585 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
CaliBrain	893f7bdb92	fix(mam): keep the session ID on MAM and rerun Prowlarr's exact search (#1399) ... Follow-up to #1390. - The origin came from each result's infoUrl, matched by a regex that did not check the host, and the mam_id cookie had no domain. Any Prowlarr indexer returning a URL like https://evil.example?myanonamouse.net/t/1 sent the session ID to evil.example. Requests now always go to https://www.myanonamouse.net (Prowlarr's only MAM URL), with the cookie as a header and redirects off. Only results from Prowlarr's MyAnonamouse indexer are looked up, and their URLs must be on myanonamouse.net. - The lookup searched every category and read one page, so for common titles most of Prowlarr's results were missed (a "Dune" audiobook search: 56 audiobooks on the first 100 of 328 matches). It now reruns Prowlarr's exact search: the same query clean-up, the MAM main categories behind the Torznab categories searched (13/15/16 for audiobooks, 14 for e-books, all once expanded), and the MAM indexer's own search type, search-in options and languages. Further pages are read while IDs are missing, page 1 of every title first, at most 4 requests per search. - Failed requests back off for 1, 2, 4 ... up to 30 minutes. The 10th consecutive failure stops enrichment until Test MAM Session passes, the session ID changes, or Shelfmark restarts. - The detail cache prunes expired entries instead of growing for as long as Shelfmark runs.	2026-09-25 21:21:54 -04:00
dependabot[bot]andCaliBrain	efb1f66bc3	build(deps): bump astral-sh/uv from 0.12.16 to 0.12.19 in the docker-base-image-digests group across 1 directory (#1392) ... > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update in the / directory: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.12.16 to 0.12.19 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.19</h2> <h2>Release Notes</h2> <p>Released on 2026-09-24.</p> <h3>Python</h3> <ul> <li>Add PyPy 3.11.16 and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> <li>Update GraalPy 3.13.0 to build 25.4.4 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Format upload URLs with backticks in <code>uv publish</code> errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21934">#21934</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Run build-backend hooks with lazy imports on CPython 3.15 and later using the <code>build-lazy-imports</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21967">#21967</a>)</li> <li>Omit unused resolution settings from <code>uv.lock</code> and ignore changes to them when checking lockfile freshness with the <code>resolution-inputs</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21913">#21913</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (<a href="https://redirect.github.com/astral-sh/uv/pull/21971">#21971</a>)</li> <li>Recognize <code>1.0.0</code> as satisfying <code>===1</code> during installed-package checks, matching resolution (<a href="https://redirect.github.com/astral-sh/uv/pull/21931">#21931</a>)</li> <li>Avoid collisions between Git checkout readiness markers and <code>.ok</code> files in dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21891">#21891</a>)</li> <li>Preserve always-false <code>python_version</code> markers when parsing their serialized form (<a href="https://redirect.github.com/astral-sh/uv/pull/21939">#21939</a>)</li> </ul> <h3>Rust API</h3> <ul> <li>Restore the public <code>FlatDistributions</code> export and its <code>BTreeMap</code> conversion for downstream resolvers (<a href="https://redirect.github.com/astral-sh/uv/pull/21965">#21965</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Make individual preview-feature reference entries linkable by name (<a href="https://redirect.github.com/astral-sh/uv/pull/21950">#21950</a>)</li> </ul> <h2>Install uv 0.12.19</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c &quot;irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex&quot; </code></pre> <h2>Download uv 0.12.19</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.19</h2> <p>Released on 2026-09-24.</p> <h3>Python</h3> <ul> <li>Add PyPy 3.11.16 and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> <li>Update GraalPy 3.13.0 to build 25.4.4 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Format upload URLs with backticks in <code>uv publish</code> errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21934">#21934</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Run build-backend hooks with lazy imports on CPython 3.15 and later using the <code>build-lazy-imports</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21967">#21967</a>)</li> <li>Omit unused resolution settings from <code>uv.lock</code> and ignore changes to them when checking lockfile freshness with the <code>resolution-inputs</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21913">#21913</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (<a href="https://redirect.github.com/astral-sh/uv/pull/21971">#21971</a>)</li> <li>Recognize <code>1.0.0</code> as satisfying <code>===1</code> during installed-package checks, matching resolution (<a href="https://redirect.github.com/astral-sh/uv/pull/21931">#21931</a>)</li> <li>Avoid collisions between Git checkout readiness markers and <code>.ok</code> files in dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21891">#21891</a>)</li> <li>Preserve always-false <code>python_version</code> markers when parsing their serialized form (<a href="https://redirect.github.com/astral-sh/uv/pull/21939">#21939</a>)</li> </ul> <h3>Rust API</h3> <ul> <li>Restore the public <code>FlatDistributions</code> export and its <code>BTreeMap</code> conversion for downstream resolvers (<a href="https://redirect.github.com/astral-sh/uv/pull/21965">#21965</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Make individual preview-feature reference entries linkable by name (<a href="https://redirect.github.com/astral-sh/uv/pull/21950">#21950</a>)</li> </ul> <h2>0.12.18</h2> <p>Released on 2026-09-22.</p> <p>This release addresses <a href="https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7">GHSA-2cv4-cqwr-gwf7</a>, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.</p> <h3>Enhancements</h3> <ul> <li>Add <code>--output-format json</code> to <code>uv pip install</code> and <code>uv pip sync</code>, including for <code>--dry-run</code> and <code>--check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21893">#21893</a>)</li> <li>Add <code>--check</code> to <code>uv pip install</code> and <code>uv pip sync</code> to report planned changes without modifying the environment (<a href="https://redirect.github.com/astral-sh/uv/pull/21844">#21844</a>)</li> <li>Identify failures from <code>get_requires_for_build_*</code> hooks correctly in build errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21881">#21881</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Validate build requirements for <code>uv build --no-build-isolation</code> with <code>--preview-features build-dependency-check</code>; use <code>--skip-dependency-check</code> to opt out (<a href="https://redirect.github.com/astral-sh/uv/pull/21880">#21880</a>)</li> </ul> <h3>Performance</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/bea138450f0e620a4ce5765b0e38cff7b9f0799f"><code>bea1384</code></a> Bump version to 0.12.19 (<a href="https://redirect.github.com/astral-sh/uv/issues/21975">#21975</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/299a93de4b94e754f260c673d2de456afbdd4fb7"><code>299a93d</code></a> Sync latest Python releases (<a href="https://redirect.github.com/astral-sh/uv/issues/21970">#21970</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/30de9e2cc92018c7c16a1ab66bb9b8341fbf0eff"><code>30de9e2</code></a> Preserve query parameters in direct URL metadata (<a href="https://redirect.github.com/astral-sh/uv/issues/21971">#21971</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0e7433eee906fe81709c95c5bde556263367f21f"><code>0e7433e</code></a> Filter distribution hashes in tests (<a href="https://redirect.github.com/astral-sh/uv/issues/21941">#21941</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/c73db78f0b00580b3c67279b59b85153a9d0264d"><code>c73db78</code></a> Omit unused runtime settings from lockfiles (<a href="https://redirect.github.com/astral-sh/uv/issues/21913">#21913</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/ad123420aaa75b3bdbccf81496aaece8b9045b30"><code>ad12342</code></a> Add a preview feature for lazy build backend imports (<a href="https://redirect.github.com/astral-sh/uv/issues/21967">#21967</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/dd965a276182e2d46d80439feecd03216cc6643a"><code>dd965a2</code></a> Restore <code>FlatDistributions</code> for downstream resolvers (<a href="https://redirect.github.com/astral-sh/uv/issues/21965">#21965</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/214d7f677585fbb0bb46fadef890335e388641c0"><code>214d7f6</code></a> Use Astra for PR security reviews (<a href="https://redirect.github.com/astral-sh/uv/issues/21959">#21959</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3db665232544183edcb80dd7077b8051b365e236"><code>3db6652</code></a> Disable incremental compilation when publishing docs (<a href="https://redirect.github.com/astral-sh/uv/issues/21955">#21955</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e18f413b23bfe5f33bcc1a3a3de330e4716aedcf"><code>e18f413</code></a> Reproduce editable project relocation failure (<a href="https://redirect.github.com/astral-sh/uv/issues/21948">#21948</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.16...0.12.19">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz>	2026-09-25 19:18:30 -04:00
3 people	a05e002305	feat: narrator, series and bitrate columns for MyAnonamouse results (#1390) ... # feat: narrator, series and bitrate columns for MyAnonamouse results Addresses #605 and #934 (narrator in the release list). ## Problem Both requests were closed because the narrator isn't in Torznab results, which is correct. Prowlarr's MyAnonamouse indexer reads `author_info` but drops the `narrator_info` and `series_info` MAM returns next to it, and neither Prowlarr's `ReleaseInfo` nor the Torznab output has a field for them. Shelfmark's size tooltip already looks for a `narrator` Torznab attribute, but nothing ever sends one. When a book has several narrations, choosing one means going back and forth between Shelfmark and the tracker. ## Approach Optional, opt-in enrichment using the user's own MAM session (`mam_id`), the same approach AudioBookRequest's MAM indexer uses: 1. After the Prowlarr search, releases whose info URL is `…myanonamouse.net/t/<id>` are collected. 2. Shelfmark sends the same query text to MAM's JSON search (`/tor/js/loadSearchJSONbasic.php`, normally one request, at most 3), and matches torrents back to Prowlarr's results by torrent ID. The MAM origin is taken from the result URL, so a custom Prowlarr MAM base URL is respected, and the cookie is only ever sent to `*.myanonamouse.net`. 3. Adds `extra.narrator`, `extra.series` (`The Sun Eater #1`) and `extra.bitrate` / `extra.bitrate_value`. MAM has no bitrate field, so it's parsed from the uploader's free-text tags (`64 kbps`) and some releases won't have one. Lookups are cached per torrent for an hour, respect the existing Prowlarr search deadline, go through the configured proxy (`get_proxies`), and never fail the search: a 403, timeout or bad JSON is logged and the list renders without the extra details. ## Changes - **`release_sources/prowlarr/mam.py`** (new): small MAM client (`search`, and `get_username` for the test button), `narrator_info` / `series_info` / tags parsing, cached best-effort `lookup_torrent_details()`. A 403 includes MAM's reply and a note about the IP/ASN lock. - **`release_sources/prowlarr/source.py`**: enrichment after the result loop. Series, Narrator and Bitrate columns only when a MAM ID is configured, since otherwise they would be empty for every row. A Torznab `bitrate` attribute from other indexers is also mapped to `extra.bitrate`. - **`release_sources/prowlarr/settings.py`**: "MyAnonamouse Enrichment" section with `PROWLARR_MAM_ID` (password field, env-overridable like every setting) and a **Test MAM Session** button. - **`release_sources/__init__.py`**: `ColumnSchema` gains optional `setting_key` and `content_types`. The new `apply_column_visibility()` drops gated columns and their grid tracks. Neither field is serialized. - **`main.py`**: `/api/releases` applies `apply_column_visibility()` with the request's content type and the user's effective settings. - **`config/settings.py` / `users_settings.py`**: Search Mode › "Release List Columns" with `SHOW_SERIES_COLUMN`, `SHOW_NARRATOR_COLUMN` and `SHOW_BITRATE_COLUMN`, all default on and user-overridable. Narrator and bitrate are audiobook-only, series shows for both. AudiobookBay's existing bitrate column now follows the bitrate toggle. - **Frontend**: text cells truncate with a hover title; the mobile info line wraps and skips empty text/number cells so blank optional columns don't leave orphan `·` separators; the size tooltip no longer lists Bitrate twice. - **Docs**: new `docs/myanonamouse-enrichment.md` (linked from the index), and a regenerated `environment-variables.md`. The regeneration also picked up a few pre-existing drifts from `main` (the Libgen section, `AA_DEFAULT_SORT` default, a duplicate `BOOK_LANGUAGE` row). I can drop those if you'd rather keep this diff focused. ## ⚠️ MAM sessions are IP/ASN-locked MyAnonamouse locks each session to one IP or ASN. Reusing the session Prowlarr (or a seedbox script) uses will often **403**. **A separate MAM session for Shelfmark will likely be needed** when Shelfmark reaches MAM from a different IP (another host, a VPN container, or a proxy in Shelfmark's Network settings), or when the existing session is ASN-locked to another network. The setting's description, the error message and the new doc all say so. ## Testing - `tests/prowlarr/test_mam_enrichment.py` (new, 19 tests): parsing (narrator dedupe, multiple series, missing numbers, malformed JSON, tag bitrate), lookup (stops once all IDs are found, cache, 403 and connection errors return empty, expired deadline skips the request), only MAM releases enriched, Torznab bitrate mapping, column config with and without a MAM ID for audiobook and ebook, toggles, grid-track removal, and gates not serialized. - `tests/core/test_admin_users_api.py`: the curated search-preference key list now includes the three toggles. - Full `pytest -m "not integration and not e2e"` compared with an upstream `main` worktree on the same machine: no new failures. The remaining ~115 failures on both are Windows-only (tor/entrypoint shell tests, path separators). - `ruff check` / `ruff format --check` / `basedpyright` (0 errors) / `vulture` on touched files; frontend `tsc --noEmit`, `oxlint`, `oxfmt --check`, `vitest` (201 passed). - Manually verified with a real MAM account on a Docker build of this branch: the test button, then narrator, series and bitrate on MyAnonamouse audiobook results. No behavior change unless `PROWLARR_MAM_ID` is set, apart from the bitrate toggle on AudiobookBay (default on, same as today). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz>	2026-09-25 19:17:23 -04:00
dependabot[bot]andCaliBrain	bb430dfdbc	build(deps): bump seleniumbase from 4.54.9 to 4.54.10 in the python-deps group (#1382) ... Bumps the python-deps group with 1 update: [seleniumbase](https://github.com/seleniumbase/SeleniumBase). Updates `seleniumbase` from 4.54.9 to 4.54.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.54.10 - MCP Server: Patch 18</h2> <h2>MCP Server: Patch 18</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a010555082f7ef5d1568890c13177f6b60b78f98">Update the MCP server</a> --&gt; Make <code>manage_cookies</code> more secure. --&gt; Update docstrings.</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/fae54471dee9f8925e46235075e8d250972bea10">Refresh Python dependencies</a> --&gt; <code>platformdirs</code></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 18 by <a href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4509">seleniumbase/SeleniumBase#4509</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.9...v4.54.10">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.9...v4.54.10</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4c54cb7ffbc11b3a2cde4b85c81eb058b118504e"><code>4c54cb7</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4509">#4509</a> from seleniumbase/mcp-server-patch-18</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/df6fc937aae7e1a7f3bf058609f6e31edde38135"><code>df6fc93</code></a> Version 4.54.10</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/fae54471dee9f8925e46235075e8d250972bea10"><code>fae5447</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7cac7c15450feb08948c0f178e8abaad7633e037"><code>7cac7c1</code></a> Update MCP server versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a010555082f7ef5d1568890c13177f6b60b78f98"><code>a010555</code></a> Update the MCP server</li> <li>See full diff in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.9...v4.54.10">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz>	2026-09-25 19:17:08 -04:00
