bot] 22aa59e567 build(deps): bump the docker-base-image-digests group with 2 updates (#1306) 
> [!WARNING]
> Cooldown could not be applied because no publication date was
available from the registry.
>

Bumps the docker-base-image-digests group with 2 updates: node and
[astral-sh/uv](https://github.com/astral-sh/uv).

Updates `node` from `d32cdf6` to `e67514e`

Updates `astral-sh/uv` from 0.12.5 to 0.12.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases">astral-sh/uv's
releases</a>.</em></p>
<blockquote>
<h2>0.12.9</h2>
<h2>Release Notes</h2>
<p>Released on 2026-09-01.</p>
<h3>Python</h3>
<ul>
<li>Add CPython 3.15.0rc2 (<a
href="https://redirect.github.com/astral-sh/uv/pull/21413">#21413</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/21415">#21415</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Add <code>--no-locked</code> and <code>--no-frozen</code> to disable
lock modes enabled by <code>UV_LOCKED</code> and <code>UV_FROZEN</code>
for a single invocation (<a
href="https://redirect.github.com/astral-sh/uv/pull/21408">#21408</a>)</li>
<li>Report the exact command-line lock-mode flag in warnings and errors
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21402">#21402</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Speed up cold wheel installs by extracting each streaming ZIP
archive in a single blocking task and reusing buffers across files (<a
href="https://redirect.github.com/astral-sh/uv/pull/21372">#21372</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Update <code>async_http_range_reader</code> to 0.11.1 to address a
potential memory-safety issue when reading metadata ranges from
untrusted wheels (<a
href="https://redirect.github.com/astral-sh/uv/pull/21401">#21401</a>)</li>
<li>Remove sensitive headers when redirects cross authentication realms,
including same-host redirects that change URL schemes (<a
href="https://redirect.github.com/astral-sh/uv/pull/21382">#21382</a>)</li>
<li>Redact secrets in signed URLs from retry diagnostics, including
nested request errors (<a
href="https://redirect.github.com/astral-sh/uv/pull/21381">#21381</a>)</li>
<li>Give <code>--locked</code>, <code>--frozen</code>,
<code>--check</code>, and <code>--check-exists</code> precedence over
conflicting <code>UV_LOCKED</code> and <code>UV_FROZEN</code> values (<a
href="https://redirect.github.com/astral-sh/uv/pull/21396">#21396</a>)</li>
<li>Prevent concurrent uv processes from redundantly extracting the same
local or source-built wheel (<a
href="https://redirect.github.com/astral-sh/uv/pull/21400">#21400</a>)</li>
</ul>
<h2>Install uv 0.12.9</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c &quot;irm
https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1
| iex&quot;
</code></pre>
<h2>Download uv 0.12.9</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td>
<td>x86 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td>
<td>x64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td>
<td>ARM64 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's
changelog</a>.</em></p>
<blockquote>
<h2>0.12.9</h2>
<p>Released on 2026-09-01.</p>
<h3>Python</h3>
<ul>
<li>Add CPython 3.15.0rc2 (<a
href="https://redirect.github.com/astral-sh/uv/pull/21413">#21413</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/21415">#21415</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Add <code>--no-locked</code> and <code>--no-frozen</code> to disable
lock modes enabled by <code>UV_LOCKED</code> and <code>UV_FROZEN</code>
for a single invocation (<a
href="https://redirect.github.com/astral-sh/uv/pull/21408">#21408</a>)</li>
<li>Report the exact command-line lock-mode flag in warnings and errors
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21402">#21402</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Speed up cold wheel installs by extracting each streaming ZIP
archive in a single blocking task and reusing buffers across files (<a
href="https://redirect.github.com/astral-sh/uv/pull/21372">#21372</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Update <code>async_http_range_reader</code> to 0.11.1 to address a
potential memory-safety issue when reading metadata ranges from
untrusted wheels (<a
href="https://redirect.github.com/astral-sh/uv/pull/21401">#21401</a>)</li>
<li>Remove sensitive headers when redirects cross authentication realms,
including same-host redirects that change URL schemes (<a
href="https://redirect.github.com/astral-sh/uv/pull/21382">#21382</a>)</li>
<li>Redact secrets in signed URLs from retry diagnostics, including
nested request errors (<a
href="https://redirect.github.com/astral-sh/uv/pull/21381">#21381</a>)</li>
<li>Give <code>--locked</code>, <code>--frozen</code>,
<code>--check</code>, and <code>--check-exists</code> precedence over
conflicting <code>UV_LOCKED</code> and <code>UV_FROZEN</code> values (<a
href="https://redirect.github.com/astral-sh/uv/pull/21396">#21396</a>)</li>
<li>Prevent concurrent uv processes from redundantly extracting the same
local or source-built wheel (<a
href="https://redirect.github.com/astral-sh/uv/pull/21400">#21400</a>)</li>
</ul>
<h2>0.12.8</h2>
<p>Released on 2026-08-31.</p>
<h3>Enhancements</h3>
<ul>
<li>Warn about invalid tool directories and continue upgrading valid
tools with <code>uv tool upgrade --all</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21368">#21368</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Deduplicate identical files within and across cached wheels with the
<code>content-addressed-cache</code> preview feature (<a
href="https://redirect.github.com/astral-sh/uv/pull/21327">#21327</a>)</li>
<li>Reduce allocations while extracting content-addressed wheels by
reusing the hashing buffer across files (<a
href="https://redirect.github.com/astral-sh/uv/pull/21340">#21340</a>)</li>
<li>Speed up content-addressed cache cleanup on macOS by reading
hard-link counts in bulk (<a
href="https://redirect.github.com/astral-sh/uv/pull/21344">#21344</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Prevent concurrent uv processes from downloading and extracting the
same remote wheel more than once (<a
href="https://redirect.github.com/astral-sh/uv/pull/21379">#21379</a>)</li>
<li>Speed up dependency graph construction from large lockfiles by
indexing packages during traversal (<a
href="https://redirect.github.com/astral-sh/uv/pull/21373">#21373</a>)</li>
<li>Extend indexed lockfile traversal to exports, dependency trees,
audits, and freshness checks (<a
href="https://redirect.github.com/astral-sh/uv/pull/21377">#21377</a>)</li>
<li>Speed up warm resolutions by reducing repeated marker interner work
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21300">#21300</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Do not trust hashes from direct URLs discovered only in wheel
metadata when installing with <code>--require-hashes</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21348">#21348</a>)</li>
<li>Use a compatible Azure Storage API version for anonymous and
authenticated requests, allowing credential retries when public access
is disabled (<a
href="https://redirect.github.com/astral-sh/uv/pull/21366">#21366</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/9f928602938ac5cf1cd6b294a725833c16f5720e"><code>9f92860</code></a>
Bump version to 0.12.9 (<a
href="https://redirect.github.com/astral-sh/uv/issues/21422">#21422</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/29c546228ed6ba8970bb063960c9a767fae19236"><code>29c5462</code></a>
Skip invalid scripts in <code>uv workspace list --scripts</code> (<a
href="https://redirect.github.com/astral-sh/uv/issues/21416">#21416</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/bf1d7e8049017a363565185a7df7e86f33041452"><code>bf1d7e8</code></a>
Encapsulate wheel extraction directory ownership (<a
href="https://redirect.github.com/astral-sh/uv/issues/21419">#21419</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/6dacee042f58cea9184267ffb70c6960582bb210"><code>6dacee0</code></a>
Run streaming ZIP extraction in a blocking task (<a
href="https://redirect.github.com/astral-sh/uv/issues/21372">#21372</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/91d1ebf1b4ea1fc00928b412a9da23639aacb086"><code>91d1ebf</code></a>
Sync latest Python releases (<a
href="https://redirect.github.com/astral-sh/uv/issues/21415">#21415</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/6a61ddb2c094ab44e55a2cc5bb4a88b7c08d733a"><code>6a61ddb</code></a>
Revert &quot;Limit CI planner checkout depth&quot; (<a
href="https://redirect.github.com/astral-sh/uv/issues/21414">#21414</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/e9d1816b538468e7deb8f267f28775007706b866"><code>e9d1816</code></a>
Add CPython 3.15.0rc2 (<a
href="https://redirect.github.com/astral-sh/uv/issues/21413">#21413</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/e888329afc22fa3e34f93d5ae5e23fbc87328952"><code>e888329</code></a>
Remove unreachable lock configuration sources (<a
href="https://redirect.github.com/astral-sh/uv/issues/21409">#21409</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/bf041f9245952ba7c9e3c29aebe0a8acc2bc983d"><code>bf041f9</code></a>
Allow negating locked and frozen modes (<a
href="https://redirect.github.com/astral-sh/uv/issues/21408">#21408</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/feffc0b5bbf8aeca1dff4a6f042a58e44a5daf09"><code>feffc0b</code></a>
Bump async_http_range_reader to 0.11.1 (<a
href="https://redirect.github.com/astral-sh/uv/issues/21401">#21401</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.12.5...0.12.9">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-04 11:03:26 -04:00
dependabot[bot] b317dd1110 build(deps): bump python from cae66f2 to cad9a2c (#1307) 
> [!WARNING]
> Cooldown could not be applied because no publication date was
available from the registry.
>