dependabot[bot]andCaliBrain	c11bf99848	build(deps): bump the npm-deps group in /src/frontend with 7 updates (#1394) ... Bumps the npm-deps group in /src/frontend with 7 updates: | Package | From | To | | --- | --- | --- | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.3` | `7.18.4` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.1` | `26.6.2` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.35.1` | `6.37.0` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.68.0` | `0.70.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.83.0` | `1.85.0` | | [oxlint-tsgolint](https://github.com/oxc-project/tsgolint) | `7.0.2001` | `7.0.2002` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.0` | `5.0.1` | Updates `react-router-dom` from 7.18.3 to 7.18.4 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/remix-run/react-router/blob/react-router-dom@7.18.4/packages/react-router-dom/CHANGELOG.md">react-router-dom's changelog</a>.</em></p> <blockquote> <h2>v7.18.4</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies: <ul> <li><a href="https://github.com/remix-run/react-router/releases/tag/react-router@7.18.4"><code>react-router@7.18.4</code></a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/remix-run/react-router/commit/1b1e0b0e79b21692ce907933475233babdd16e3e"><code>1b1e0b0</code></a> Release v7.18.4 (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/15498">#15498</a>)</li> <li>See full diff in <a href="https://github.com/remix-run/react-router/commits/react-router-dom@7.18.4/packages/react-router-dom">compare view</a></li> </ul> </details> <br /> Updates `@types/node` from 26.5.1 to 26.6.2 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `knip` from 6.35.1 to 6.37.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpro-nl/knip/releases">knip's releases</a>.</em></p> <blockquote> <h2>Release 6.37.0</h2> <ul> <li>fix(graphql-codegen): mark near-operation-file outputs as entries, not the documents directory (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2048">#2048</a>) (06a68fcf99a90e559daeb0b8fb2d24e173124774) - thanks <a href="https://github.com/RobHannay"><code>@​RobHannay</code></a>!</li> <li>fix: enable JSX in the config loader (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1959">#1959</a>) (5b21dc9192f773613d1c5db8edf35f0a68820268) - thanks <a href="https://github.com/addielaruee"><code>@​addielaruee</code></a>!</li> <li>Match binaries only to their actual dependency providers (c5bdb69ccbcb7e1056233f346d0ada3495d1013d)</li> <li>Preserve executable references across package manager commands (54af171638db22f5d903faae05c37c2ea6adc869)</li> <li>Correct binary provider metadata in Relay fixtures (e67dfcb96d055c27be9c8601e077656855bb632b)</li> <li>Separate shell binary expectations from reporting exemptions (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2022">#2022</a>) (c1d7d75a3529d9faff7f4c0df11dd0ca1bdfb149)</li> <li>Respect npx no-install flags before the executable (4237010c9a834eb8b04f4a528c76d10a5c38ee98)</li> <li>Update dependencies (038ea179f7d6bf7ca43bc5daf553a68b13a9067c)</li> <li>Remove npm auth check now that's in release-it (4aaf77c58004ac64063a1982b98e53107c2ebe93)</li> <li>Fix --format name resolution in the ESLint plugin (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2046">#2046</a>) (1269e98bb700384811fadc124d69ea720832037e) - thanks <a href="https://github.com/bytedoe"><code>@​bytedoe</code></a>!</li> </ul> <h2>Release 6.36.0</h2> <ul> <li>Add <code>@​tailwindcss/webpack</code> as Tailwind plugin enabler (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2027">#2027</a>) (b5ac0cf734dda3c6c6c51c817981dfc558b7c582) - thanks <a href="https://github.com/igas"><code>@​igas</code></a>!</li> <li>Fix Next.js Turbopack loader dependencies (23419b4edfd48796dd484fa880e1bad49a043d2e)</li> <li>Explain ambiguous star exports in traces (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2025">#2025</a>) (3c2c1a53f9c2b7ff3057a4e46761791979e0b09c) - thanks <a href="https://github.com/gioboa"><code>@​gioboa</code></a>!</li> <li>Fix eslintrc <code>parserOptions.parser</code> handling in ESLint plugin (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2028">#2028</a>) (c79463cec81d09518eda325ec00e6f12327dea8d) - thanks <a href="https://github.com/bytedoe"><code>@​bytedoe</code></a>!</li> <li>fix(compilers): require word boundary around import keyword (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2029">#2029</a>) (68bbe51c39b564022b63942bc83cb570778cca00) - thanks <a href="https://github.com/thanadolps"><code>@​thanadolps</code></a>!</li> <li>fix: recover from corrupt cache file (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2034">#2034</a>) (30ff7568c84e0a6731ca634a52314228d23d1a2b) - thanks <a href="https://github.com/gioboa"><code>@​gioboa</code></a>!</li> <li>fix: fix trailing comma on dependency removal (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2033">#2033</a>) (adfaf4f78878b6d55b0939a92d70a1fbb0ae1240) - thanks <a href="https://github.com/gioboa"><code>@​gioboa</code></a>!</li> <li>Document built-in compiler scope (a05e155276dad4ead16992580d17572cebf045e7)</li> <li>Add babel, khan and oxc to projects and optimize svgs (1c26560b98bc3109e93d15761d02f089213bfb6c)</li> <li>Add section to test preview packages &amp; extension (d911c18385f0aa41f53653a2a15cc90a1e0251b8)</li> <li>Fix shared info/exclude handling in linked Git worktrees (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2037">#2037</a>) (c1f18d5a7d25fc5a614747bbcbd62d043457eb48) - thanks <a href="https://github.com/kenfdev"><code>@​kenfdev</code></a>!</li> <li>Shard Node specs on Windows and enable Bun test parallelism (66e966b6edec4460b40b05847fefa9f90ee69068)</li> <li>Add Varlock plugin support (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2000">#2000</a>) (e4fbf46acff08e78370e72b142e795bd81f28561) - thanks <a href="https://github.com/Joehoel"><code>@​Joehoel</code></a>!</li> <li>Apply NODE_OPTIONS inputs to package manager binaries (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2038">#2038</a>) (c8df8a28e9a19484efe7097f984abc0c6556aff5) - thanks <a href="https://github.com/giaBaoJS"><code>@​giaBaoJS</code></a>!</li> <li>Handle array form of <code>import/resolver</code> setting in ESLint plugin (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2041">#2041</a>) (a80d386a80fdafc89c610d4887ec82184ac178db) - thanks <a href="https://github.com/bytedoe"><code>@​bytedoe</code></a>!</li> <li>fix(node): add valueless Node CLI flags to boolean options (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2042">#2042</a>) (4c6768501f7115a894d7ece9e5c32090b684cc6f) - thanks <a href="https://github.com/shoutoutuoadi325"><code>@​shoutoutuoadi325</code></a>!</li> <li>fix(typedoc): accept string form of plugin and theme options (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2043">#2043</a>) (ce387b05c8f136546e860ec73e29557563c63afa) - thanks <a href="https://github.com/giaBaoJS"><code>@​giaBaoJS</code></a>!</li> <li>Add textlint plugin (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2039">#2039</a>) (532dab595fc9a910e320418dc0390222fb2d7478) - thanks <a href="https://github.com/anandghegde"><code>@​anandghegde</code></a>!</li> <li>fix: Correctly resolve Vitest setupFiles from nested configs (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2040">#2040</a>) (84a494334e125d229dc865893b21d69d0d201e85) - thanks <a href="https://github.com/CruseCtrl"><code>@​CruseCtrl</code></a>!</li> <li>Add n8n to projects (3f756a7e70c4164d57a7dbbd58f3604afe4043e2)</li> <li>Resolve re-export traces to their defining bindings (43b3f9bbd7701ab44fca0554908f7550fbe84649)</li> <li>Show ambiguous, shadowed and converged exports (f1e97b998d80906f0cef3f5e3946833b7166cbdc)</li> <li>Document export tracing and editor contention (0188e7da1a481c7f6493d50580dfa8a7ecdf8c72)</li> <li>Resolve local <code>extends</code> files in eslintrc configs (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2044">#2044</a>) (62b5bf5aef5e6d3fc4784a1b5ef9933d383609ea) - thanks <a href="https://github.com/bytedoe"><code>@​bytedoe</code></a>!</li> <li>docs: link each page to its own OG image (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2045">#2045</a>) (a85eb4e2aab46c3fa0813b1f1e13e93e134b8be7) - thanks <a href="https://github.com/bytedoe"><code>@​bytedoe</code></a>!</li> <li>fix: fix language server bundled knip fallback (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2035">#2035</a>) (882ba3abb0b99c2bfe3e13a241d889376fe87c4c) - thanks <a href="https://github.com/gioboa"><code>@​gioboa</code></a>!</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpro-nl/knip/commit/675c1b1a3dbed53d57108dc90a060dc3d0c85b0b"><code>675c1b1</code></a> Release knip@6.37.0</li> <li><a href="https://github.com/webpro-nl/knip/commit/1269e98bb700384811fadc124d69ea720832037e"><code>1269e98</code></a> Fix --format name resolution in the ESLint plugin (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2046">#2046</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/038ea179f7d6bf7ca43bc5daf553a68b13a9067c"><code>038ea17</code></a> Update dependencies</li> <li><a href="https://github.com/webpro-nl/knip/commit/4237010c9a834eb8b04f4a528c76d10a5c38ee98"><code>4237010</code></a> Respect npx no-install flags before the executable</li> <li><a href="https://github.com/webpro-nl/knip/commit/c1d7d75a3529d9faff7f4c0df11dd0ca1bdfb149"><code>c1d7d75</code></a> Separate shell binary expectations from reporting exemptions (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2022">#2022</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/e67dfcb96d055c27be9c8601e077656855bb632b"><code>e67dfcb</code></a> Correct binary provider metadata in Relay fixtures</li> <li><a href="https://github.com/webpro-nl/knip/commit/54af171638db22f5d903faae05c37c2ea6adc869"><code>54af171</code></a> Preserve executable references across package manager commands</li> <li><a href="https://github.com/webpro-nl/knip/commit/c5bdb69ccbcb7e1056233f346d0ada3495d1013d"><code>c5bdb69</code></a> Match binaries only to their actual dependency providers</li> <li><a href="https://github.com/webpro-nl/knip/commit/5b21dc9192f773613d1c5db8edf35f0a68820268"><code>5b21dc9</code></a> fix: enable JSX in the config loader (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1959">#1959</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/06a68fcf99a90e559daeb0b8fb2d24e173124774"><code>06a68fc</code></a> fix(graphql-codegen): mark near-operation-file outputs as entries, not the do...</li> <li>Additional commits viewable in <a href="https://github.com/webpro-nl/knip/commits/knip@6.37.0/packages/knip">compare view</a></li> </ul> </details> <br /> Updates `oxfmt` from 0.68.0 to 0.70.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxfmt's releases</a>.</em></p> <blockquote> <h2>oxfmt v0.70.0</h2> <h3>🚀 Features</h3> <ul> <li>415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26763">#26763</a>) (leaysgur)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/288d8cc77984b0a3851c58c423ffe9e6edc79f2e"><code>288d8cc</code></a> release(apps): oxlint v1.85.0 &amp;&amp; oxfmt v0.70.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26903">#26903</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/f02a64a517a69a4eaa4ef83b722a3f10cf633f10"><code>f02a64a</code></a> release(apps): oxlint v1.84.0 &amp;&amp; oxfmt v0.69.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26874">#26874</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.70.0/npm/oxfmt">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.83.0 to 1.85.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxlint's releases</a>.</em></p> <blockquote> <h2>oxlint v1.85.0</h2> <h3>🚀 Features</h3> <ul> <li>415b742 oxlint,oxfmt: Do not discover nested config in Vite+ mode (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26763">#26763</a>) (leaysgur)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/288d8cc77984b0a3851c58c423ffe9e6edc79f2e"><code>288d8cc</code></a> release(apps): oxlint v1.85.0 &amp;&amp; oxfmt v0.70.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26903">#26903</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/f02a64a517a69a4eaa4ef83b722a3f10cf633f10"><code>f02a64a</code></a> release(apps): oxlint v1.84.0 &amp;&amp; oxfmt v0.69.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26874">#26874</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.85.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Updates `oxlint-tsgolint` from 7.0.2001 to 7.0.2002 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/tsgolint/releases">oxlint-tsgolint's releases</a>.</em></p> <blockquote> <h2>v7.0.2002</h2> <h2>What's Changed</h2> <ul> <li>feat(no-misused-promises): improve diagnostics by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1101">oxc-project/tsgolint#1101</a></li> <li>docs: update benchmarks by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1102">oxc-project/tsgolint#1102</a></li> <li>docs: declare tsgolint stable by <a href="https://github.com/Boshen"><code>@​Boshen</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1106">oxc-project/tsgolint#1106</a></li> <li>ci(semgrep): add scan workflow by <a href="https://github.com/Boshen"><code>@​Boshen</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1107">oxc-project/tsgolint#1107</a></li> <li>fix(no-unnecessary-template-expression): preserve expression precedence by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1108">oxc-project/tsgolint#1108</a></li> <li>feat(no-unsafe-assignment): improve diagnostics by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1105">oxc-project/tsgolint#1105</a></li> <li>feat(no-unsafe-return): improve diagnostics by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1110">oxc-project/tsgolint#1110</a></li> <li>chore: disable typescript-go renovate updates by <a href="https://github.com/Boshen"><code>@​Boshen</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1116">oxc-project/tsgolint#1116</a></li> <li>chore(deps): update github actions by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1117">oxc-project/tsgolint#1117</a></li> <li>chore(deps): update actions/setup-go action to v7 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1118">oxc-project/tsgolint#1118</a></li> <li>chore(deps): update dependency typescript to v7 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1119">oxc-project/tsgolint#1119</a></li> <li>chore(deps): update pnpm to v11.17.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1123">oxc-project/tsgolint#1123</a></li> <li>chore(deps): update github actions by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1124">oxc-project/tsgolint#1124</a></li> <li>fix(no-misused-promises): guard nil contextual type in return statements by <a href="https://github.com/connorshea"><code>@​connorshea</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1121">oxc-project/tsgolint#1121</a></li> <li>feat(no-unsafe-type-assertion): improve diagnostics by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1111">oxc-project/tsgolint#1111</a></li> <li>fix(prefer-readonly-parameter-types): ignore private mapped properties by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1125">oxc-project/tsgolint#1125</a></li> <li>chore(deps): update crate-ci/typos action to v1.49.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1130">oxc-project/tsgolint#1130</a></li> <li>chore(deps): update github actions by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1135">oxc-project/tsgolint#1135</a></li> <li>chore(deps): update module github.com/dlclark/regexp2/v2 to v2.6.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1136">oxc-project/tsgolint#1136</a></li> <li>ci: remove Semgrep workflow by <a href="https://github.com/Boshen"><code>@​Boshen</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1138">oxc-project/tsgolint#1138</a></li> <li>chore(deps): update taiki-e/install-action action to v2.85.13 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1139">oxc-project/tsgolint#1139</a></li> <li>chore(deps): update gomod by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1140">oxc-project/tsgolint#1140</a></li> <li>fix(consistent-type-exports): split diagnostic help text by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1144">oxc-project/tsgolint#1144</a></li> <li>fix(no-confusing-void-expression): split diagnostic help text by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1145">oxc-project/tsgolint#1145</a></li> <li>fix(no-implied-eval): split diagnostic help text by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1146">oxc-project/tsgolint#1146</a></li> <li>fix(no-unsafe-type-assertion): split diagnostic help text by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1147">oxc-project/tsgolint#1147</a></li> <li>fix(no-useless-default-assignment): split diagnostic help text by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1148">oxc-project/tsgolint#1148</a></li> <li>fix(prefer-readonly): split diagnostic help text by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1149">oxc-project/tsgolint#1149</a></li> <li>fix(strict-boolean-expressions): split diagnostic help text by <a href="https://github.com/camc314"><code>@​camc314</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1150">oxc-project/tsgolint#1150</a></li> <li>chore(deps): update github.com/go-json-experiment/json digest to c27c302 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1151">oxc-project/tsgolint#1151</a></li> <li>chore(deps): update dependency dprint-toml to v0.8.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1152">oxc-project/tsgolint#1152</a></li> <li>chore(deps): update npm packages by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1153">oxc-project/tsgolint#1153</a></li> <li>chore(deps): update taiki-e/install-action action to v2.86.4 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1154">oxc-project/tsgolint#1154</a></li> <li>chore(deps): update crate-ci/typos action to v1.49.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1157">oxc-project/tsgolint#1157</a></li> <li>chore(deps): update dependency dprint-markdown to v0.23.2 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1158">oxc-project/tsgolint#1158</a></li> <li>chore(deps): update taiki-e/install-action action to v2.87.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1159">oxc-project/tsgolint#1159</a></li> <li>chore(deps): update crate-ci/typos action to v1.50.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1162">oxc-project/tsgolint#1162</a></li> <li>chore(deps): update pnpm to v11.24.