Bumps python from `cae66f2` to `cad9a2c`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.7-slim&new-version=3.14.7-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-04 11:03:15 -04:00
dependabot[bot] faaa119884 build(deps): bump python from ce40764 to cae66f2 (#1278) 
Bumps python from `ce40764` to `cae66f2`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.7-slim&new-version=3.14.7-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-30 12:18:03 -04:00
dependabot[bot] cb3f6fee82 build(deps): bump astral-sh/uv from 0.11.3 to 0.12.5 in the docker-base-image-digests group (#1247) 
Bumps the docker-base-image-digests group with 1 update:
[astral-sh/uv](https://github.com/astral-sh/uv).

Updates `astral-sh/uv` from 0.11.3 to 0.12.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases">astral-sh/uv's
releases</a>.</em></p>
<blockquote>
<h2>0.12.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-08-14.</p>
<h3>Python</h3>
<ul>
<li>Add CPython 3.10.21, 3.11.16, and 3.12.14 (<a
href="https://redirect.github.com/astral-sh/uv/pull/21138">#21138</a>)</li>
<li>Prefer newer versions and standard variants when selecting between
equally prioritized Python interpreters (<a
href="https://redirect.github.com/astral-sh/uv/pull/21134">#21134</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Simplify errors and hints for invalid editable requirements, and
redact credentials in requirement URLs (<a
href="https://redirect.github.com/astral-sh/uv/pull/21130">#21130</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Allow <code>--index</code> and <code>--default-index</code> to
select configured package indexes by name with the
<code>index-by-name</code> preview feature (<a
href="https://redirect.github.com/astral-sh/uv/pull/17455">#17455</a>)</li>
<li>Include distribution artifact URLs and hashes in CycloneDX SBOM
exports by default (<a
href="https://redirect.github.com/astral-sh/uv/pull/21131">#21131</a>)</li>
<li>Fall back to logical file sizes when using
<code>cache-physical-space</code> on filesystems that do not support
physical-space accounting (<a
href="https://redirect.github.com/astral-sh/uv/pull/21133">#21133</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Resolve relative package index paths in PEP 723 scripts against the
script directory (<a
href="https://redirect.github.com/astral-sh/uv/pull/21097">#21097</a>)</li>
</ul>
<h2>Install uv 0.12.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c &quot;irm
https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.ps1
| iex&quot;
</code></pre>
<h2>Download uv 0.12.5</h2>
<table>
<thead>
<tr>
<th>File</th>
<th>Platform</th>
<th>Checksum</th>
</tr>
</thead>
<tbody>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td>
<td>Apple Silicon macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td>
<td>Intel macOS</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td>
<td>ARM64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td>
<td>x86 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td>
<td>x64 Windows</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td>
<td>ARM64 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-unknown-linux-gnu.tar.gz">uv-i686-unknown-linux-gnu.tar.gz</a></td>
<td>x86 Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-unknown-linux-gnu.tar.gz.sha256">checksum</a></td>
</tr>
<tr>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-powerpc64le-unknown-linux-gnu.tar.gz">uv-powerpc64le-unknown-linux-gnu.tar.gz</a></td>
<td>PPC64LE Linux</td>
<td><a
href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256">checksum</a></td>
</tr>
</tbody>
</table>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's
changelog</a>.</em></p>
<blockquote>
<h2>0.12.5</h2>
<p>Released on 2026-08-14.</p>
<h3>Python</h3>
<ul>
<li>Add CPython 3.10.21, 3.11.16, and 3.12.14 (<a
href="https://redirect.github.com/astral-sh/uv/pull/21138">#21138</a>)</li>
<li>Prefer newer versions and standard variants when selecting between
equally prioritized Python interpreters (<a
href="https://redirect.github.com/astral-sh/uv/pull/21134">#21134</a>)</li>
</ul>
<h3>Enhancements</h3>
<ul>
<li>Simplify errors and hints for invalid editable requirements, and
redact credentials in requirement URLs (<a
href="https://redirect.github.com/astral-sh/uv/pull/21130">#21130</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Allow <code>--index</code> and <code>--default-index</code> to
select configured package indexes by name with the
<code>index-by-name</code> preview feature (<a
href="https://redirect.github.com/astral-sh/uv/pull/17455">#17455</a>)</li>
<li>Include distribution artifact URLs and hashes in CycloneDX SBOM
exports by default (<a
href="https://redirect.github.com/astral-sh/uv/pull/21131">#21131</a>)</li>
<li>Fall back to logical file sizes when using
<code>cache-physical-space</code> on filesystems that do not support
physical-space accounting (<a
href="https://redirect.github.com/astral-sh/uv/pull/21133">#21133</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Resolve relative package index paths in PEP 723 scripts against the
script directory (<a
href="https://redirect.github.com/astral-sh/uv/pull/21097">#21097</a>)</li>
</ul>
<h2>0.12.4</h2>
<p>Released on 2026-08-13.</p>
<h3>Enhancements</h3>
<ul>
<li>Prefer post-quantum key exchange and enable opt-in TLS diagnostics
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21054">#21054</a>)</li>