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1164">oxc-project/tsgolint#1164</a></li> <li>fix(no-unnecessary-boolean-literal-compare): preserve nullable boolean narrowing by <a href="https://github.com/sharmila-oai"><code>@​sharmila-oai</code></a> in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1160">oxc-project/tsgolint#1160</a></li> <li>chore(deps): update crate-ci/typos action to v1.50.1 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1169">oxc-project/tsgolint#1169</a></li> <li>chore(deps): update github actions by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1171">oxc-project/tsgolint#1171</a></li> <li>chore(deps): update module github.com/dlclark/regexp2/v2 to v2.7.2 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1172">oxc-project/tsgolint#1172</a></li> <li>chore(deps): update dependency dprint-markdown to v0.23.3 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1170">oxc-project/tsgolint#1170</a></li> <li>chore(deps): update npm packages by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1173">oxc-project/tsgolint#1173</a></li> <li>chore(deps): update dependency vitest to v5 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1174">oxc-project/tsgolint#1174</a></li> <li>chore(deps): update dependency dprint-markdown to v0.24.0 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1178">oxc-project/tsgolint#1178</a></li> <li>chore(deps): update taiki-e/install-action action to v2.87.10 by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1177">oxc-project/tsgolint#1177</a></li> <li>chore(deps): update gomod by <a href="https://github.com/renovate"><code>@​renovate</code></a>[bot] in <a href="https://redirect.github.com/oxc-project/tsgolint/pull/1179">oxc-project/tsgolint#1179</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/tsgolint/commit/acd88e1b1ef8f219e8956f804f2548dafd949705"><code>acd88e1</code></a> perf(prefer-regexp-exec): defer argument type resolution (<a href="https://redirect.github.com/oxc-project/tsgolint/issues/1207">#1207</a>)</li> <li><a href="https://github.com/oxc-project/tsgolint/commit/14908447a2a1cad72aa8a43faf72170ddd21606e"><code>1490844</code></a> perf(use-unknown-in-catch-callback-variable): defer annotation fixes (<a href="https://redirect.github.com/oxc-project/tsgolint/issues/1206">#1206</a>)</li> <li><a href="https://github.com/oxc-project/tsgolint/commit/d11b717674dd549832ce2f95654fa76ac1337a2d"><code>d11b717</code></a> perf(strict-boolean-expressions): avoid temporary variant maps (<a href="https://redirect.github.com/oxc-project/tsgolint/issues/1205">#1205</a>)</li> <li><a href="https://github.com/oxc-project/tsgolint/commit/fe1ecf30b8ab6e6fac25bef55ad25c9296417bd1"><code>fe1ecf3</code></a> perf(no-unsafe-unary-minus): skip type queries for literals (<a href="https://redirect.github.com/oxc-project/tsgolint/issues/1203">#1203</a>)</li> <li><a href="https://github.com/oxc-project/tsgolint/commit/e42a51052afbdd4787a44740ed44391b695e3bce"><code>e42a510</code></a> perf(no-deprecated): skip type queries for empty allow lists (<a href="https://redirect.github.com/oxc-project/tsgolint/issues/1202">#1202</a>)</li> <li><a href="https://github.com/oxc-project/tsgolint/commit/94ee8ac38f44244e7a4895d4a8eb55421be06a29"><code>94ee8ac</code></a> perf(restrict-template-expressions): avoid unnecessary base-type checks (<a href="https://redirect.github.com/oxc-project/tsgolint/issues/1204">#1204</a>)</li> <li><a href="https://github.com/oxc-project/tsgolint/commit/7bbe34100a66912ff134bbbeda5fd88f456e1e17"><code>7bbe341</code></a> perf(await-thenable): skip aggregator checks for empty calls (<a href="https://redirect.github.com/oxc-project/tsgolint/issues/1201">#1201</a>)</li> <li><a href="https://github.com/oxc-project/tsgolint/commit/8296505a3a50b26bf5f8d586d7887d2c1c6c1da5"><code>8296505</code></a> perf(no-base-to-string): avoid temporary certainty slices (<a href="https://redirect.github.com/oxc-project/tsgolint/issues/1200">#1200</a>)</li> <li><a href="https://github.com/oxc-project/tsgolint/commit/636677305c6fbf581241bf2d49b5d217c23c2da1"><code>6366773</code></a> perf(no-unnecessary-template-expression): defer single-interpolation fixes (#...</li> <li><a href="https://github.com/oxc-project/tsgolint/commit/8300b95c905e44d912896e9a75958e41eb5d8d32"><code>8300b95</code></a> perf(unbound-method): check native names before resolving symbols (<a href="https://redirect.github.com/oxc-project/tsgolint/issues/1198">#1198</a>)</li> <li>Additional commits viewable in <a href="https://github.com/oxc-project/tsgolint/compare/v7.0.2001...v7.0.2002">compare view</a></li> </ul> </details> <br /> Updates `vitest` from 5.0.0 to 5.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v5.0.1</h2> <h3>   🚀 Features</h3> <ul> <li><strong>ui</strong>: <ul> <li>Move trace attempts selector to viewer header  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11189">vitest-dev/vitest#11189</a> <a href="https://github.com/vitest-dev/vitest/commit/5dc4b5c92"><!-- raw HTML omitted -->(5dc4b)<!-- raw HTML omitted --></a></li> <li>Add focused trace view layout mode  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong>, <strong>OpenCode (gpt-5.6-sol)</strong> and <strong>Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11190">vitest-dev/vitest#11190</a> <a href="https://github.com/vitest-dev/vitest/commit/376dc3bc1"><!-- raw HTML omitted -->(376dc)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h3>   🐞 Bug Fixes</h3> <ul> <li>Exit 1 when vitest list fails collection  -  by <a href="https://github.com/hamed-bavar"><code>@​hamed-bavar</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11145">vitest-dev/vitest#11145</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/11146">vitest-dev/vitest#11146</a> <a href="https://github.com/vitest-dev/vitest/commit/6108b8197"><!-- raw HTML omitted -->(6108b)<!-- raw HTML omitted --></a></li> <li>Keep parse error details in static collection  -  by <a href="https://github.com/hamed-bavar"><code>@​hamed-bavar</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11150">vitest-dev/vitest#11150</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/11151">vitest-dev/vitest#11151</a> <a href="https://github.com/vitest-dev/vitest/commit/7c818153a"><!-- raw HTML omitted -->(7c818)<!-- raw HTML omitted --></a></li> <li>Avoid recursive prototype in automocking  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11195">vitest-dev/vitest#11195</a> <a href="https://github.com/vitest-dev/vitest/commit/99fc52591"><!-- raw HTML omitted -->(99fc5)<!-- raw HTML omitted --></a></li> <li>Prevent false Vitest import resolution  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11196">vitest-dev/vitest#11196</a> <a href="https://github.com/vitest-dev/vitest/commit/b426c1976"><!-- raw HTML omitted -->(b426c)<!-- raw HTML omitted --></a></li> <li>Keep metadata file when clearing the cache  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11199">vitest-dev/vitest#11199</a> <a href="https://github.com/vitest-dev/vitest/commit/73614654a"><!-- raw HTML omitted -->(73614)<!-- raw HTML omitted --></a></li> <li>Correct typos in error message and comments  -  by <a href="https://github.com/shinji00222"><code>@​shinji00222</code></a> and <strong>Shinji</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11187">vitest-dev/vitest#11187</a> <a href="https://github.com/vitest-dev/vitest/commit/115c3f6d2"><!-- raw HTML omitted -->(115c3)<!-- raw HTML omitted --></a></li> <li>Resolve ResolvedConfig exactOptionalPropertyTypes errors  -  by <a href="https://github.com/LukeAbby"><code>@​LukeAbby</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11175">vitest-dev/vitest#11175</a> <a href="https://github.com/vitest-dev/vitest/commit/498fbe922"><!-- raw HTML omitted -->(498fb)<!-- raw HTML omitted --></a></li> <li>Share the server on self-referencing <code>extends</code>  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11034">vitest-dev/vitest#11034</a> <a href="https://github.com/vitest-dev/vitest/commit/23dda738c"><!-- raw HTML omitted -->(23dda)<!-- raw HTML omitted --></a></li> <li>Warn when deprecated <code>deps.optimizer.web</code> is used  -  by <a href="https://github.com/im10furry"><code>@​im10furry</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11214">vitest-dev/vitest#11214</a> <a href="https://github.com/vitest-dev/vitest/commit/2ce29d5fa"><!-- raw HTML omitted -->(2ce29)<!-- raw HTML omitted --></a></li> <li><strong>browser</strong>: <ul> <li>Avoid double quotes in <code>config.define</code>  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11198">vitest-dev/vitest#11198</a> <a href="https://github.com/vitest-dev/vitest/commit/972e24bab"><!-- raw HTML omitted -->(972e2)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>doctor</strong>: <ul> <li>Measure vm pools for custom environments  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11212">vitest-dev/vitest#11212</a> <a href="https://github.com/vitest-dev/vitest/commit/91ab1588c"><!-- raw HTML omitted -->(91ab1)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>expect</strong>: <ul> <li>Correct return value in <code>toMatchAriaSnapshot</code>  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11208">vitest-dev/vitest#11208</a> <a href="https://github.com/vitest-dev/vitest/commit/c119be016"><!-- raw HTML omitted -->(c119b)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>fakeTimers</strong>: <ul> <li>Force <code>queueMicrotask</code> and <code>nextTick</code> in <code>toNotFake</code>  -  by <a href="https://github.com/kingmakeruix"><code>@​kingmakeruix</code></a>, <strong>kingmakeruix</strong>, <strong>Hiroshi Ogawa</strong>, <strong>Codex</strong> and <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11261">vitest-dev/vitest#11261</a> <a href="https://github.com/vitest-dev/vitest/commit/a47d7908f"><!-- raw HTML omitted -->(a47d7)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>snapshot</strong>: <ul> <li>Report obsolete keys next to skipped tests  -  by <a href="https://github.com/hamed-bavar"><code>@​hamed-bavar</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (gpt-5.6-sol)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11157">vitest-dev/vitest#11157</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/11158">vitest-dev/vitest#11158</a> <a href="https://github.com/vitest-dev/vitest/commit/17e2b22dd"><!-- raw HTML omitted -->(17e2b)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>types</strong>: <ul> <li>Make public declarations self-contained  -  by <a href="https://github.com/ZoeySigel"><code>@​ZoeySigel</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11141">vitest-dev/vitest#11141</a> <a href="https://github.com/vitest-dev/vitest/commit/455466c16"><!-- raw HTML omitted -->(45546)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>ui</strong>: <ul> <li>Fix collapse/expand suite with file name search  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11260">vitest-dev/vitest#11260</a> <a href="https://github.com/vitest-dev/vitest/commit/0a7122daa"><!-- raw HTML omitted -->(0a712)<!-- raw HTML omitted --></a></li> <li>Fix explorer file summary count  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong>, <strong>OpenCode (gpt-5.6-sol)</strong> and <strong>Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11125">vitest-dev/vitest#11125</a> <a href="https://github.com/vitest-dev/vitest/commit/05982297d"><!-- raw HTML omitted -->(05982)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>utils</strong>: <ul> <li>Fix <code>deepMerge</code> to handle prototype  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11215">vitest-dev/vitest#11215</a> <a href="https://github.com/vitest-dev/vitest/commit/4944cf498"><!-- raw HTML omitted -->(4944c)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <h5>    <a href="https://github.com/vitest-dev/vitest/compare/v5.0.0...v5.0.1">View changes on GitHub</a></h5> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/03630a5995d10455fa136be53bfb2b2409381106"><code>03630a5</code></a> chore: release v5.0.1 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11275">#11275</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/a47d7908f0635e9cba6cbe5e1a209bb6add5e0ab"><code>a47d790</code></a> fix(fakeTimers): force <code>queueMicrotask</code> and <code>nextTick</code> in <code>toNotFake</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11261">#11261</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/2ce29d5fa758046e5453bd92b8ed6c9da9709bb5"><code>2ce29d5</code></a> fix: warn when deprecated <code>deps.optimizer.web</code> is used (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11214">#11214</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/ccd6d057b6e4ca29a5e6b753a2b8e16b0afd8cda"><code>ccd6d05</code></a> docs: fix typecheck exclude default in documentation (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11223">#11223</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/91ab1588c72c9c5f7c638368a541cd20e0e8a934"><code>91ab158</code></a> fix(doctor): measure vm pools for custom environments (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11212">#11212</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/23dda738ccacb11682426426cd7b876afd107621"><code>23dda73</code></a> fix: share the server on self-referencing <code>extends</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11034">#11034</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/498fbe9222eb9aa3d8cf48481e200c16bb693bbd"><code>498fbe9</code></a> fix: resolve ResolvedConfig exactOptionalPropertyTypes errors (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11175">#11175</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/115c3f6d2bfa6a8672eeab8cc21bbecc6a4ef3d0"><code>115c3f6</code></a> fix: correct typos in error message and comments (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11187">#11187</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/73614654a46f617c357920eecda439654a561f92"><code>7361465</code></a> fix: keep metadata file when clearing the cache (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11199">#11199</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/972e24bab5fb96843de72447eb65585628b8dbde"><code>972e24b</code></a> fix(browser): avoid double quotes in <code>config.define</code> (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11198">#11198</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v5.0.1/packages/vitest">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz>	2026-09-25 19:12:12 -04:00
CaliBrain	dce91e6972	fix(audiobookbay): reuse the resolved magnet when retrying (#1388) (#1398) ... Retrying an AudiobookBay download re-scraped the detail page for the magnet link before checking the torrent client, so a torrent that had already finished in the client could not be imported while AudiobookBay was down. The handler now keeps the magnet it resolved in the task's retry context, which is persisted with the download history, and a retry hands that magnet straight to the client's existing-download check. The context is handler-owned, so a client-supplied download URL cannot seed it. Fixes #1388	2026-09-25 19:11:56 -04:00
dependabot[bot]	0f4342fede	build(deps): bump the gh-actions group with 4 updates (#1395) ... Bumps the gh-actions group with 4 updates: [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv), [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `astral-sh/setup-uv` from 10.1.0 to 10.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.2.0 🌈 Disable automatic cache saves for merge queues</h2> <h2>Changes</h2> <p>This release contains the known-checksum of the most recent uv releases and also disabled the uploading(saving) of the cache when in a merge queue since theses caches would almost never be used.</p> <h2>🚀 Enhancements</h2> <ul> <li>Disable automatic cache saves for merge queues <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1056">#1056</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.12.17 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1058">#1058</a>)</li> <li>chore: update known checksums for 0.12.16 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1057">#1057</a>)</li> <li>chore: update known checksums for 0.12.15 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1054">#1054</a>)</li> <li>chore: update known checksums for 0.12.14 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1053">#1053</a>)</li> <li>chore: update known checksums for 0.12.13 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1045">#1045</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.1.0 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1044">#1044</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore(deps): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1059">#1059</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/c18668ad3cf93ea998bef934396af7bb5c839dc7"><code>c18668a</code></a> chore(deps): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1059">#1059</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/ffe14763056ca34ecd158146a9fc7e144c8a2753"><code>ffe1476</code></a> chore: update known checksums for 0.12.17 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1058">#1058</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f5548c55522a1db0af3c84f2af3d058bc9bc2de2"><code>f5548c5</code></a> chore: update known checksums for 0.12.16 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1057">#1057</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/a761a4e9afd7b2f353ae020bd6d3a3af34c6c4d5"><code>a761a4e</code></a> Disable automatic cache saves for merge queues (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1056">#1056</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/3377a30666f438759955882b3eba6a92b2b29b12"><code>3377a30</code></a> chore: update known checksums for 0.12.15 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1054">#1054</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/dfb5f386776afcea37f271f3b656318d9949b9f1"><code>dfb5f38</code></a> chore: update known checksums for 0.12.14 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1053">#1053</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/45c121f982720f3bdf236c2ac06f126ca211949c"><code>45c121f</code></a> chore: update known checksums for 0.12.13 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1045">#1045</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/8073452fd4b566e886f04f731bcdbd8332b0b779"><code>8073452</code></a> docs: update version references to v10.1.0 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1044">#1044</a>)</li> <li>See full diff in <a href="https://github.com/astral-sh/setup-uv/compare/bec219d24cd3e171d82865faccec33120bb574f4...c18668ad3cf93ea998bef934396af7bb5c839dc7">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.38.0 to 4.38.