<li>Accept whitespace before versions in noncompliant wildcard
comparisons such as <code>Requires-Python: &gt;= 3.5.*</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21012">#21012</a>)</li>
<li>Report a specific error when a PEP 723 closing tag contains trailing
whitespace or other content (<a
href="https://redirect.github.com/astral-sh/uv/pull/20944">#20944</a>)</li>
<li>Omit source-span carets from diagnostics for empty PEP 508
requirements (<a
href="https://redirect.github.com/astral-sh/uv/pull/21094">#21094</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Add <code>uv check --no-install-project</code> and respect
<code>UV_NO_INSTALL_PROJECT</code> to install dependencies without
building or installing the project (<a
href="https://redirect.github.com/astral-sh/uv/pull/21085">#21085</a>)</li>
<li>Make the ty subprocess invoked by <code>uv check</code> honor uv's
color and progress settings, including quiet mode (<a
href="https://redirect.github.com/astral-sh/uv/pull/21086">#21086</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Speed up resolutions with long runs of unavailable package versions
by coalescing gaps in the resolver's version ranges (<a
href="https://redirect.github.com/astral-sh/uv/pull/20804">#20804</a>)</li>
<li>Speed up Simple API parsing by deserializing PyPI and Pyx file
metadata directly (<a
href="https://redirect.github.com/astral-sh/uv/pull/21041">#21041</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Use windowed <code>pythonw.exe</code> launchers for virtual
environments created from managed Python minor-version links (<a
href="https://redirect.github.com/astral-sh/uv/pull/19235">#19235</a>)</li>
<li>Allow <code>uv lock</code> to proceed when <code>.venv</code> is an
unusable project environment (<a
href="https://redirect.github.com/astral-sh/uv/pull/21068">#21068</a>)</li>
<li>Respect <code>fork-strategy</code> when ordering forks created from
<code>environments</code> or existing lockfile
<code>resolution-markers</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21000">#21000</a>)</li>
<li>Preserve consecutive wildcard Python minor-version exclusions such
as <code>!=3.11.*, !=3.12.*</code> in <code>uv.lock</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/21045">#21045</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/210d1f6785e95a8c8c0d53e284408c9be1134700"><code>210d1f6</code></a>
Bump version to 0.12.5 (<a
href="https://redirect.github.com/astral-sh/uv/issues/21140">#21140</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/802a9162a1153ddee799a0080c80a38d96009d91"><code>802a916</code></a>
Sync latest Python releases: 3.10.21, 3.11.16, 3.12.14 (<a
href="https://redirect.github.com/astral-sh/uv/issues/21138">#21138</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/a6904bbdabd3c6ac42b1051896ff597c8bd1895a"><code>a6904bb</code></a>
Order equal-priority Python installations by key (<a
href="https://redirect.github.com/astral-sh/uv/issues/21134">#21134</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/728a70d25c0889d9aaa53776256c3a843eea67a6"><code>728a70d</code></a>
Improve automated fixes for related bug manifestations (<a
href="https://redirect.github.com/astral-sh/uv/issues/21102">#21102</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/b82b0383fc3471227aa864f18d2c1c8efac8b9f1"><code>b82b038</code></a>
Include hashes in cyclonedx exports (<a
href="https://redirect.github.com/astral-sh/uv/issues/21131">#21131</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/8011778d41f2c96fb0b856fb3cbcb4ec8d28cb63"><code>8011778</code></a>
Simplify editable requirement errors and hints (<a
href="https://redirect.github.com/astral-sh/uv/issues/21130">#21130</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/dca33f5e6799f2aefee52729732a839a3b358740"><code>dca33f5</code></a>
Fall back to logical cache accounting on unsupported filesystems (<a
href="https://redirect.github.com/astral-sh/uv/issues/21133">#21133</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/3a76e496e36783371a6d91a8f4834478964d36ca"><code>3a76e49</code></a>
Get rid of <code>Lock::with_manifest</code>, make
<code>Lock::from_resolution</code> take the manif...</li>
<li><a
href="https://github.com/astral-sh/uv/commit/7e6caa45f62a0506fea1b8ecfa0558e5d62d520c"><code>7e6caa4</code></a>
Support referencing indexes by name via <code>--index</code> and
<code>--default-index</code> (<a
href="https://redirect.github.com/astral-sh/uv/issues/17455">#17455</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/298dda41bff49bbd0a2f397e1662ab09b9cd148e"><code>298dda4</code></a>
Fix relative indexes in PEP 723 scripts (<a
href="https://redirect.github.com/astral-sh/uv/issues/21097">#21097</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.11.3...0.12.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/uv&package-manager=docker&previous-version=0.11.3&new-version=0.12.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-24 01:57:00 -04:00
CaliBrain 7d56624ab6 fix: group multi-file audiobooks that arrive as an archive (#1254) 
Follow-up to #1237. \`rename_and_group\` only grouped when the source
root was a directory, so a multi-file audiobook delivered as a single
archive fell through to the flat path: a \`Book.zip\` of twelve chapters
landed loose in the destination root with its original chapter names —
the layout #1181 is about.

The \`is_dir()\` guard was there to keep \`Book.zip/\` from becoming the
folder name, but skipping the file case gives up the grouping instead of
naming it. A non-directory source can only produce several book files by
having been extracted (\`collect_staged_files\` returns a single-element
list for every other file shape), so the archive stem is the release
name and the suffix is packaging: group under \`Book/\`.

Also regenerates the env docs for the new option and gives it the same
\"do not use with ingest folders\" caveat Rename and Organize carries,
since both now create directories in the destination.

Tested: reverting only the source fix makes both new tests fail and the
\`rename\` control case pass, so grouping stays opt-in. Full non-e2e
suite green (2653 passed).
 2026-08-21 10:43:06 -04:00
Sujeito OperatorandCaliBrain 52c1702419 docker: mount uv at build time instead of copying it into every image (#1200) 
### What this PR does

`uv` stops being copied into the image and starts being mounted into the
three `RUN`s that
actually use it. The digest pin stays in exactly one place — it moves
from the `COPY` to a
stage declaration:

```dockerfile
FROM ghcr.io/astral-sh/uv:0.11.3@sha256:90bbb3c... AS uv
```
```dockerfile
RUN --mount=type=cache,target=/root/.cache/uv \
    --mount=from=uv,source=/uv,target=/usr/local/bin/uv \
    uv sync --locked --no-default-groups
```

A stage consumed only through `--mount=from=` contributes no layer to
anything published, so
`uv` never lands in `base`. The two `RUN rm -f /usr/bin/uv /usr/bin/uvx`
lines then have nothing
left to delete and go with it.

### Why

The `base` stage copies uv in, and both final stages try to take it back
out:

```dockerfile
# uv is only needed while building the image.
RUN rm -f /usr/bin/uv /usr/bin/uvx
```

That intent is exactly right. **The mechanism can't carry it out**: a
`RUN` adds a layer, it
does not rewrite the layer underneath. The `COPY` layer is still pushed
and still pulled by
everyone. What the `rm` produces is a whiteout on top of it.

### Measured, not assumed

Read off the published images over the registry API — `linux/amd64`,
both built
`2026-08-13T17:53Z`, pinned by digest so these numbers stay reproducible
after tonight's
scheduled rebuild:

```
ghcr.io/calibrain/shelfmark@sha256:9b6041f797cbcc1e5c50ab42bd010a8f747dfaac926080cb6269ddfae99cf820
  layer  COPY /uv /uvx /bin/                        24.3 MB   of 585 MB total   4.1% of the pull
  layer  RUN rm -f /usr/bin/uv /usr/bin/uvx              159 B

ghcr.io/calibrain/shelfmark-lite@sha256:2eae503d791cef685e10135aaaff77077cfb4a31d6911e31216704988ce28b02
  layer  COPY /uv /uvx /bin/                        24.3 MB   of 221 MB total  11.0% of the pull
```

The `rm` layer unpacks to exactly four tar entries:

```
usr/
usr/bin/
usr/bin/.wh.uv       0 bytes
usr/bin/.wh.uvx      0 bytes
```

Two zero-length overlayfs whiteouts. That is the deletion behaving
exactly as specified — and
removing nothing at all from what anyone downloads.

Same thing without the registry API:

```
$ docker manifest inspect ghcr.io/calibrain/shelfmark-lite:latest
```

and look for the ~24 MB layer; or `docker history` on a local build.

### To be clear about what the `rm` does and doesn't do

**It is not useless and I'm not claiming it is.** It removes `uv` from
the flattened filesystem,
which is what the container sees at runtime and what Trivy/Grype scan by
default — so the
"don't ship a stale installer" half of the intent is already working
today, the same way the
`pip` removal above it does. This PR is about the other half: the bytes.
After it, `uv` is
absent from the filesystem *and* absent from the layers, so nothing
regresses.

This is image size, not a vulnerability, and I would not have opened it
as anything else.

### Why this is safe

- **Nothing at runtime can depend on `uv` or `uvx` today**, and that is
read off your own
artifact rather than argued: both are already whiteouted out of both
published images. `uvx`
is never invoked anywhere in the repo — `entrypoint.sh` has no `uv` in
it, and the Makefile's
  `uv run` lines are the host-side dev workflow, outside the image.
- `/usr/local/bin` is already on `PATH` in `python:3.14.7-slim`, and
your `ENV PATH=/app/.venv/bin:$PATH`
prepends rather than replaces, so `uv` resolves the same way it does
now.
- The pin does not move. Same image, same `sha256`, same resolution per
target platform as
`COPY --from=<image>` does today, so the `linux/amd64` and `linux/arm64`
builds each keep
  getting their own `uv`.
- `RUN --mount=` is already used three times in this file, so the
frontend in use supports
  mounts; `from=` is part of the same feature.
- Your `docker-build-check` job builds `shelfmark-lite` on every PR, so
a build is the cheapest
possible review of this change. As a first-time contributor my workflow
runs sit at
`action_required` until someone approves them — approving is enough to
check the whole claim.

### Notes for reviewers

- I have **not** built these images locally. There is no Docker daemon
on the machine I run on.
Every figure above is read from the published images over the registry
API, and my own
  selftest re-reads them live on each run rather than trusting a note.
- I left the `pip` removal in `base` alone. It has the same shape, but
its stated goal — keeping
a stale installer out of what scanners see — is genuinely achieved by
the flattened
filesystem, and `pip` arrives in the `python:slim` base layer where a
Dockerfile change can't
  reach it anyway.
- Written by an automated agent; saying so plainly seemed better than
not.