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.38.1</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/1c5b675653bb5c22dbe9b12b556ec555138e09fd"><code>1c5b675</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4152">#4152</a> from github/update-v4.38.1-a65b83a73</li> <li><a href="https://github.com/github/codeql-action/commit/a97cdcae05f95787760713131181ee6624037e17"><code>a97cdca</code></a> Add changelog entry for <a href="https://redirect.github.com/github/codeql-action/issues/4146">#4146</a></li> <li><a href="https://github.com/github/codeql-action/commit/cc6c6911c3eb4bc527e1382609bf400bb4c44611"><code>cc6c691</code></a> Update changelog for v4.38.1</li> <li><a href="https://github.com/github/codeql-action/commit/a65b83a73db5849f2c05f0112023a8a4e89a7258"><code>a65b83a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4146">#4146</a> from github/henrymercer/per-language-bundles-pr</li> <li><a href="https://github.com/github/codeql-action/commit/07fa87d33359d182be54e4da4bf41664595e3042"><code>07fa87d</code></a> Clarify the latest-nightly eligibility exception</li> <li><a href="https://github.com/github/codeql-action/commit/f18f3536f13ef44ab98c9ef15f8aa05c7f6ac4ae"><code>f18f353</code></a> Describe the bundle URL resolver</li> <li><a href="https://github.com/github/codeql-action/commit/ecec9b5a3756247bd2bfec7da1b6f7bb3eb92d46"><code>ecec9b5</code></a> Share per-language telemetry fields without renaming</li> <li><a href="https://github.com/github/codeql-action/commit/79fe3a1270f5a101a20367147a05eb6d8ed533af"><code>79fe3a1</code></a> Move download telemetry into the status-report directory</li> <li><a href="https://github.com/github/codeql-action/commit/ead1f7d93f7fea11d3cf483d696b783b3f686607"><code>ead1f7d</code></a> Rename the platform module</li> <li><a href="https://github.com/github/codeql-action/commit/549d498da392f61aadfc0416f08ed43ae7397a2f"><code>549d498</code></a> Simplify per-language platform eligibility checks</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...1c5b675653bb5c22dbe9b12b556ec555138e09fd">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.38.0 to 4.38.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.38.1</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/1c5b675653bb5c22dbe9b12b556ec555138e09fd"><code>1c5b675</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4152">#4152</a> from github/update-v4.38.1-a65b83a73</li> <li><a href="https://github.com/github/codeql-action/commit/a97cdcae05f95787760713131181ee6624037e17"><code>a97cdca</code></a> Add changelog entry for <a href="https://redirect.github.com/github/codeql-action/issues/4146">#4146</a></li> <li><a href="https://github.com/github/codeql-action/commit/cc6c6911c3eb4bc527e1382609bf400bb4c44611"><code>cc6c691</code></a> Update changelog for v4.38.1</li> <li><a href="https://github.com/github/codeql-action/commit/a65b83a73db5849f2c05f0112023a8a4e89a7258"><code>a65b83a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4146">#4146</a> from github/henrymercer/per-language-bundles-pr</li> <li><a href="https://github.com/github/codeql-action/commit/07fa87d33359d182be54e4da4bf41664595e3042"><code>07fa87d</code></a> Clarify the latest-nightly eligibility exception</li> <li><a href="https://github.com/github/codeql-action/commit/f18f3536f13ef44ab98c9ef15f8aa05c7f6ac4ae"><code>f18f353</code></a> Describe the bundle URL resolver</li> <li><a href="https://github.com/github/codeql-action/commit/ecec9b5a3756247bd2bfec7da1b6f7bb3eb92d46"><code>ecec9b5</code></a> Share per-language telemetry fields without renaming</li> <li><a href="https://github.com/github/codeql-action/commit/79fe3a1270f5a101a20367147a05eb6d8ed533af"><code>79fe3a1</code></a> Move download telemetry into the status-report directory</li> <li><a href="https://github.com/github/codeql-action/commit/ead1f7d93f7fea11d3cf483d696b783b3f686607"><code>ead1f7d</code></a> Rename the platform module</li> <li><a href="https://github.com/github/codeql-action/commit/549d498da392f61aadfc0416f08ed43ae7397a2f"><code>549d498</code></a> Simplify per-language platform eligibility checks</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...1c5b675653bb5c22dbe9b12b556ec555138e09fd">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.38.0 to 4.38.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.38.1</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.2 - 24 Sept 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li> </ul> <h2>4.38.1 - 18 Sept 2026</h2> <ul> <li>The CodeQL Action now has experimental support for CodeQL releases for which per-language bundles are available. Per-language bundles support analysis for a single language and are therefore smaller than the combined bundles that allow analysis for all supported languages. As a result, per-language bundles take up less space on disk and are faster to download. We expect to roll this change out to everyone in the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li> </ul> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/1c5b675653bb5c22dbe9b12b556ec555138e09fd"><code>1c5b675</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4152">#4152</a> from github/update-v4.38.1-a65b83a73</li> <li><a href="https://github.com/github/codeql-action/commit/a97cdcae05f95787760713131181ee6624037e17"><code>a97cdca</code></a> Add changelog entry for <a href="https://redirect.github.com/github/codeql-action/issues/4146">#4146</a></li> <li><a href="https://github.com/github/codeql-action/commit/cc6c6911c3eb4bc527e1382609bf400bb4c44611"><code>cc6c691</code></a> Update changelog for v4.38.1</li> <li><a href="https://github.com/github/codeql-action/commit/a65b83a73db5849f2c05f0112023a8a4e89a7258"><code>a65b83a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4146">#4146</a> from github/henrymercer/per-language-bundles-pr</li> <li><a href="https://github.com/github/codeql-action/commit/07fa87d33359d182be54e4da4bf41664595e3042"><code>07fa87d</code></a> Clarify the latest-nightly eligibility exception</li> <li><a href="https://github.com/github/codeql-action/commit/f18f3536f13ef44ab98c9ef15f8aa05c7f6ac4ae"><code>f18f353</code></a> Describe the bundle URL resolver</li> <li><a href="https://github.com/github/codeql-action/commit/ecec9b5a3756247bd2bfec7da1b6f7bb3eb92d46"><code>ecec9b5</code></a> Share per-language telemetry fields without renaming</li> <li><a href="https://github.com/github/codeql-action/commit/79fe3a1270f5a101a20367147a05eb6d8ed533af"><code>79fe3a1</code></a> Move download telemetry into the status-report directory</li> <li><a href="https://github.com/github/codeql-action/commit/ead1f7d93f7fea11d3cf483d696b783b3f686607"><code>ead1f7d</code></a> Rename the platform module</li> <li><a href="https://github.com/github/codeql-action/commit/549d498da392f61aadfc0416f08ed43ae7397a2f"><code>549d498</code></a> Simplify per-language platform eligibility checks</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/b96794f015dfd88f77b49b1c93e0fa7110f94c63...1c5b675653bb5c22dbe9b12b556ec555138e09fd">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-25 18:57:45 -04:00
CaliBrain	ece6b8f341	fix(auth): fail closed when auth prerequisites are missing (#1387) (#1397) ... Auth mode resolution fell back to "none" (anonymous full admin) whenever the configured method's prerequisites were missing: no local password admin for builtin/OIDC, no Calibre-Web database, a blank proxy header, an unrecognized AUTH_METHOD (including "OIDC" in uppercase), or any error while reading the config. Deleting or demoting the last local admin was allowed on purpose because of that fallback, which exposed OIDC instances publicly. - Only an explicit AUTH_METHOD=none disables authentication. A configured method stays active when its prerequisites are missing, so sign-in fails instead of opening up. - An unrecognized or unreadable AUTH_METHOD resolves to "unavailable", which still requires a session and accepts no login. Values are normalized, so AUTH_METHOD=OIDC works. - Restore the guard against deleting or demoting the last local password admin while builtin/OIDC is active (unless DISABLE_LOCAL_AUTH is set). - Require a local admin before enabling Local auth, as OIDC already did. - Log a recovery hint at startup when builtin/OIDC runs without a local admin, and document recovery via AUTH_METHOD=none. - Drop the "will fall back to No Authentication" UI toasts and hints. Fixes https://github.com/calibrain/shelfmark/issues/1387	2026-09-25 18:56:16 -04:00
CaliBrain	c7bfb20448	Default to english when no lang is slected (#1396) ... Fixes https://github.com/calibrain/shelfmark/issues/1384	2026-09-25 18:38:25 -04:00
splitsec2	37a77e9562	feat(library): mark search results already in a Calibre library (#1377) ... Per discussion #1372, where you said you were fine with this specific implementation: check whether metadata.db exists, read it if so, and show a check mark saying the book is already there. Searching for a book you already own gives no hint that you own it, so the easiest way to end up with a second copy is to not remember you have the first. This reads a Calibre `metadata.db`, read only, and marks matching results with an **In library** badge in the card, list and compact views and in the details dialog. Off by default. It sits in Settings, General beside the existing Library URL, with a test button that reports how many books it indexed. No HTTP call, no token, nothing written back. Matching runs most to least confident: a shared external id, then an ISBN compared in both ISBN-10 and ISBN-13 form, then fuzzy title tokens plus the author surname. The check fails open, so an unreadable database degrades the badge and never blocks a search, and entries are cached for ten minutes with an early refresh when the file changes, so a large library costs one read rather than one per search. `text_match.py` is new and shared by the index and the provider, so title, author and ISBN matching stays consistent in one place. ## On the provider interface `library_index` talks only to a `LibraryProvider` protocol and knows nothing about Calibre. That is deliberate but it is not speculative generality, it is what let me send you the Calibre half on its own: I run an Audiobookshelf provider on the same interface in my fork, which is where the audiobook side of the badge comes from. I have left that out because it is a new service integration rather than something already in the codebase, which is the line your non-goals draw. Happy to send it separately if you ever want it, and equally happy for the answer to be no. Adding a library is a module with the `LibraryProvider` shape plus one line in `all_providers()`. ## Verification - `tests/core/test_library_index.py`: id, ISBN and fuzzy matching, per-content-type provider selection, fail-open on provider errors, stale-cache reuse, TTL and fingerprint refresh, per-provider cache isolation, and the test-connection path including unsaved form values. - `tests/core/test_text_match.py`: ISBN variants and token matching. - `src/frontend/src/tests/libraryBadge.test.ts` and the added cases in `bookTransformers.test.ts`. - Python suite (3269) and frontend suite (206) green, plus ruff, ruff format, basedpyright, vulture, tsc, oxlint, oxfmt and the production build.	2026-09-25 18:18:10 -04:00
splitsec2	fe99d4bb5b	feat(search): add a configurable default content type (#1371) ... Closes #1018. Worth correcting the issue first: the search tab is not hardcoded. `useContentTypePreferences` has persisted the user's choice to localStorage since #564, so a browser that has picked a tab already keeps it. What is missing is the other half the issue asks for, a default for a browser that has stored nothing, and a per-user override. `DEFAULT_CONTENT_TYPE` is a user overridable select next to `BOOK_LANGUAGE`, so it follows the same path: global value in Settings, per-user value in Search Preferences, resolved with `user_id` in `/api/config`. The frontend uses it only when this browser has no stored choice, which is captured before the existing effect writes one, so nothing changes for anyone who has already picked a tab. The resolution is a pure function in `utils/contentTypePreference.ts` rather than logic inside the hook, since vitest here has no jsdom and the existing tests cover resolvers like `resolveDefaultLanguageCodes` the same way. One small move in `App.tsx`: the `config` state was declared below the hook that now reads it, so it moved above it. ## Verification - `tests/core/test_config_api.py`: the payload carries `default_content_type` and reads it with the user's id. - `tests/core/test_admin_users_api.py`: the key appears in the per-user search preferences list. - `src/frontend/src/tests/contentTypePreference.test.ts`: a stored tab wins, combined mode survives, the server default applies when nothing is stored, and an unrecognised value falls back to ebook. - Python suite (3163) and frontend suite (201) green, plus ruff, ruff format, basedpyright, vulture, tsc, oxlint, oxfmt and the production build.	2026-09-25 18:14:42 -04:00
splitsec2	ce1092db7f	test(auth): stop proxy provisioning tests depending on run order (#1381) ... I hit this while building the Debrid-Link client in #1380. The new tests there changed the test count, that reshuffled the xdist workers, and these two went red. They were related to this branch, but were tests related to another PR I did which didn't have proper tests.. `test_sets_session_from_header` and `test_reads_remote_user_wsgi_fallback` both assert that a proxy-authenticated user comes back with `is_admin is True`. Since #1356 that only holds for the bootstrap account, because `_proxy_default_is_admin` returns True only while `has_admin()` is False. Both tests assume they're provisioning the first account, and only one of them can be. Run with `-n 0` so nothing is sharded: | | | |---|---| | either test alone | passes | | both, file order | the second fails | | both, reversed | the second fails | | both, across 2 workers | both pass | Reversing the order moving which one breaks is what makes it an ordering problem rather than a real one. It stays green on CI because the suite runs with `-n auto` and `tests/conftest.py` calls `mkdtemp` at module level, which runs once per worker process. Each worker gets its own `CONFIG_DIR` and its own `users.db`, the two tests land on different workers, and each one is genuinely first in its own database. That passed but it's luck rather than design, and any change to the test count can put them back together. So this gives every test in the file an empty user table and stops the question of who ran first from mattering. While I was fixed that I added coverage for the rule itself, which I had failed to test for: - the bootstrap account is an admin and the next one isn't - `PROXY_AUTH_DEFAULT_ROLE=admin` promotes later accounts - a user already in the database keeps its stored role instead of picking up the default Tests only, no source changes. The full suite passes serially now, where it had those two failures before, and it's still green under `-n auto`.	2026-09-25 18:07:46 -04:00
splitsec2	ca25448529	perf(docker): keep the heavy build layers cacheable across builds - save 11minutes per build (#1379) ... With the amount of changes and testing I've been doing lately I noticed how long the builds were taking and how much each one pulled, so I went and looked at the Dockerfile. I think this balances cache and efficiency. Three changes needed to be stacked to make it happen. **The version stamp sits above everything expensive.** `ARG BUILD_VERSION` and `ENV BUILD_VERSION` are at the top of the `base` stage and the value carries the commit sha, so it changes on every commit. This invalidates the layer and everything below it, which means the apt install, the dependency sync and the Chromium install. Nothing in the build reads either variable. They're only used at runtime by entrypoint.sh, tor.sh, wireguard.sh and genDebug.sh, so they can move to the end of the final stages. **`COPY . .` sits above the Chromium install.** It's in `base`, and the `shelfmark` stage installs Chromium and the seleniumbase drivers after it, so any source change rebuilds those too. Moving the source copy and the runtime-paths block to the end of each final stage solves that. **There's no cross-run cache.** Runners are ephemeral, so without `cache-from` and `cache-to` every layer is rebuilt on every run whatever the ordering, and a rebuilt layer gets a new digest even when the content is identical. That's why reordering on its own doesn't change the load. Measured with a source-only change between two builds: | | Build | Pull | |---|---|---| | before | 13m 20s | 526.5 MB | | after | 2m 25s | 3.7 MB | 15 of 18 layers get reused where it was 5. The cache sits at 0.86 GB, which leaves room under the 10 GB repo budget for the uv caches in ci.yml and e2e-platform.yml. I tried `mode=max` first and it built a bit quicker at 1m 43s, but it used 5.15 GB of cache and the potential to impact other workflows so it didn't seem worth 40 seconds, but that is a single line fix if you want to. This means the runtime-paths block is now duplicated, once per final stage, and that's most of the diff. It has to sit below each stage's heavy layers to do its job and I couldn't find a way around that short of another shared stage, which looked like more complexity for complexity's sake. Happy to take another run at it if you'd rather have it 'DRY'. I checked the built image against the current one. Same size, it boots, /api/health returns 200, and BUILD_VERSION and RELEASE_VERSION are still stamped correctly. Also, I'll slow down on the PRs. Promise.	2026-09-25 18:07:05 -04:00
splitsec2	b690832659	fix(download): stream a completed book instead of buffering it in RAM - lowering memory needs significantly (#1378) ... Credit where it is due: this defect was found and measured by **@DrNgo** in [DrNgo/shelfmark-fork@ae2185c](https://github.com/DrNgo/shelfmark-fork/commit/ae2185c8a83d537e55f1dc03f745ab844b5cdcdb). He recorded a 493 MB audiobook peaking near 963 MB and OOM-killing a 1 GiB container, with the proxy access log showing a single `GET /api/localdownload` returning 502 at the exact second of the kill. The analysis is his; I am sending it because it is still open here. Serving a completed book from the live queue calls `get_book_data`, which reads the whole file into bytes so the route can wrap it in a `BytesIO` for `send_file`. That is two copies of the book, with one resident for the length of the client transfer, to hand over a file that is already sitting on disk. `get_book_path` returns the path the task already holds and `send_file` streams it. The history fallback a few lines up in the same route has always worked this way, so this makes the two paths consistent rather than introducing anything new. `get_book_data` stays for callers that genuinely want the bytes, now documented as the expensive option. ## The fetch side has the same problem, and this PR does not fix it I should note: `download_url` in `shelfmark/download/http.py` still builds the inbound file in a `BytesIO` and returns it, so a large download is fully resident while it fetches. @DrNgo's commit fixes that too, with a `tempfile.SpooledTemporaryFile(max_size=...)` so small payloads stay in memory exactly as they do now and large ones spill to disk. I left it out deliberately. It changes the return type of `download_url` from `BytesIO` to a file object, which touches several callers, and it lands in a file that has been reworked around bypass handling, waiting rooms and resume since his branch point. That deserves its own PR rather than riding along with a two-function change. I may send it later; if @DrNgo sends it first, his should win, and if you would rather have both together say so and I will hold this one. ## Verification - `tests/download/test_orchestrator_retry.py`: `get_book_path` returns the path without opening the file (the test fails the run if it does), and reports a missing file rather than handing back a dead path. - The existing `/api/localdownload` tests still pass unchanged, including the history fallback and the ownership checks. - Full suite (3222), ruff, ruff format, basedpyright, vulture green.	2026-09-25 18:06:15 -04:00