Signed-off-by: Sujeito Operator <operator@sujeito.org>
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-08-15 11:32:37 -04:00
dependabot[bot] 78e1f4daba Bump python from 83c1ceb to ce40764 (#1206) 
Bumps python from `83c1ceb` to `ce40764`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.7-slim&new-version=3.14.7-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-15 11:16:14 -04:00
dependabot[bot] 7f770f54fa Bump python from 3.14.6-slim to 3.14.7-slim (#1190) 
Bumps python from 3.14.6-slim to 3.14.7-slim.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.7-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-12 00:21:24 -04:00
CaliBrain cc1a95f965 Fix protection bypass cancelled by stall detection at exactly 300s (#1184) 
A download that hits Cloudflare hung on "Bypassing protection..." for
five
minutes and then died, regardless of which bypasser was configured.

html_get_page() started a BypassHeartbeat thread to keep the download
marked
alive during a bypass, but the thread had no loop: it fired one status
event
and returned. Even with the loop restored it could not have worked,
because
update_download_status() dedupes identical (status, message) tuples and
returns before refreshing _last_activity, and the heartbeat re-sent the
byte-identical payload already emitted just above it.

So _last_activity was frozen for the whole bypass, while both bypassers
are
allowed to run longer than STALL_TIMEOUT (external FlareSolverr ~394s at
default settings, internal 420s per get() call). The watchdog always
won.
From a reporter's log: 403 at 07:04:33.390, cancelled at 07:09:33.987 -
exactly 300.000s, and 41s before the bypasser would have finished and
reported the real error, an HTTP 500 from FlareSolverr the user never
saw.

The regression is not one commit. 1f093de (#536) added the heartbeat and
the
dedup together and refreshed activity before the dedup return, so it
worked.
ff094be (#832) moved the refresh below that return while tightening
stall
detection for #823. 3a3a3ce (#845) then deleted the heartbeat's while
loop
to silence a B023 lint, removing the last evidence of intent.

The dedup itself is correct and stays: a keep-alive that ticks on a
timer
proves nothing about whether an operation is progressing, so letting it
refresh the stall clock would make a wedged download immortal. Split the
two
concerns instead.

Add shelfmark/download/activity.py. A long single-shot operation
declares its
own upper bound once, over a sentinel status carried on the existing
status_callback channel - so no new parameter has to be threaded through
every
handler, post-processor and output module. The orchestrator intercepts
the
sentinel in its per-task closure and records an absolute deadline in
_activity_grace, which stall detection honours alongside STALL_TIMEOUT.
The
grace never extends itself and is clamped to
_MAX_ACTIVITY_GRACE_SECONDS, so
an operation that overruns its own declared budget is still cancelled.

Each bypasser now reports max_duration_seconds() derived from its own
retry
and timeout settings, and http.py asks whichever is active, plus 30s of
slack
so the bypasser's own deadline expires first and the user sees its real
failure. On that path html_get_page() also emits
status_callback("error", ...)
rather than silently returning an empty page.

Three further fixes on the same code path:

- Extract the watchdog into _find_stalled_tasks() and
_cancel_stalled_task().
It was the only place holding _progress_lock across a call into
book_queue,
whose terminal-status hooks reach a sqlite write that gevent does not
patch,
blocking the hub and every download worker. It now holds the lock for
dict
  reads only.
- Bound _CDP_WORKER.run(), which waited with timeout=None while holding
the
module-wide LOCKED, so a single wedged in-process CDP session blocked
every
  subsequent bypass forever on non-Docker installs.
- Broaden the coordinator loop's except clause back to Exception, with
  escalating backoff. 8d98e12 (#868) narrowed it to a six-type tuple to
silence BLE001, which let gevent's LoopExit and similar kill the only
thread
driving the download queue - undoing #832's fix for #823 and resurfacing
it
  as #1166. GreenletExit and gevent.Timeout still propagate.

Fixes #1001
Refs #1166, #823
 2026-08-11 02:25:28 -04:00
CaliBrain dfcd7c9b00 Fix silent Hardcover search failures on rejected sort values (#1183) 
Hardcover forwards the `sort` argument to Typesense's `sort_by` and
rejects
the entire search if it dislikes the value -- an unknown field, a bare
field
name with no direction, or more than three sort keys. A rejected search
is
not a GraphQL error: it comes back as HTTP 200, no `errors` key, and a
null
`results` body.

_extract_typesense_hits() reads that null as `hits=[], found=0`, so a
failed
search was indistinguishable from one that matched nothing. Users saw
zero
results with a healthy container and no log line explaining why.

Add _execute_search_query(), used by the three sort-bearing call sites
(book
search, field typeahead, series resolution):

- Detect the rejection via the null `results` body. A search that
genuinely
matched nothing still returns a results object with `found: 0`, so empty
    result sets are not mistaken for failures.
- Retry once with an empty sort, which Hardcover always accepts, so
searches
    return results instead of nothing.
- Keep that fallback sticky for 15 minutes so every subsequent search
does
not pay for a request known to fail, and let it expire so sort order
comes
    back on its own if the index is fixed upstream.
- Log rejections that no sort can explain, and retries that also fail,
at
    ERROR instead of discarding them.

While the fallback is active, results fall back to Typesense's default
ordering regardless of the selected sort. Degraded ordering beats no
results,
and it is now logged rather than silent.

SORT_MAPPING itself is unchanged: all five of its values were verified
against
the live API and return results. The `sort: "relevance"` reported in
#1179 was
the raw SortOrder value sent by v1.3.5; the mapping already fixed that.
What
remained unfixed, and is fixed here, is that the failure was invisible.

Fixes #1179
 2026-08-11 01:35:41 -04:00
dependabot[bot] bd9a22bd6c Bump node from a0b9bf0 to d32cdf6 in the docker-base-image-digests group (#1168) 
Bumps the docker-base-image-digests group with 1 update: node.