CaliBrain	2c6d6a02cd	ci: debounce dev image builds instead of building nightly (#1376) ... Replace the nightly cron and its check-changes job with a debounce. Every push to main starts dev-image-debounce.yml, which waits out the 60-minute wait timer on the dev-image-debounce environment, then dispatches the Docker workflow only if main still points at its commit. A burst of merges now publishes one dev image, an hour after the last merge. The Docker workflow keeps only its tag and workflow_dispatch triggers, so its history holds real builds only. The debounce workflow deletes its own finished runs, so no-op runs don't pile up either. Requires the dev-image-debounce environment with a 60-minute wait timer (Settings → Environments).	2026-09-21 02:38:06 -04:00
dependabot[bot]	4a0675e0d3	build(deps): bump the python-deps group with 4 updates (#1375) ... Bumps the python-deps group with 4 updates: [gevent](https://github.com/gevent/gevent), [emoji](https://github.com/carpedm20/emoji), [seleniumbase](https://github.com/seleniumbase/SeleniumBase) and [ruff](https://github.com/astral-sh/ruff). Updates `gevent` from 26.8.0 to 26.9.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gevent/gevent/commit/003c77a6f3da41c014dd415022fb61f9d91fc95d"><code>003c77a</code></a> Preparing release 26.9.0</li> <li><a href="https://github.com/gevent/gevent/commit/725ecc3e53dd74f3828f1cf189e1cbeaebbdfae9"><code>725ecc3</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2209">#2209</a> from bojanz/issue2207-resolve-result-on-setup-failure</li> <li><a href="https://github.com/gevent/gevent/commit/a5b68e812e8ddf65d13dfa117d8656fcb713d69b"><code>a5b68e8</code></a> Adjust the ThreadPool after an unexpected worker exit</li> <li><a href="https://github.com/gevent/gevent/commit/67a725659bd622ac476bd39019209e11a1f18f2b"><code>67a7256</code></a> Resolve the ThreadResult when worker task setup fails</li> <li><a href="https://github.com/gevent/gevent/commit/a3b307bb82cd9b875933a964e883015bf0ce18b2"><code>a3b307b</code></a> Add change note for <a href="https://redirect.github.com/gevent/gevent/issues/2211">#2211</a> / <a href="https://redirect.github.com/gevent/gevent/issues/2039">#2039</a> [skip ci]</li> <li><a href="https://github.com/gevent/gevent/commit/b0ec8d3b4cb7cde5799dc57d35f74267e3b8259a"><code>b0ec8d3</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2211">#2211</a> from afonsojanu/fix/subprocess-stdin-mode-missing-bi...</li> <li><a href="https://github.com/gevent/gevent/commit/29b00308c74a703e26178229f6edacf98a31a1cb"><code>29b0030</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2210">#2210</a> from Shivakarthikeya23/issue-1946</li> <li><a href="https://github.com/gevent/gevent/commit/47ea41c7e2bc8ca50785a60e929e7335c75fc308"><code>47ea41c</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2208">#2208</a> from bojanz/issue2206-skip-missing-hooks</li> <li><a href="https://github.com/gevent/gevent/commit/0ee0c838cf50255c40647109de5391f84630af6a"><code>0ee0c83</code></a> Report the full binary mode string from FileObjectPosix</li> <li><a href="https://github.com/gevent/gevent/commit/3f3dc574d2b1e5381ea70bfea0da565fd4fcd6c8"><code>3f3dc57</code></a> Fix AsyncResult accumulating traceback frames on repeated get()</li> <li>Additional commits viewable in <a href="https://github.com/gevent/gevent/compare/26.8.0...26.9.0">compare view</a></li> </ul> </details> <br /> Updates `emoji` from 2.15.0 to 2.16.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/carpedm20/emoji/releases">emoji's releases</a>.</em></p> <blockquote> <h2>v2.16.0</h2> <ul> <li>Update to Unicode 18.0</li> <li>Update translations to CLDR release-49-alpha2</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/carpedm20/emoji/blob/master/CHANGES.md">emoji's changelog</a>.</em></p> <blockquote> <h2>v2.16.0 (2026-09-16)</h2> <ul> <li>Update to Unicode 18.0</li> <li>Update translations to CLDR release-49-alpha2</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/carpedm20/emoji/commit/d5d59d591f8590ada989f0bdf31603b3fe84e103"><code>d5d59d5</code></a> Merge pull request <a href="https://redirect.github.com/carpedm20/emoji/issues/335">#335</a> from carpedm20/update-unicode-18.0</li> <li><a href="https://github.com/carpedm20/emoji/commit/7acc7f0740b0ded33c7450d788c6641b74e84e16"><code>7acc7f0</code></a> update to Unicode 18.0.0</li> <li>See full diff in <a href="https://github.com/carpedm20/emoji/compare/v2.15.0...v2.16.0">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.54.5 to 4.54.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.54.9 - MCP Server: Patch 17</h2> <h2>MCP Server: Patch 17</h2> <ul> <li><a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4508/changes/e323a9d851b58a99b8b55b041218f415652a9fd6">Update the MCP server</a></li> <li><a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4508/commits/bc88accb2909629f7b0af68be73bebf014c17373">Refresh Python dependencies</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 17 by <a href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4508">seleniumbase/SeleniumBase#4508</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.8...v4.54.9">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.8...v4.54.9</a></p> <h2>4.54.8 - Fix command injection and more</h2> <h2>Fix command injection and more</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7c8744798ed97616fe246effe982b93b0cc1d15e">Fix command injection in console scripts</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7c9871c812bf410164b3a6ed14aec9b9cfe2abd3">Fix issue with clearing a field that has autocomplete</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/969a36c19fb3a05eec50821ad6be63805a68e21a">Fix typos in behave_sb.py</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/47034f13729e9f24564c18ba1952b1307798f080">Refactor console scripts</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f7da99c23471a0f0a1101b0afd9a0a82d38a99ba">Update the MCP server</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4bc64fb41dcd6ea6030887456fe97de72a3443a7">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/c1b492a650c8077ae6ef43915b3a455fab8f4e8d">Update examples</a></li> </ul> <h2>What's Changed</h2> <ul> <li>Fix command injection and more by <a href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4507">seleniumbase/SeleniumBase#4507</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.7...v4.54.8">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.7...v4.54.8</a></p> <h2>4.54.7 - MCP Server: Patch 16</h2> <h2>MCP Server: Patch 16</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/534c0c124002bfb48e10a7198194c91c61f4d4db">Update the MCP server</a> --&gt; annotations and docstrings</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4a5453ee14dff60599b058669eaff025488b75d2">Refresh Python dependencies</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 16 by <a href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4505">seleniumbase/SeleniumBase#4505</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.6...v4.54.7">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.6...v4.54.7</a></p> <h2>4.54.6 - MCP Server: Patch 15</h2> <h2>MCP Server: Patch 15</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/fbc665f3cb19ea6e5eb4ed6ffcf4eec32e4d9580">Add tool annotations to the MCP Server</a> --&gt; This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4503">seleniumbase/SeleniumBase#4503</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a406b7f277de3a56dc3d83d4b5466dbca34a35e4">Update the Dockerfile</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/8c9805f870bd1a2a0bb9b8ef79e710848a9e81f2">Update CDP Mode</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7f488faed38e8afce01d18b30291906e75dfe72d">Update uv</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b4910211a8e801eebab9f0b1a6679bf1077ac53f">Update CDP Mode examples</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 15 by <a href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4504">seleniumbase/SeleniumBase#4504</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ddd0f047e522c584221176bccf078784cac03b00"><code>ddd0f04</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4508">#4508</a> from seleniumbase/mcp-server-patch-17</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/918078082a49b2a57f3a33fc9a4149973f780e64"><code>9180780</code></a> Version 4.54.9</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/bc88accb2909629f7b0af68be73bebf014c17373"><code>bc88acc</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/d10f01b50168d62aea34bdc756ae249f75fdf642"><code>d10f01b</code></a> Update MCP versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/e323a9d851b58a99b8b55b041218f415652a9fd6"><code>e323a9d</code></a> Update the MCP server</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/52ceddcfbc466c937f88b322cfa69f11600b1e0a"><code>52ceddc</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4507">#4507</a> from seleniumbase/fix-command-injection-and-more</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/1b18c10456cc064ce38e7024913b285b3053197a"><code>1b18c10</code></a> Version 4.54.8</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/c1b492a650c8077ae6ef43915b3a455fab8f4e8d"><code>c1b492a</code></a> Update examples</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a64c668254f20c3384c9f0ec1635de7e9eba45ce"><code>a64c668</code></a> Update MCP versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4bc64fb41dcd6ea6030887456fe97de72a3443a7"><code>4bc64fb</code></a> Refresh Python dependencies</li> <li>Additional commits viewable in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.5...v4.54.9">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.7 to 0.16.8 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.8</h2> <h2>Release Notes</h2> <p>Released on 2026-09-16.</p> <h3>Bug fixes</h3> <ul> <li>Visit functional <code>TypedDict</code> keyword arguments correctly (<a href="https://redirect.github.com/astral-sh/ruff/pull/28584">#28584</a>)</li> <li>[<code>flake8-simplify</code>] Detect nested <code>async with</code> under sync parent (<code>SIM117</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27821">#27821</a>)</li> <li>[<code>flake8-simplify</code>] Preserve operand order in <code>SIM109</code> fix (<a href="https://redirect.github.com/astral-sh/ruff/pull/27824">#27824</a>)</li> <li>[<code>pyupgrade</code>] Preserve required parentheses in multiline <code>UP040</code> fixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28164">#28164</a>)</li> <li>[<code>pyupgrade</code>] Skip <code>TypeVarTuple</code> and <code>ParamSpec</code> conversions with bounds or constraints (<code>UP040</code>, <code>UP046</code>, <code>UP047</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28505">#28505</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Add support for <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28459">#28459</a>)</li> <li>Recognize PEP-728 <code>TypedDict</code> class keywords (<a href="https://redirect.github.com/astral-sh/ruff/pull/28533">#28533</a>)</li> <li>Recognize quoted types in <code>typing.TypeForm</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28507">#28507</a>)</li> <li>Support conditional assignment to <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28491">#28491</a>)</li> <li>[<code>flake8-type-checking</code>] Prefer lazy imports over <code>TYPE_CHECKING</code> on Python 3.15 and later (<code>TC001</code>, <code>TC002</code>, <code>TC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28541">#28541</a>)</li> <li>[<code>pyupgrade</code>] Make the fix for <code>UP040</code> always unsafe (<a href="https://redirect.github.com/astral-sh/ruff/pull/28526">#28526</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending deprecated <code>ByteString</code> aliases (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28498">#28498</a>)</li> <li>[<code>ruff</code>, <code>flake8-use-pathlib</code>] Recognize the <code>parent_mode</code> argument (<code>RUF064</code>, <code>PTH103</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28528">#28528</a>)</li> <li>[<code>ruff</code>] Detect <code>\Z</code> in <code>pytest.raises()</code> match patterns (<code>RUF043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28598">#28598</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Use rule name and code in formatter incompatibility warnings (<a href="https://redirect.github.com/astral-sh/ruff/pull/28571">#28571</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>[<code>flake8-tidy-imports</code>] Add <code>extend-banned-api</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28644">#28644</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/VedantMadane"><code>@​VedantMadane</code></a></li> <li><a href="https://github.com/alzeph"><code>@​alzeph</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li> <li><a href="https://github.com/fredrikblau"><code>@​fredrikblau</code></a></li> <li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li> <li><a href="https://github.com/zsol"><code>@​zsol</code></a></li> <li><a href="https://github.com/Aniket-a14"><code>@​Aniket-a14</code></a></li> <li><a href="https://github.com/r-b-1"><code>@​r-b-1</code></a></li> </ul> <h2>Install ruff 0.16.8</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.8/ruff-installer.sh | sh &lt;/tr&gt;&lt;/table&gt; </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.8</h2> <p>Released on 2026-09-16.</p> <h3>Bug fixes</h3> <ul> <li>Visit functional <code>TypedDict</code> keyword arguments correctly (<a href="https://redirect.github.com/astral-sh/ruff/pull/28584">#28584</a>)</li> <li>[<code>flake8-simplify</code>] Detect nested <code>async with</code> under sync parent (<code>SIM117</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27821">#27821</a>)</li> <li>[<code>flake8-simplify</code>] Preserve operand order in <code>SIM109</code> fix (<a href="https://redirect.github.com/astral-sh/ruff/pull/27824">#27824</a>)</li> <li>[<code>pyupgrade</code>] Preserve required parentheses in multiline <code>UP040</code> fixes (<a href="https://redirect.github.com/astral-sh/ruff/pull/28164">#28164</a>)</li> <li>[<code>pyupgrade</code>] Skip <code>TypeVarTuple</code> and <code>ParamSpec</code> conversions with bounds or constraints (<code>UP040</code>, <code>UP046</code>, <code>UP047</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28505">#28505</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Add support for <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28459">#28459</a>)</li> <li>Recognize PEP-728 <code>TypedDict</code> class keywords (<a href="https://redirect.github.com/astral-sh/ruff/pull/28533">#28533</a>)</li> <li>Recognize quoted types in <code>typing.TypeForm</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28507">#28507</a>)</li> <li>Support conditional assignment to <code>__lazy_modules__</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28491">#28491</a>)</li> <li>[<code>flake8-type-checking</code>] Prefer lazy imports over <code>TYPE_CHECKING</code> on Python 3.15 and later (<code>TC001</code>, <code>TC002</code>, <code>TC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28541">#28541</a>)</li> <li>[<code>pyupgrade</code>] Make the fix for <code>UP040</code> always unsafe (<a href="https://redirect.github.com/astral-sh/ruff/pull/28526">#28526</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending deprecated <code>ByteString</code> aliases (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28498">#28498</a>)</li> <li>[<code>ruff</code>, <code>flake8-use-pathlib</code>] Recognize the <code>parent_mode</code> argument (<code>RUF064</code>, <code>PTH103</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28528">#28528</a>)</li> <li>[<code>ruff</code>] Detect <code>\Z</code> in <code>pytest.raises()</code> match patterns (<code>RUF043</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28598">#28598</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Use rule name and code in formatter incompatibility warnings (<a href="https://redirect.github.com/astral-sh/ruff/pull/28571">#28571</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>[<code>flake8-tidy-imports</code>] Add <code>extend-banned-api</code> (<a href="https://redirect.github.com/astral-sh/ruff/pull/28644">#28644</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/VedantMadane"><code>@​VedantMadane</code></a></li> <li><a href="https://github.com/alzeph"><code>@​alzeph</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li> <li><a href="https://github.com/fredrikblau"><code>@​fredrikblau</code></a></li> <li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li> <li><a href="https://github.com/zsol"><code>@​zsol</code></a></li> <li><a href="https://github.com/Aniket-a14"><code>@​Aniket-a14</code></a></li> <li><a href="https://github.com/r-b-1"><code>@​r-b-1</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/62914c4b9b79a9e5004374a9c482ad2ed69290e1"><code>62914c4</code></a> Bump version to 0.16.8 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28648">#28648</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/c47e0cdc665f56536ce7f7a8ac40fa0ff3f79482"><code>c47e0cd</code></a> [ty] Bound aliased intersection expansion during inference (<a href="https://redirect.github.com/astral-sh/ruff/issues/28546">#28546</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ff4747b509ab4fffbe5689fcae39caa7503d1dcf"><code>ff4747b</code></a> renovate: update uv hashes correctly with setup-uv (<a href="https://redirect.github.com/astral-sh/ruff/issues/28621">#28621</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/94efeaa28630d80b2a74adf3c3963de99ed4ee29"><code>94efeaa</code></a> [ty] Compact reachable binding and declaration histories (<a href="https://redirect.github.com/astral-sh/ruff/issues/28349">#28349</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/50020fb1e8aa83b0826fa6f5f33a1e93c10cc60e"><code>50020fb</code></a> [ty] Avoid storing constraint nodes twice (<a href="https://redirect.github.com/astral-sh/ruff/issues/28375">#28375</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/446bb68da50014bb75f5ce1504a80c5883e3b0b2"><code>446bb68</code></a> [ty] Compare bound-method receivers before signatures (<a href="https://redirect.github.com/astral-sh/ruff/issues/28384">#28384</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/304ab86be5de6507e276ab09f5b43f44aeb92469"><code>304ab86</code></a> [<code>flake8-type-checking</code>] Prefer lazy imports over <code>TYPE_CHECKING</code> on 3.15+ (`...</li> <li><a href="https://github.com/astral-sh/ruff/commit/d940b244f7512427b0d87c7953e88c60e69f9bdf"><code>d940b24</code></a> [ty] Watch script dependencies in CLI watch mode (<a href="https://redirect.github.com/astral-sh/ruff/issues/28125">#28125</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/fe9f065a504127b11da72c2ff6d7813ddf3ce8ac"><code>fe9f065</code></a> [flake8-tidy-imports] Add <code>extend-banned-api</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/28644">#28644</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/31131db44f057cce68fa6b95552b7db54167b0b3"><code>31131db</code></a> [ty] Support <code>type[A &amp; B]</code> (<a href="https://redirect.github.com/astral-sh/ruff/issues/27124">#27124</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.7...0.16.8">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-21 00:44:08 -04:00