Updates `node` from `a0b9bf0` to `d32cdf6`


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node&package-manager=docker&previous-version=24-alpine&new-version=24-alpine)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-11 01:06:51 -04:00
dependabot[bot] 8eb9bd5c21 Bump python from d3400aa to cea0e60 (#1131) 
Bumps python from `d3400aa` to `cea0e60`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-24 18:33:45 -04:00
dependabot[bot] 2d949d4e7c Bump python from b877e50 to d3400aa (#1119) 
Bumps python from `b877e50` to `d3400aa`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-19 02:52:03 -04:00
Alex SchittkoandCaliBrain 40d6a179b7 feat: native WireGuard VPN egress mode (USING_WIREGUARD) (#1097) 
Add an opt-in WireGuard egress path alongside the existing Tor mode

---------

Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-07-06 01:51:18 -04:00
CaliBrain 02a45c1a12 fix: pin chromium to 149.0.7827.196 — Debian's 150 breaks the CDP bypasser (#1105) 2026-07-06 01:33:10 -04:00
Alex Schittko 8b4230ee9f fix(bypass): resolve Xlib namespace collision breaking CDP browser startup (#1099) 
## Problem

The full (browser) image ships two conflicting distributions that both
own the top-level `Xlib/` namespace:

- **`python-xlib` 0.33** (2022) — pulled by the `browser` extra
- **`python3-xlib` 0.15** (2014) — pulled transitively via `pyautogui` →
`mouseinfo`

Both install into the same `Xlib/` directory, so install order decides
which files survive. When the 2014 `python3-xlib` lands last, `Xlib.X`
is missing the `FamilyServerInterpreted` attribute that the SeleniumBase
Pure-CDP driver references during browser startup. Every bypass attempt
then fails with:

```
Pure CDP browser startup failed: module 'Xlib.X' has no attribute 'FamilyServerInterpreted'
Bypasser error: RuntimeError: Pure CDP browser startup failed: module 'Xlib.X' has no attribute 'FamilyServerInterpreted'
```

Result: **all Cloudflare / DDoS-Guard protected downloads fail** on
affected builds.

## Fix

After the browser stack is installed, uninstall the stale `python3-xlib`
and force-reinstall `python-xlib==0.33` so it deterministically owns the
namespace. A build-time assertion checks
`Xlib.X.FamilyServerInterpreted` exists so the image fails fast if the
collision ever returns.

`pyautogui` operates correctly against `python-xlib` 0.33 (superset
API), so nothing else regresses.

## Testing

- Reproduced live: a build where `python3-xlib` won produced the exact
`FamilyServerInterpreted` error on every CDP browser start; removing it
and reinstating `python-xlib==0.33` immediately restored `Chrome browser
ready (Pure CDP)` and successful `_bypass_method_cdp_solve`.
- The new build-time assertion prints `Xlib namespace OK: (0, 33)` and
exits non-zero if the attribute is ever missing.
 2026-07-04 09:50:33 -04:00
dependabot[bot] 14bd50bfd1 Bump python from 63a4c7f to b877e50 (#1100) 
Bumps python from `63a4c7f` to `b877e50`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-04 09:46:45 -04:00
dependabot[bot] 76c55a488c Bump node from 156b55f to a0b9bf0 in the docker-base-image-digests group (#1089) 
Bumps the docker-base-image-digests group with 1 update: node.

Updates `node` from `156b55f` to `a0b9bf0`


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node&package-manager=docker&previous-version=24-alpine&new-version=24-alpine)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-26 14:53:45 -04:00
dependabot[bot] 08d0a04cf2 Bump python from 44dd044 to 63a4c7f (#1090) 
Bumps python from `44dd044` to `63a4c7f`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.6-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-26 14:53:28 -04:00
dependabot[bot] 3c1b79989a Bump node from fb71d01 to 156b55f in the docker-base-image-digests group (#1075) 
Bumps the docker-base-image-digests group with 1 update: node.

Updates `node` from `fb71d01` to `156b55f`


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node&package-manager=docker&previous-version=24-alpine&new-version=24-alpine)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-21 00:00:22 -04:00
dependabot[bot] e41c1d4e8e Bump python from 3.14.5-slim to 3.14.6-slim (#1076) 
Bumps python from 3.14.5-slim to 3.14.6-slim.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python&package-manager=docker&previous-version=3.14.5-slim&new-version=3.14.6-slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-21 00:00:13 -04:00
dependabot[bot] b5acbc1209 Bump node from 2bdb65e to fb71d01 in the docker-base-image-digests group (#1061) 
Bumps the docker-base-image-digests group with 1 update: node.

Updates `node` from `2bdb65e` to `fb71d01`


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=node&package-manager=docker&previous-version=24-alpine&new-version=24-alpine)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-06-14 01:41:02 -04:00
dependabot[bot]andCaliBrain 709d3828d9 Bump the docker-base-image-digests group across 1 directory with 2 updates (#1015) 
Bumps the docker-base-image-digests group with 2 updates in the /
directory: node and python.

Updates `node` from `d1b3b4d` to `2bdb65e`

Updates `python` from 3.14-slim to 3.14.5-slim


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-06-09 20:43:01 -04:00
Alex b67df083e6 Remove installer tooling from runtime images (#978) 2026-05-10 15:08:44 +01:00
Alex f4daf05d03 Pin Docker base image digests (#969) 2026-05-09 14:37:44 +01:00
Alex 41c4aa1d72 Updated permissions model and non-root support (#871) 
- Adds a non-root startup path at user 1000:1000 - skips privilege
escalation and ownership checks. Works e.g. for kubernetes deployments
(user 1000:1000 and runAsNonRoot enabled).
- Remove startup check/chown commands for user-owned folders. Checks can
be done with a "Test destination" button in settings which performs a
test write. Users are responsible for fixing their own permissions.
- Update docs
 2026-04-12 08:22:32 +01:00
Alex e3d5bd91fc Bump node to 24 LTS (#853) 2026-04-10 13:29:48 +01:00
Alex 3a3a3ce449 Add new python tooling + apply ruff linter cleanup (#845) 
- Adds `uv`, `ruff`, `pyright`, `vulture` and `pytest-xdist`
- Move project, lockfile, docker build etc to uv
- Align python tooling on 3.14
- Huge bulk of ruff linter fixes applied. Still in progress but all the
core types are now enforced
- Update CI and test helpers
 2026-04-10 13:03:25 +01:00
Alexanddependabot[bot] 21a11b06b9 Dependency updates roll-up (#765) 
Supersedes the dependabot PRs after testing: 
- `actions/attest-build-provenance`
- `docker/build-push-action`
- `actions/checkout`
- `seleniumbase`
- `docker/metadata-action`
- `actions/setup-node`
- `python:3.14-slim`
- `@types/node`
- `postcss`
- `react-router-dom`