CaliBrain	e1c3f057ab	fix: bypass recordings, welib wrong-md5 links, footer build sha (#1364) (#1373) ... Debug screen recordings never started. Every bypass logged "Capturearea 1540x1050 at position 0.0 outside the screen size 1440x1880".We ask ffmpeg for the fingerprint screen size plus margin, the size wealso pass SeleniumBase as xvfb_metrics. SeleniumBase builds thatdisplay with use_xauth=True, the image ships no xauth binary, so itfalls back to a fixed 1440x1880 Xvfb and the requested size neverexists. Drop -video_size so x11grab records the whole screen, whateversize it turned out to be. welib could hand back a link for a different book. Welib answers/md5/<md5> with a search for that md5; when it does not have the file,the resolver took the first "Download" on the results page (md5a2c1dc0c... resolved to auto_download/9c8cf85d...). On an /md5/<md5>page a GET/Download link is now only taken when its href names thatmd5; otherwise the source is reported as not having the file. Alsoremoves _get_download_urls_from_welib and _is_source_enabled: themd5-template branch in _get_urls_for_source always handles welib first,so that resolver could never run. The footer showed the build date instead of the commit. CI stampsBUILD_VERSION as <yyyy-mm-dd>-<sha> (pr-<sha> for PR images) and thefooter kept its first seven characters, so dev images read "Shelfmarkmain (2026-09)". Take the trailing commit sha instead: "main (1a5b37d)".The full BUILD_VERSION stays in the hover title	2026-09-21 00:15:41 -04:00
CaliBrain	d978896142	fix(auth): rename the API_KEY env var to SHELFMARK_API_KEY (#1374)	2026-09-21 00:10:10 -04:00
Gavin McFallandClaude Fable 5.1	3b280009ae	feat(auth): static API_KEY (env) accepted as Bearer or X-Api-Key, cookie or key (#1366) ... Supersedes #1353, per the discussion in #1352: one `API_KEY` environment variable; when set, a request carrying it is authenticated as the first admin, and cookie sessions keep working exactly as before (cookie **or** key). Nothing else changes. No table, no UI, no settings-tab switch, no per-user keys. ## What - `API_KEY` (env). Unset → the feature is off and none of the new code runs. - `Authorization: Bearer <key>` or `X-Api-Key: <key>` on any existing `/api/*` route authenticates that request as the first admin in `users.db` (`ORDER BY id`), or as a bare admin identity (`user_id="api"`, `is_admin=True`, no local user row) if the install has no admin yet. Per request only; nothing is persisted; the admin's role is read live, so deleting or demoting that user takes effect on the next request. - Both headers are checked and either may match. That is what makes the key usable behind a reverse proxy that injects its own `Authorization` header (oauth2-proxy, Authelia, forwardAuth): send the key in `X-Api-Key`. - A credential that is **not** the key is ignored and the request continues on the normal session path, so proxy-forwarded tokens are unaffected. Without a valid session such a request gets the usual `401 {"error": "Unauthorized"}`, identical to a request with no credential, so there is nothing to probe. ## How - `shelfmark/config/env.py`: `API_KEY = os.getenv("API_KEY", "").strip()`. - `shelfmark/core/api_key.py`: `extract_api_key_candidates()` (Bearer token if the scheme is Bearer, then `X-Api-Key`) and `matches_api_key()` using `hmac.compare_digest` on bytes. - `shelfmark/core/user_db.py`: `UserDB.get_first_admin()`. - `shelfmark/main.py`: `api_key_auth_middleware` (`before_request`, registered before `proxy_auth_middleware`, which early-returns for keyed requests). Only `/api/` paths; `/api/health` and `/api/auth/*` exempt; no-op when `API_KEY` is unset or the auth mode is `none`. On a match it mirrors the proxy-auth pattern: `session.clear()` then populate `user_id` / `is_admin` / `db_user_id` for this request, `permanent = False`, `modified = False`, `g.api_key_auth = True`. An `after_request` hook guarantees no `Set-Cookie` is written for a keyed request even if a handler dirties the session. - `docs/api-access.md` (new), the `API_KEY` entry in `docs/environment-variables.md`, and a README link. ## Security - Constant-time compare; the key is never logged or echoed. - Keyed requests never mint or refresh a session cookie and ignore any cookie sent with them (a non-admin cookie plus the key yields admin for that request; the browser's own session is left untouched and usable). - The mismatch path touches neither the session nor `g`, so a stray bearer on a browser request can neither log the user out nor change how their cookie is refreshed. - Store errors during the admin lookup fail closed (`500 {"error": "Authentication error"}`), never to anonymous. - Verified against Flask's `save_session` / `should_set_cookie` ordering, and under auth modes `none`, `builtin`, `proxy`. ## Tests `tests/core/test_api_key_env.py` (36): extraction and matching; first-admin lookup; middleware behaviour on a guarded route and an admin route, with and without a user_db, `X-Api-Key`, both-headers combinations, no `Set-Cookie` when a handler dirties the session, incoming non-admin cookie ignored, browser cookie still usable after a keyed request, security headers, store error → 500, mismatch → guard's 401 / cookie path / permanent cookie untouched, unset → off, exempt paths and path probes, `none` and `proxy` modes, deleted and demoted first admin, a keyed write passing the guard. Existing auth suites unchanged. All CI gates green on the fork: https://github.com/gavinmcfall/shelfmark/pull/2 (CI-only draft). Also exercised against a running instance: 47 scripted checks including 150 concurrent requests, proxy-mode switching through the key, an unset-key restart, and a log scan for the key. ## Naming `API_KEY` as discussed. If you'd rather namespace it (`SHELFMARK_API_KEY`) to avoid clashing with other tools' env vars in shared compose files, it is a one-line change; say the word. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-21 00:00:42 -04:00
splitsec2	1a5b37d9d3	fix(deluge): send seeding ratio limit under Deluge's own keys (#1367) ... Deluge's per-torrent options are `stop_at_ratio` (bool) and `stop_ratio` (float), and `torrentmanager` checks `options['stop_at_ratio'] and get_ratio() >= options['stop_ratio']`. We were putting the indexer's float into `stop_at_ratio`, which only switched stopping on and left the daemon's global ratio (default 2.0) as the one actually enforced. A `ratio_limit` of 0 turned stopping off entirely. `stop_at_ratio_enabled` is not a Deluge option at all. Deluge has no per-torrent seeding time limit, `seed_time_limit` is a global core preference, so the value is logged as unapplied instead of sent as a key the daemon drops. qBittorrent and Transmission already honour both indexer limits, so this removes a silent difference between clients. ## Verification - `tests/prowlarr/test_deluge_client.py`: the ratio arrives as `stop_ratio` with `stop_at_ratio` set, and no key Deluge does not define is sent. Both fail on current main and pass here. - Full suite (3165), ruff, ruff format, basedpyright, vulture green.	2026-09-20 23:06:14 -04:00
splitsec2	7c8e89c567	fix(googlebooks): page by the capped size, not the raw limit (#1370) ... The Google Books search builds `maxResults` as `min(limit, 40)` because the API caps a page at 40 volumes, but advances `startIndex` by the full `limit`. The pages then stop tiling. With `limit=50`, page 1 covers items 0 to 39 and page 2 starts at 50, so items 40 to 49 are never returned and every later page drops another 10. This computes the page size once and uses it for both `maxResults` and `startIndex`. The shipped frontend asks for 40 and is unaffected. `/api/metadata/search` clamps `limit` to 100, so an API caller passing 41 to 100 was hitting it. One thing I left alone. The provider uses the base `search_paginated` heuristic, `has_more = len(books) >= options.limit`, which still reports `has_more: false` for a limit above 40 since Google can never return that many. That was already the behaviour before this change, and fixing it means either touching the shared heuristic or adding a provider override, so I kept this patch to the stride. Happy to follow up if you want it. ## Verification - `tests/metadata/test_googlebooks_parse.py`: pages 1 and 2 at `limit=50` must tile exactly, plus a guard that `limit=25` still strides by 25. The first fails on current main and passes here. - Full suite (3165), ruff, ruff format, basedpyright, vulture green.	2026-09-20 23:05:48 -04:00
splitsec2	bc03ad062e	fix(http): keep the host of a protocol-relative download link (#1368) ... `get_absolute_url()` replaced both `netloc` and `scheme` whenever either one was missing. A protocol-relative href such as `//cdn.example.org/f.epub`, scraped from a page on `https://annas-archive.org/...`, parses with a netloc and an empty scheme, so it came back pointing at the page's own host. The download then 404s and the source is skipped. Each field now falls back to the base URL only when the parsed URL does not supply it. Plain relative paths resolve exactly as before, which the control test covers. This affects the Z-Library, welib and generic download link handling in `release_sources/direct_download/annas_archive.py`. ## Verification - New `tests/download/test_http_absolute_url.py`: a protocol-relative link keeps its own host, and a plain `/path` still resolves against the base. The first fails on current main and passes here. - Full suite (3165), ruff, ruff format, basedpyright, vulture green.	2026-09-20 23:04:22 -04:00
splitsec2	ab3aa9a8b0	fix(requests): reject non-object items in the batch endpoint (#1369) ... `POST /api/requests/batch` checks that `requests` is a non-empty list and then hands each element to the shared preparation helper, which calls `.get()` on it. A bare string, number or null in the list raises `AttributeError` and the caller gets a 500, while `POST /api/requests` answers 400 with a message for the same mistake. This validates the element type beside the existing list check. One bad item rejects the whole batch rather than being reported per item, which matches the endpoint's current contract: every other failure path already aborts the batch with a single error body, as `test_batch_create_requests_is_atomic` asserts. Responses for valid payloads are unchanged. ## Verification - `tests/core/test_request_routes_api.py`: a case per bad shape (int, str, null, list), plus a mixed valid and invalid batch that asserts nothing was created. All fail on current main with a 500 and pass here. - Full suite (3168), ruff, ruff format, basedpyright, vulture green.	2026-09-20 23:03:31 -04:00
Paul Rimmer	d4619be69a	Feature: Show the AA search result stats (#1362) ... When doing a direct search for a book, show the stats of the AA results. For example if we search for "The Great Gatsby", AA reports it has 240 hits and shows the first page of 50. Provide this stats info in the shelfmark webUI via ResultsSection.tsx and ReleaseModal.tsx. This table shows what should be displayed based on the total number of hits found: |Total |Display| |-------|-------| |1 |"Result 1 (1 Total)"| |6 |"Results 1-6 (6 Total)"| |144 |"Results 1-50 (144 Total)"| |500+ |"Results 1-50 (500+ Total)"| Currently, shelfmark also only shows us the first 50 search hits even if there were more available from AA. This could be added later if considered desirable. As usual, a picture is worth a 1000 words: <img width="1012" height="610" alt="direct-results-stat" src="https://github.com/user-attachments/assets/8c0c688f-444e-482a-a9a3-2dee5a5563b8" /> <img width="1013" height="741" alt="universal-results-info" src="https://github.com/user-attachments/assets/399bbb79-87f2-4432-a3d0-64937795f5f1" /> Coded with llama.cpp, opencode and 🤖	2026-09-20 13:03:32 -04:00
splitsec2	c1315a2b23	fix(download): check task ownership before serving queued files (#1357) ... `/api/localdownload` resolves the file through the live queue and returns it before checking who owns the task; the owner check only runs on the download-history fallback, once the task has aged out of the queue. Task ids are source ids, so two users who searched the same book can end up with the same id. This applies the same rule on the queue path, reusing the `_task_owned_by_actor` helper the cancel/retry/priority routes already use, so both paths answer a non-owner with the same 404. Admin behaviour is unchanged. The 404 matches what this endpoint's history path already returns for a non-owner rather than the 403 `download_not_owned` the cancel/retry/priority routes use, happy to switch it if you prefer consistency with the siblings instead. ## Verification - `tests/core/test_activity_routes_api.py`: the owner still receives their queued file; a different user receives 404. The new case fails on current main and passes here; the existing history-fallback test is unchanged. - Full suite (3148), ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:56:23 -04:00
splitsec2	7934924678	fix(queue): don't stamp CANCELLED over a finished download (#1361) ... `cancel_download` reads the task status under the queue lock, releases it, and only then writes CANCELLED through `update_status`. A download that finishes in that window has its COMPLETE overwritten. The queue and the UI show the task as cancelled while the file is already on disk, and the terminal hook fires for both statuses. The check and the write now happen in a single lock hold. Because the lock is non-reentrant and the terminal hook has to run after it is released (the stall canceller depends on that), the lock-held part of `update_status` moved into a small private helper that both paths share; `update_status` is a thin wrapper over it. A cancel arriving once the task is already terminal still returns `False`. ## Verification - `tests/core/test_queue.py::test_cancel_does_not_overwrite_a_download_that_finished_first`: a worker thread completes the download while the cancel is in flight, with the handover driven by events rather than sleeps. The task stays complete. Fails on main, passes here. - Full suite (3147), plus `tests/download/` and `tests/core/test_download_api_guardrails.py`, ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:54:05 -04:00
splitsec2	a6204a318e	fix(oidc): reject backslash paths in the return_to sanitizer (#1359) ... The OIDC `return_to` sanitizer rejects values starting with `//` and then relies on `urlsplit` to catch anything carrying a netloc. A value such as `/\host` has no netloc, so it is stored in the session and used as the post-login redirect target and browsers resolve the backslash as a path separator, which lands the user outside the app after a successful login. `_normalize_return_to` now also rejects values whose path contains a backslash. That matches the frontend sanitizer in `authRedirect.ts`, which parses with `URL` and already discards those forms, so the two ends agree again. The check covers the path only, so query and fragment backslashes still round-trip, and it also catches the script-root case where `/app/\host` strips to `/\host`. ## Verification - New cases in `tests/core/test_oidc_routes.py` cover the rejected forms, including under a script root, and confirm `/`, `/settings` and `/search?q=x#frag` are unaffected. They fail on current main and pass here. - Full suite (3155), ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:51:21 -04:00
splitsec2	545480c557	fix(download): default is_admin to False in the request policy guard (#1358) ... `_resolve_policy_mode_for_current_user` reads `session.get("is_admin", True)`, so a session carrying `user_id` but no `is_admin` key skips the request policy entirely, while every other admin check in the codebase defaults the key to `False`. This uses the same default here. Every authenticated login path (builtin, CWA, proxy, OIDC) writes `is_admin` into the session, and `AUTH_METHOD=none` is already short-circuited one line earlier, so sessions from those flows behave exactly as before. ## Verification - `tests/core/test_request_routes_api.py::TestDownloadPolicyGuards`: a session without `is_admin` now gets `policy_requires_request` and nothing is queued. Fails on current main, passes here. - Full suite (3147), ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:50:53 -04:00
splitsec2	127dd82615	fix(users): apply user updates only after the payload validates (#1360) ... `PUT /api/users/me` and `PUT /api/admin/users/<id>` write the new password hash, and then the profile fields, before the rest of the payload is checked. When the request is rejected further down as an invalid role, an admin-only setting, an invalid settings value, the route answers 400 with those writes already committed, so the caller sees an error while the password has in fact changed. Both routes now validate the whole payload before touching the database, and the password hash is folded into the same `update_user` call as the other fields so the field write is a single transaction. Error messages, status codes and the order they are reported in are unchanged. ## Verification - New tests in `tests/core/test_self_user_routes.py` and `tests/core/test_admin_users_api.py` assert that a rejected update leaves the password, profile fields and role as they were, plus a positive case that a valid payload still applies all three. They fail on current main and pass here. - Full suite (3150), ruff, ruff format, basedpyright, vulture green.	2026-09-20 12:50:14 -04:00
splitsec2	acd59f7cbb	feat(auth): provision proxy users as non-admin once an admin exists (#1356) ... With `AUTH_METHOD=proxy` and no admin group configured, every user the proxy authenticates for the first time is provisioned as an admin (`is_admin = True` unless the user already exists in `users.db`). The intent to never lock an instance out makes sense, but the effect is that anyone the SSO gate lets through becomes an administrator. On an instance shared with family or a small community that is a footgun; I hit it when the first invited reader landed as an admin. This keeps the guarantee and removes the footgun: the first account is still provisioned as an admin while the instance has no admin at all, and later first-time users follow a new `PROXY_AUTH_DEFAULT_ROLE` setting (Security tab / env), default `user`. Known users keep their stored role; the `PROXY_AUTH_ADMIN_GROUP_NAME` path is unchanged and still takes precedence. I couldn't find a way with Cloudflare access to pass this along. Changes: `UserDB.has_admin()`, `_proxy_default_is_admin()` in the proxy middleware, the new `SelectField` beside the other proxy settings, the regenerated `docs/environment-variables.md` entry and a row in `docs/reverse-proxy.md`. Compatibility: the default moves from "everyone admin" to "first admin, then users". Accounts already in `users.db` are unaffected; new SSO users on an existing instance become regular users unless `PROXY_AUTH_DEFAULT_ROLE=admin` is set. If you would rather ship this purely opt-in I can flip the default to `admin`. ## Verification - `tests/core/test_auth_api.py::TestProxyProvisioningRole`: first user admin / second user not; `PROXY_AUTH_DEFAULT_ROLE=admin` restores the old behaviour; an admin from another auth source counts as "an admin exists"; a known user keeps their role whatever the default. - Full suite (3094), ruff, ruff format, basedpyright, vulture green. - Running on my own instance since 2026-09-19.	2026-09-19 23:27:13 -04:00
dependabot[bot]	c42edac363	build(deps): bump the gh-actions group with 6 updates (#1350) ... Bumps the gh-actions group with 6 updates: | Package | From | To | | --- | --- | --- | | [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `4.3.0` | `4.4.0` | | [docker/build-push-action](https://github.com/docker/build-push-action) | `7.3.0` | `7.4.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `10.0.1` | `10.1.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.9` | `4.38.0` | | [github/codeql-action/autobuild](https://github.com/github/codeql-action) | `4.37.9` | `4.38.0` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.9` | `4.38.0` | Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/setup-buildx-action/releases">docker/setup-buildx-action's releases</a>.</em></p> <blockquote> <h2>v4.4.0</h2> <ul> <li>Use official Buildx releases for cloud driver by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/606">docker/setup-buildx-action#606</a></li> <li>Pull BuildKit image before builder creation by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/609">docker/setup-buildx-action#609</a></li> <li>Use shared error helpers for Buildx and Docker commands by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/620">docker/setup-buildx-action#620</a></li> <li>Bump <code>@​docker/actions-toolkit</code> from 0.95.0 to 0.100.0 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/610">docker/setup-buildx-action#610</a> <a href="https://redirect.github.com/docker/setup-buildx-action/pull/618">docker/setup-buildx-action#618</a> <a href="https://redirect.github.com/docker/setup-buildx-action/pull/619">docker/setup-buildx-action#619</a></li> <li>Bump <code>@​humanfs/node</code> from 0.16.7 to 0.16.8 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/614">docker/setup-buildx-action#614</a></li> <li>Bump js-yaml from 5.3.0 to 5.4.2 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/608">docker/setup-buildx-action#608</a> <a href="https://redirect.github.com/docker/setup-buildx-action/pull/617">docker/setup-buildx-action#617</a></li> <li>Bump postcss-selector-parser from 7.1.1 to 7.1.5 in <a href="https://redirect.github.com/docker/setup-buildx-action/pull/611">docker/setup-buildx-action#611</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/setup-buildx-action/compare/v4.3.0...v4.4.0">https://github.com/docker/setup-buildx-action/compare/v4.3.0...v4.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/setup-buildx-action/commit/594f3bf4285d9ea8dc53c9a0c9c4092420091003"><code>594f3bf</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/609">#609</a> from crazy-max/pull-buildkit-image-before-create</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/bd6e702fc33b636671900d5b5edfab64698c9c25"><code>bd6e702</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/6268c9da9abbd1309c8a16a75f92a878715c3032"><code>6268c9d</code></a> pull BuildKit image before builder creation</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/e8235251b82e23c90e6fad50016f0a78b7f28f11"><code>e823525</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/621">#621</a> from docker/dependabot/github_actions/codeql-actions-...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/533ed8ed095b0b133ef16fb495aad119524e220d"><code>533ed8e</code></a> build(deps): bump the codeql-actions group with 2 updates</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/bedaf135699075c88620cd30772b9b6eadc9ba99"><code>bedaf13</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/620">#620</a> from crazy-max/shared-error-helpers</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/d5079fba84d5edd23d25ba7f3045122175ca6ee2"><code>d5079fb</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/226a61612ab71c26bbd805f955834049a4a9772f"><code>226a616</code></a> use shared error helpers for Buildx and Docker commands</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/77ce7f4bab9bc462d825001cde7f82d409ee474c"><code>77ce7f4</code></a> Merge pull request <a href="https://redirect.github.com/docker/setup-buildx-action/issues/619">#619</a> from docker/dependabot/npm_and_yarn/docker/actions-to...</li> <li><a href="https://github.com/docker/setup-buildx-action/commit/0dc1dc94f0f7c064e93fda72884ca71e054c0354"><code>0dc1dc9</code></a> [dependabot skip] chore: update generated content</li> <li>Additional commits viewable in <a href="https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...594f3bf4285d9ea8dc53c9a0c9c4092420091003">compare view</a></li> </ul> </details> <br /> Updates `docker/build-push-action` from 7.3.0 to 7.4.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/build-push-action/releases">docker/build-push-action's releases</a>.</em></p> <blockquote> <h2>v7.4.0</h2> <ul> <li>Use the shared error helper for Buildx commands by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1620">docker/build-push-action#1620</a></li> <li>Prevent workflow command injection in metadata logs by <a href="https://github.com/crazy-max"><code>@​crazy-max</code></a> in <a href="https://redirect.github.com/docker/build-push-action/pull/1617">docker/build-push-action#1617</a></li> <li>Bump <code>@​docker/actions-toolkit</code> from 0.92.0 to 0.100.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1614">docker/build-push-action#1614</a> <a href="https://redirect.github.com/docker/build-push-action/pull/1618">docker/build-push-action#1618</a> <a href="https://redirect.github.com/docker/build-push-action/pull/1621">docker/build-push-action#1621</a></li> <li>Bump <code>@​humanfs/node</code> from 0.16.7 to 0.16.8 in <a href="https://redirect.github.com/docker/build-push-action/pull/1609">docker/build-push-action#1609</a></li> <li>Bump brace-expansion from 1.1.13 to 1.1.18 in <a href="https://redirect.github.com/docker/build-push-action/pull/1592">docker/build-push-action#1592</a></li> <li>Bump csv-parse from 7.0.0 to 7.0.2 in <a href="https://redirect.github.com/docker/build-push-action/pull/1613">docker/build-push-action#1613</a></li> <li>Bump js-yaml from 4.3.0 to 4.3.2 in <a href="https://redirect.github.com/docker/build-push-action/pull/1605">docker/build-push-action#1605</a> <a href="https://redirect.github.com/docker/build-push-action/pull/1615">docker/build-push-action#1615</a></li> <li>Bump nanoid from 3.3.16 to 3.3.18 in <a href="https://redirect.github.com/docker/build-push-action/pull/1611">docker/build-push-action#1611</a></li> <li>Bump postcss from 8.5.10 to 8.5.25 in <a href="https://redirect.github.com/docker/build-push-action/pull/1590">docker/build-push-action#1590</a></li> <li>Bump postcss-selector-parser from 7.1.1 to 7.1.5 in <a href="https://redirect.github.com/docker/build-push-action/pull/1606">docker/build-push-action#1606</a></li> <li>Bump sigstore from 4.1.0 to 4.1.1 in <a href="https://redirect.github.com/docker/build-push-action/pull/1577">docker/build-push-action#1577</a></li> <li>Bump undici from 6.27.0 to 6.28.0 in <a href="https://redirect.github.com/docker/build-push-action/pull/1594">docker/build-push-action#1594</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/build-push-action/compare/v7.3.0...v7.4.0">https://github.com/docker/build-push-action/compare/v7.3.0...v7.4.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/build-push-action/commit/c3c9e263c25d99ce0380d002d59b67737d91b0dc"><code>c3c9e26</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1621">#1621</a> from docker/dependabot/npm_and_yarn/docker/actions-t...</li> <li><a href="https://github.com/docker/build-push-action/commit/459b6741834dcd35f946352017e7675bd2089d42"><code>459b674</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/build-push-action/commit/4dedcb23c91d79c1629bf53ec2c3bcfffef5b34e"><code>4dedcb2</code></a> chore(deps): Bump <code>@​docker/actions-toolkit</code> from 0.99.0 to 0.100.0</li> <li><a href="https://github.com/docker/build-push-action/commit/379bf63a979bd70751945601fa04c50674509952"><code>379bf63</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1620">#1620</a> from crazy-max/buildx-error-message</li> <li><a href="https://github.com/docker/build-push-action/commit/9877975c9e0b0b661592ff61049069507f9bc2f6"><code>9877975</code></a> chore: update generated content</li> <li><a href="https://github.com/docker/build-push-action/commit/7ed0556ffafb8eb312463411ef0a84a1dfe24d94"><code>7ed0556</code></a> use the shared Buildx error summary helper</li> <li><a href="https://github.com/docker/build-push-action/commit/91670ba5a4df99a24efff8637a78c83fd1b0f6b1"><code>91670ba</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1618">#1618</a> from docker/dependabot/npm_and_yarn/docker/actions-t...</li> <li><a href="https://github.com/docker/build-push-action/commit/80dbc8614a5c0ce4356740f69179cf829ecdc79a"><code>80dbc86</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/build-push-action/commit/50cac3a3b6f55e6015d6483d1dd72a3ecb90d20d"><code>50cac3a</code></a> chore(deps): Bump <code>@​docker/actions-toolkit</code> from 0.98.0 to 0.99.0</li> <li><a href="https://github.com/docker/build-push-action/commit/03b4d6cac0163b44733e1fa60adfd6da560ee4d1"><code>03b4d6c</code></a> Merge pull request <a href="https://redirect.github.com/docker/build-push-action/issues/1617">#1617</a> from crazy-max/fix-metadata-workflow-commands</li> <li>Additional commits viewable in <a href="https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc">compare view</a></li> </ul> </details> <br /> Updates `astral-sh/setup-uv` from 10.0.1 to 10.1.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/setup-uv/releases">astral-sh/setup-uv's releases</a>.</em></p> <blockquote> <h2>v10.1.0 🌈 New output <code>python-runtime-id</code>and respect NO_PROXY</h2> <h2>Changes</h2> <p>This release adds more bheind the scene security improvements and also 2 small improvements.</p> <h3>NO_PROXY</h3> <p>This action now respects <code>no_proxy/NO_PROXY</code> environment variables which were previously ignored.</p> <h3>New output <code>python-runtime-id</code></h3> <p>The new output <code>python-runtime-id</code> can be used to know which python version exactly was installed if you use <code>activate-environment</code>. See <a href="https://redirect.github.com/pyca/cryptography/pull/15572#discussion_r3913508686">pyca/cryptography#15572</a> for details on why this can be useful.</p> <h2>🐛 Bug fixes</h2> <ul> <li>fix: respect no proxy directive <a href="https://github.com/mj0nez"><code>@​mj0nez</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1037">#1037</a>)</li> <li>Use JSON + a typed wrapper instead of TS codegen <a href="https://github.com/woodruffw"><code>@​woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1025">#1025</a>)</li> </ul> <h2>🚀 Enhancements</h2> <ul> <li>Expose a Python &quot;identity&quot; output <a href="https://github.com/woodruffw"><code>@​woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1036">#1036</a>)</li> <li>Verify downloads with astral-sh/versions checksums <a href="https://github.com/zaniebot"><code>@​zaniebot</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1033">#1033</a>)</li> </ul> <h2>🧰 Maintenance</h2> <ul> <li>chore: update known checksums for 0.12.12 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1041">#1041</a>)</li> <li>chore: update known checksums for 0.12.10/0.12.11 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1038">#1038</a>)</li> <li>chore: update known checksums for 0.12.9 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1035">#1035</a>)</li> <li>chore: update known checksums for 0.12.7/0.12.8 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1031">#1031</a>)</li> <li>chore: update known checksums for 0.12.6 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1030">#1030</a>)</li> <li>chore: update known checksums for 0.12.5 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1020">#1020</a>)</li> <li>Use self-repo syntax for all in-repo actions/reusable workflows <a href="https://github.com/woodruffw"><code>@​woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1024">#1024</a>)</li> <li>Pin one-shot tools <a href="https://github.com/woodruffw"><code>@​woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1022">#1022</a>)</li> <li>ci: remove obsolete direct push attempts <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1019">#1019</a>)</li> </ul> <h2>📚 Documentation</h2> <ul> <li>docs: update version references to v10.0.1 @<a href="https://github.com/apps/github-actions">github-actions[bot]</a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1018">#1018</a>)</li> </ul> <h2>⬆️ Dependency updates</h2> <ul> <li>chore(deps-dev): roll up Dependabot updates <a href="https://github.com/eifinger"><code>@​eifinger</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1043">#1043</a>)</li> <li>Harden npm install defaults <a href="https://github.com/zaniebot"><code>@​zaniebot</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1026">#1026</a>)</li> <li>Add dependency cooldowns <a href="https://github.com/woodruffw"><code>@​woodruffw</code></a> (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1021">#1021</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/setup-uv/commit/bec219d24cd3e171d82865faccec33120bb574f4"><code>bec219d</code></a> chore(deps-dev): roll up Dependabot updates (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1043">#1043</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/b90ec40d15bfa44c33c6700196eb6efcdddb4373"><code>b90ec40</code></a> fix: respect no proxy directive (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1037">#1037</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/421feb646df5262e7dd93bc54161edfa30372417"><code>421feb6</code></a> chore: update known checksums for 0.12.12 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1041">#1041</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/f634bf473ad85bf3e23a613f52c5fa9f363874fc"><code>f634bf4</code></a> Expose a Python &quot;identity&quot; output (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1036">#1036</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/a6772c8f0a09dc9e3582c70a994b0c55af921803"><code>a6772c8</code></a> chore: update known checksums for 0.12.10/0.12.11 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1038">#1038</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/e105c8fb1d7b13074b851babdaef4185243c6a07"><code>e105c8f</code></a> chore: update known checksums for 0.12.9 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1035">#1035</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/cd13f9217092d43a771cf9ba7b09bdd3da8d7c4d"><code>cd13f92</code></a> Verify downloads with astral-sh/versions checksums (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1033">#1033</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/3aef7b92c52cec135792ea1e95f4c77683d39e61"><code>3aef7b9</code></a> chore: update known checksums for 0.12.7/0.12.8 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1031">#1031</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/d08d816a1ea176d61a318eff45abd3dffef415b1"><code>d08d816</code></a> chore: update known checksums for 0.12.6 (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1030">#1030</a>)</li> <li><a href="https://github.com/astral-sh/setup-uv/commit/19b4d1e990bec64818914c40230bde93a0de300b"><code>19b4d1e</code></a> Harden npm install defaults (<a href="https://redirect.github.com/astral-sh/setup-uv/issues/1026">#1026</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/setup-uv/compare/20cfd1bf945f4377ade1205e4dbc17946fc9a30d...bec219d24cd3e171d82865faccec33120bb574f4">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.9 to 4.38.