Left out for now: 
- `node:25-alpine`
- `vite@8`
- `@vitejs/plugin-react@6`

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-13 18:41:02 +00:00
Alex 7d992c3918 User DB cleanup and refactor (#686) 
- Refactored user and request code to avoid any database conflicts
- Fix threading behavior with custom script execution
- Harden the no_auth activity user filtering
- Add a hint to add local admin if none is created
- Added secret key to persist login states across updates / restarts
 2026-03-02 15:41:15 +00:00
Alex b10458a48b Patch: Migrate bypasser to pure CDP + Misc fixes (#575) 
Bypasser:
- Refactored internal bypasser logic to use SeleniumBase Pure CDP mode,
removed chromedriver dependencies and UC code.
- Added dedicated threading for internal bypasser functions, fixes any
potential asyncio CPU spike behavior
- Fixed WebGL issue with Chromium 144. Reverted 1.0.3 hotfix and updated
to latest Chromium

Misc: 
- Added M4A color mapping
- Fix frontend language filtering with multi-language releases
- Added "days" age for usenet/torrent releases
- Improved entrypoint chown efficiency
- Added `ONBOARDING` env variable, default true
 2026-02-02 20:32:19 +00:00
Alex 10bfaec793 Fix: Broken bypasser dependencies (#540) 2026-01-26 08:02:26 +00:00
Alex edf25150bd Fix: various external client issues (#505) 2026-01-20 19:34:18 +00:00
Alex afeae46821 Rename to Shelfmark and IRC adjustments (#415) 2026-01-11 19:38:38 +00:00
Alex 06778184af Fix: Directory config and init process (#396) 2026-01-05 17:56:00 +00:00
Alex a0f8d14c45 Hardcover enhancements, refactor and cleanup, PUID/PGID additions (#365) 2025-12-28 22:51:40 +00:00
Alex a99dc1501d Prowlarr and IRC sources, Google Books, book series support + more (#361) 
## Headline features 

### Prowlarr plugin - search trackers and download usenet/torrent books

- Search any usenet/torrent tracker via Prowlarr, returns books within
Universal search
- Configure download clients in the app settings (Qbittorrent, Deluge,
Transmission, NZBget, SABnzbd)
- Unified download and file handling within the app, same as AA. 

### IRC plugin 
- Search IRCHighway #ebooks channel for books and download right in the
app.
- No setup needed
- Credit to OpenBooks for the broad idea and inspiration for best
practices for ebook-specific search and download.

### Google Books Metadata Provider
- Create a Google Cloud API key and use Google Books as a metadata
provider
- Not the best source (Hardcover is still recommended), but another
option and further redundancy for universal search

### Book series support
  - New "Series" search field in Hardcover provider
  - "Series order" sort option - lists books in reading order
  - "View Series" button in book details modal to search the full series
  - Series info display (e.g., "3 of 12 in The Wheel of Time")

## Others: 

- Better format filtering, helpful errors when formats rejected (e.g.,
"Found 3 ebooks but format not supported (.pdf). Enable in Settings >
Formats."
- Directory processing - Handles multi-file torrent/usenet downloads
properly
- Expand search toggle - Skip ISBN search to find more editions
- Filtered authors - Uses primary authors only (excludes
translators/narrators) for better search results
- Language multi-select - Filter releases by multiple languages

 Docker / Build / Testing

  - pip cache mounts - Faster Docker builds via BuildKit cache
  - npm cache mounts - Faster frontend builds
  - APT cleanup - Smaller final image size
  - Added make restart command for quick restarts without rebuild
- New pytest-based test framework with proper configuration
(pyproject.toml)
- Unit tests for all download clients (qBittorrent, Transmission,
Deluge, NZBGet, SABnzbd)
  - Bencode parsing tests
  - Cache tests
  - Integration tests for Prowlarr handler
  - E2E test framework
 2025-12-27 14:59:06 +00:00
Alex 823ceeef4a Settings pass, SOCK5 proxy, RAR/ZIP handling + more (#355) 
- Further pass on settings UI, rearranging and adding further options
- Full RAR/ZIP support, including automatic unzipping and moving valid
file formats to ingest folder
- SOCK5 proxy support
- Full pass on the orchestrator to handle RAR/ZIP and category-specific
ingest dirs regardless of release source.
- Enhanced debug output to include new config JSON files
- Further ReleaseModal refinement
 2025-12-23 21:14:34 +00:00
Alex a4173eafcb Restructure + abstraction, plugin system, settings UI, universal search mode (#351) 
Key changes:   

| Category | Lines | What it is |

|--------------------------|--------|----------------------------------------------------------------------|
| Docs | ~2,100 | plugin-settings.md, release-sources-plugin-guide.md,
provider README |
| Settings UI | ~1,650 | Modal, sidebar, field components (TextField,
SelectField, etc.) |
| ReleaseModal | ~1,200 | Universal mode release picker UI |
| Metadata Providers | ~2,100 | Hardcover + OpenLibrary + base classes |
| Core Infrastructure | ~2,150 | Cache decorator, queue, image cache,
models, config |
| main.py | ~1,570 | Flask routes (replaces old app.py but bigger) |
| Orchestrator | ~590 | Download queue management |
| Config/Settings Registry | ~1,400 | Backend settings system |
| Frontend Hooks | ~750 | useSettings, useSearch, useDownloadTracking,
etc. |
| Other Frontend | ~500 | BookGetButton, ReleaseCell, utils |
| Release Sources base | ~320 | Plugin interfaces |
 2025-12-22 12:13:11 -05:00
CaliBrain 15a61a5191 Fix tor timeout (#349) 
Tentative fix for #340
 2025-12-18 15:53:39 -05:00
Alex 122a3633c2 APP_ENV removal and secure cookie handling (#333) 
Hey, made the tweaks we discussed, plus a couple related fixes :)

- Removed APP_ENV entirely. All dev-specific functionality is enabled
via `DEBUG: true` env var
- Set secure cookie handling to false by default, added to the readme to
enable if exclusively using HTTPS connection
- Fixed healthcheck potentially not working with auth enabled
- Removed APP_ENV from docker compose files and made sure app.db lines
are included in all versions.

APP_ENV in people's existing composes should get ignored entirely and
will be put on the default env, so no issues when updating.
 2025-12-11 17:13:41 -05:00
CaliBrain 0e2580030b Change APP_ENV from 'prod' to 'dev' default (#331) 
Fix for #330
 2025-12-08 14:48:33 -05:00
CaliBrain b02ad7452c Remove deprecated /request route prefix support (#318) 
This commit removes all references to the deprecated /request route
prefix
that was previously used for dual routing. The following changes were
made:

- Removed register_dual_routes() function that registered routes with
/request prefix
- Removed url_for_with_request() helper function for generating /request
URLs
- Removed call to register_dual_routes(app) at application startup
- Removed /request/ prefixed favicon routes
- Updated StatusEndpointFilter to remove /request/api/status log
filtering
- Removed unused flask_url_for import

All routes now only use the standard paths without the /request prefix.
 2025-11-16 15:41:29 -05:00
CaliBrain 50e53a13b0 Fix Dockerfile for arm64 qemu crashes (#316) 
Added build arguments for platform-specific builds and debug output.
 2025-11-16 12:50:12 -05:00
Zack YanceyAlexZack Yanceydavidemarcoli
 		742da1c43a WebUI - Frontend Refactor (#302) 
This PR was coauthored by alexhb1 and davidemarcoli. It builds on the FE
rework created by alex, but adds a myriad of additional tweaks and
optimizations to make the frontend feel modern, fast, and responsive.
The summary of the changes is as follows:

### Architecture Changes
React/TypeScript Migration: Refactored frontend from template/JS
structure to React/TypeScript application for better maintainability and
scalability
WebSocket Integration: Implemented real-time updates for download status
and progress with automatic fallback to polling
Gevent Worker: Configured production WebSocket support

### UI/UX Improvements
<img width="1502" height="890" alt="Screenshot 2025-11-10 at 10 02
59 AM"
src="https://github.com/user-attachments/assets/86bf8649-623f-413c-b8e5-656e687e55a8"
/>

Downloads Sidebar: Replaced bottom downloads section with sidebar
interface for better organization
<img width="201" height="450" alt="Screenshot 2025-11-10 at 10 07 52 AM"
src="https://github.com/user-attachments/assets/92b98e7c-c3bc-4b7e-80f1-252c3a760e33"
/>

Status Badges: Color-coded download status indicators instead of plain
text
Pinned Header: Fixed header position for consistent navigation
Enhanced Book Cards: Improved layout and hover states with info modal
button
<img width="1474" height="899" alt="Screenshot 2025-11-10 at 10 08
18 AM"
src="https://github.com/user-attachments/assets/9216d8a3-f662-434d-80e6-2a69b96abc31"
/>

Download Progress: Circular progress indicator on download buttons
Toast Notifications: Added user feedback for actions
Spinner Feedback: Loading indicators on search and download buttons
Animations: Smooth transitions and fluid progress updates

### Mobile & Responsive Design
Mobile-friendly Layouts: Optimized book cards and search interface for
mobile
<img width="225" height="450" alt="Screenshot 2025-11-10 at 10 05 49 AM"
src="https://github.com/user-attachments/assets/c8236c1c-5837-4309-9577-46db7292a54b"
/>

Keyboard Handling: Improved mobile keyboard behavior with proper input
types
PWA Improvements: Enhanced progressive web app functionality
Responsive Search: Better search box width and positioning across
devices

### Developer Experience
Development Mode: Separate frontend dev server that works with existing
backend container
Makefile: Added build automation and development commands
Documentation: Updated README with frontend architecture details

### Bug Fixes
Fixed "Clear completed" functionality
Fixed dark mode toggle text
Fixed sticky header behavior
Fixed mobile search box positioning
Removed active downloads requirement for initial state view

### Additional Features
ESC Key: Close downloads sidebar with ESC key
Calibre-Web Button: Direct link to Calibre-Web instance
<img width="282" height="83" alt="Screenshot 2025-11-11 at 9 38 05 AM"
src="https://github.com/user-attachments/assets/273075be-9743-4e13-9e48-5bf498f6c067"
/>
Granular Status Tracking: More detailed download progress information
obtained via websockets

---------

Co-authored-by: Alex <alex.bilbie1@gmail.com>
Co-authored-by: Zack Yancey <yanceyz@proton.me>
Co-authored-by: davidemarcoli <davide@marcoli.ch>
 2025-11-14 15:48:44 -05:00
CaliBrain 199d8453eb Adding Release version (#263) 2025-08-30 03:10:15 -04:00
Federico Della Rovere 207cff96d3 External CloudFlare resolver (#245) 
Adding support for an external CloudFlare bypasser service and
introducing a new Docker image build with a dedicated target.

Key Changes
- Added `cloudflare_bypasser_external.py` for external bypasser
integration.
- Updated Docker Compose files to support the new service.
- Introduced a new Docker target for building a separate image for the
external bypasser.
- Refactored relevant modules to utilize the external bypasser when
configured.
- Documentation and configuration updates to reflect new options and
Docker targets.

Impact
- Users can now choose between internal and external CloudFlare
bypassing.
- New Docker image and target streamline deployment of the external
bypasser.
- Improved modularity and maintainability.
- No breaking changes for existing workflows.

Testing
- Manual and E2E tests performed for both bypasser modes.
- Docker Compose setups and new image build verified for development and
production.

Notes
Please review the new configuration options and Docker targets. Update
your environment and deployment scripts as needed. Feedback and
suggestions are welcome!
 2025-08-28 17:37:59 -04:00
jojo141185 d90db433c4 Fix: Correct healthcheck behavior (#189) 
### Problem
The current `HEALTHCHECK` uses a custom script that fails on any non-2xx
HTTP response. When the API returns a `401 Unauthorized` status (a
common and valid case), the container is incorrectly marked as
`unhealthy`, even though the web server is running perfectly.

### Solution
This PR replaces the custom `pyrequests` script with a standard `curl`
command. The new `HEALTHCHECK` now only verifies that the server is
reachable and responding to connections, regardless of the HTTP status
code.

`curl` is used instead of patching the existing script because it is the
standard, most robust, and simplest solution for this type of check in a
Docker environment. It removes a custom dependency and follows a
well-understood pattern.

This change ensures the container's health status accurately reflects
the state of the server process, improving reliability for orchestration
platforms.
 2025-07-14 15:29:29 -04:00