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.38.0</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/b96794f015dfd88f77b49b1c93e0fa7110f94c63"><code>b96794f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4131">#4131</a> from github/update-v4.38.0-7e08580a9</li> <li><a href="https://github.com/github/codeql-action/commit/02d5093871674ea20274117103ce3038c73c77ef"><code>02d5093</code></a> Update changelog for v4.38.0</li> <li><a href="https://github.com/github/codeql-action/commit/7e08580a93dc4e4b9dda167e364577035cf504c6"><code>7e08580</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4130">#4130</a> from github/henrymercer/workflow-runner-sizing</li> <li><a href="https://github.com/github/codeql-action/commit/bfcc52b4f5d98468a5993daa0bf0e4fb3f3ed698"><code>bfcc52b</code></a> Run slow macOS checks on larger runners</li> <li><a href="https://github.com/github/codeql-action/commit/8c251e757c0260283fc50214a06ac768b61d3af4"><code>8c251e7</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4129">#4129</a> from github/update-bundle/codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/0b7ca400df35985869d4b9146a067865d4115da1"><code>0b7ca40</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/40484b339517c6bcf00f81eebc95ca041ddca505"><code>40484b3</code></a> Update default bundle to codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/977e6ceaea7361825998245d787fa3b4d6b9e5df"><code>977e6ce</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4124">#4124</a> from github/henrymercer/toolcache-bundle-cleanup</li> <li><a href="https://github.com/github/codeql-action/commit/40a6b3824794ae1156e1a5320d32e364bf1dcebc"><code>40a6b38</code></a> Address toolcache cleanup review feedback</li> <li><a href="https://github.com/github/codeql-action/commit/deece8f852f048bc3f52fd42c9cc7a99b1ebb252"><code>deece8f</code></a> Apply suggestion from <a href="https://github.com/henrymercer"><code>@​henrymercer</code></a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.37.9 to 4.38.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.38.0</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/b96794f015dfd88f77b49b1c93e0fa7110f94c63"><code>b96794f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4131">#4131</a> from github/update-v4.38.0-7e08580a9</li> <li><a href="https://github.com/github/codeql-action/commit/02d5093871674ea20274117103ce3038c73c77ef"><code>02d5093</code></a> Update changelog for v4.38.0</li> <li><a href="https://github.com/github/codeql-action/commit/7e08580a93dc4e4b9dda167e364577035cf504c6"><code>7e08580</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4130">#4130</a> from github/henrymercer/workflow-runner-sizing</li> <li><a href="https://github.com/github/codeql-action/commit/bfcc52b4f5d98468a5993daa0bf0e4fb3f3ed698"><code>bfcc52b</code></a> Run slow macOS checks on larger runners</li> <li><a href="https://github.com/github/codeql-action/commit/8c251e757c0260283fc50214a06ac768b61d3af4"><code>8c251e7</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4129">#4129</a> from github/update-bundle/codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/0b7ca400df35985869d4b9146a067865d4115da1"><code>0b7ca40</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/40484b339517c6bcf00f81eebc95ca041ddca505"><code>40484b3</code></a> Update default bundle to codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/977e6ceaea7361825998245d787fa3b4d6b9e5df"><code>977e6ce</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4124">#4124</a> from github/henrymercer/toolcache-bundle-cleanup</li> <li><a href="https://github.com/github/codeql-action/commit/40a6b3824794ae1156e1a5320d32e364bf1dcebc"><code>40a6b38</code></a> Address toolcache cleanup review feedback</li> <li><a href="https://github.com/github/codeql-action/commit/deece8f852f048bc3f52fd42c9cc7a99b1ebb252"><code>deece8f</code></a> Apply suggestion from <a href="https://github.com/henrymercer"><code>@​henrymercer</code></a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.38.0</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.38.0 - 09 Sept 2026</h2> <ul> <li>On GitHub-hosted runners, the CodeQL Action now deletes unused CodeQL bundles from the toolcache before downloading a different bundle, which frees up disk space for the analysis. We expect to roll this change out to everyone in September. <a href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li> <li>The CodeQL Action now supports CodeQL releases that are compatible with Linux Arm64 and downloads the native <code>linux-arm64</code> CodeQL bundle when available. <a href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li> </ul> <h2>4.37.9 - 26 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li> </ul> <h2>4.37.8 - 21 Aug 2026</h2> <p>No user facing changes.</p> <h2>4.37.7 - 13 Aug 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li> </ul> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/b96794f015dfd88f77b49b1c93e0fa7110f94c63"><code>b96794f</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4131">#4131</a> from github/update-v4.38.0-7e08580a9</li> <li><a href="https://github.com/github/codeql-action/commit/02d5093871674ea20274117103ce3038c73c77ef"><code>02d5093</code></a> Update changelog for v4.38.0</li> <li><a href="https://github.com/github/codeql-action/commit/7e08580a93dc4e4b9dda167e364577035cf504c6"><code>7e08580</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4130">#4130</a> from github/henrymercer/workflow-runner-sizing</li> <li><a href="https://github.com/github/codeql-action/commit/bfcc52b4f5d98468a5993daa0bf0e4fb3f3ed698"><code>bfcc52b</code></a> Run slow macOS checks on larger runners</li> <li><a href="https://github.com/github/codeql-action/commit/8c251e757c0260283fc50214a06ac768b61d3af4"><code>8c251e7</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4129">#4129</a> from github/update-bundle/codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/0b7ca400df35985869d4b9146a067865d4115da1"><code>0b7ca40</code></a> Add changelog note</li> <li><a href="https://github.com/github/codeql-action/commit/40484b339517c6bcf00f81eebc95ca041ddca505"><code>40484b3</code></a> Update default bundle to codeql-bundle-v2.27.0</li> <li><a href="https://github.com/github/codeql-action/commit/977e6ceaea7361825998245d787fa3b4d6b9e5df"><code>977e6ce</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4124">#4124</a> from github/henrymercer/toolcache-bundle-cleanup</li> <li><a href="https://github.com/github/codeql-action/commit/40a6b3824794ae1156e1a5320d32e364bf1dcebc"><code>40a6b38</code></a> Address toolcache cleanup review feedback</li> <li><a href="https://github.com/github/codeql-action/commit/deece8f852f048bc3f52fd42c9cc7a99b1ebb252"><code>deece8f</code></a> Apply suggestion from <a href="https://github.com/henrymercer"><code>@​henrymercer</code></a></li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/cdf488f595d80d6e07e03d4674febd5ab45fa938...b96794f015dfd88f77b49b1c93e0fa7110f94c63">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-19 23:19:16 -04:00
dependabot[bot]	d09ec9de25	build(deps): bump the npm-deps group in /src/frontend with 9 updates (#1349) ... Bumps the npm-deps group in /src/frontend with 9 updates: | Package | From | To | | --- | --- | --- | | [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` | | [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.7` | `19.3.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.5.0` | `26.5.1` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.34.0` | `6.35.1` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.67.0` | `0.68.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.82.0` | `1.83.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.0` | Updates `react` from 19.2.8 to 19.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react's releases</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <p>Below is a list of all new features, APIs, and bug fixes.</p> <p>Read the <a href="https://react.dev/blog/2026/09/09/react-19-3">React 19.3 release post</a> for more information.</p> <h2>New React Features</h2> <ul> <li><code>&lt;ViewTransition /&gt;</code>: Adds <code>&lt;ViewTransition /&gt;</code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@​jackpope</code></a>, <a href="https://github.com/gaearon"><code>@​gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code>&lt;Fragment /&gt;</code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@​jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@​Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@​chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@​teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@​fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/facebook/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/facebook/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/facebook/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/facebook/react/pull/37063">#37063</a>)</li> </ul> <h2>New React DOM Features</h2> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code>&lt;Suspense&gt;</code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@​gnoff</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/facebook/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@​gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h2>Notable changes</h2> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@​rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> </ul> <h2>All Changes</h2> <h3>React</h3> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@​UditDewan</code></a> <a href="https://redirect.github.com/facebook/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code>&lt;Activity&gt;</code> trees (<a href="https://github.com/ronnakamoto"><code>@​ronnakamoto</code></a> <a href="https://redirect.github.com/facebook/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a> <a href="https://redirect.github.com/facebook/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code>&lt;Offscreen&gt;</code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@​rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/react/react/blob/main/CHANGELOG.md">react's changelog</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <h3>New React Features</h3> <ul> <li><code>&lt;ViewTransition /&gt;</code>: Adds <code>&lt;ViewTransition /&gt;</code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@​jackpope</code></a>, <a href="https://github.com/gaearon"><code>@​gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code>&lt;Fragment /&gt;</code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@​jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@​Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@​chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@​teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@​fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/facebook/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/facebook/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/facebook/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/facebook/react/pull/37063">#37063</a>)</li> </ul> <h3>New React DOM Features</h3> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code>&lt;Suspense&gt;</code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@​gnoff</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/facebook/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@​gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h3>Notable changes</h3> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@​rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> </ul> <h3>All Changes</h3> <h4>React</h4> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@​UditDewan</code></a> <a href="https://redirect.github.com/facebook/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code>&lt;Activity&gt;</code> trees (<a href="https://github.com/ronnakamoto"><code>@​ronnakamoto</code></a> <a href="https://redirect.github.com/facebook/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a> <a href="https://redirect.github.com/facebook/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code>&lt;Offscreen&gt;</code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@​rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Fix hang when updating a dehydrated boundary inside a hidden tree (<a href="https://github.com/gaearon"><code>@​gaearon</code></a> <a href="https://redirect.github.com/facebook/react/pull/37135">#37135</a>)</li> <li>Don't reacquire Host Singletons during dev effect validation (<a href="https://github.com/gnoff"><code>@​gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37113">#37113</a>)</li> <li>Only remove properties from Host Singletons on release (<a href="https://github.com/gnoff"><code>@​gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37112">#37112</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/react/react/commit/2dc7da790d6388b95b83198ca9b588b2ad5f5c0b"><code>2dc7da7</code></a> [test] Bump Jest to 30.4 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/37382">#37382</a>)</li> <li><a href="https://github.com/react/react/commit/4f9389423b7319e1f7acc3d158c84a8365462748"><code>4f93894</code></a> docs: remove stale parentType param from validateChildKeys JSDoc (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36928">#36928</a>)</li> <li><a href="https://github.com/react/react/commit/dbc37501ffeaf8fec45af5898caf1c3d64ad10bf"><code>dbc3750</code></a> Update required references to GitHub repo (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36752">#36752</a>)</li> <li><a href="https://github.com/react/react/commit/900ae094d85b11c67d53dd14af50a2bda5db4495"><code>900ae09</code></a> [flow] Bump flow to v0.317.0 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36701">#36701</a>)</li> <li><a href="https://github.com/react/react/commit/fbb137059e4aacfaab1d36516e9b55050b4a0454"><code>fbb1370</code></a> [flow] Bump flow to v0.307.1 (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36199">#36199</a>)</li> <li><a href="https://github.com/react/react/commit/56922cf751fab6c7ab4c12ddbbd15839959fa255"><code>56922cf</code></a> [react-native-renderer] Delete Paper (legacy) renderer (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36285">#36285</a>)</li> <li><a href="https://github.com/react/react/commit/74568e8627aa43469b74f2972f427a209639d0b6"><code>74568e8</code></a> [Flight] Transport <code>AggregateErrors.errors</code> (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/36156">#36156</a>)</li> <li><a href="https://github.com/react/react/commit/e66ef6480ecd19c6885f2c06dec34fec1fdc0a98"><code>e66ef64</code></a> [tests] remove withoutStack from assertConsole helpers (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35498">#35498</a>)</li> <li><a href="https://github.com/react/react/commit/db71391c5c70dc113560d1c23d0b6548604d827f"><code>db71391</code></a> [Fiber] Instrument the lazy initializer thenable in all cases (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35521">#35521</a>)</li> <li><a href="https://github.com/react/react/commit/3e1abcc8d7083a13adf4774feb0d67ecbe4a2bc4"><code>3e1abcc</code></a> [tests] Require exact error messages in assertConsole helpers (<a href="https://github.com/react/react/tree/HEAD/packages/react/issues/35497">#35497</a>)</li> <li>Additional commits viewable in <a href="https://github.com/react/react/commits/v19.3.0/packages/react">compare view</a></li> </ul> </details> <br /> Updates `@types/react` from 19.2.18 to 19.3.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare view</a></li> </ul> </details> <br /> Updates `react-dom` from 19.2.8 to 19.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/react/react/releases">react-dom's releases</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <p>Below is a list of all new features, APIs, and bug fixes.</p> <p>Read the <a href="https://react.dev/blog/2026/09/09/react-19-3">React 19.3 release post</a> for more information.</p> <h2>New React Features</h2> <ul> <li><code>&lt;ViewTransition /&gt;</code>: Adds <code>&lt;ViewTransition /&gt;</code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@​jackpope</code></a>, <a href="https://github.com/gaearon"><code>@​gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code>&lt;Fragment /&gt;</code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@​jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@​Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@​chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@​teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@​fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect.github.com/facebook/react/pull/34103">#34103</a>, <a href="https://redirect.github.com/facebook/react/pull/34544">#34544</a>, <a href="https://redirect.github.com/facebook/react/pull/34545">#34545</a>, <a href="https://redirect.github.com/facebook/react/pull/37062">#37062</a>, <a href="https://redirect.github.com/facebook/react/pull/37061">#37061</a>, <a href="https://redirect.github.com/facebook/react/pull/37060">#37060</a>, <a href="https://redirect.github.com/facebook/react/pull/36047">#36047</a>, <a href="https://redirect.github.com/facebook/react/pull/36010">#36010</a>, <a href="https://redirect.github.com/facebook/react/pull/35642">#35642</a>, <a href="https://redirect.github.com/facebook/react/pull/35641">#35641</a>, <a href="https://redirect.github.com/facebook/react/pull/35637">#35637</a>, <a href="https://redirect.github.com/facebook/react/pull/35630">#35630</a>, <a href="https://redirect.github.com/facebook/react/pull/34935">#34935</a>, <a href="https://redirect.github.com/facebook/react/pull/37457">#37457</a>, <a href="https://redirect.github.com/facebook/react/pull/37408">#37408</a>, <a href="https://redirect.github.com/facebook/react/pull/37326">#37326</a>, <a href="https://redirect.github.com/facebook/react/pull/37251">#37251</a>, <a href="https://redirect.github.com/facebook/react/pull/37171">#37171</a>, <a href="https://redirect.github.com/facebook/react/pull/37169">#37169</a>, <a href="https://redirect.github.com/facebook/react/pull/37168">#37168</a>, <a href="https://redirect.github.com/facebook/react/pull/37167">#37167</a>, <a href="https://redirect.github.com/facebook/react/pull/37166">#37166</a>, <a href="https://redirect.github.com/facebook/react/pull/37165">#37165</a>, <a href="https://redirect.github.com/facebook/react/pull/37164">#37164</a>, <a href="https://redirect.github.com/facebook/react/pull/37163">#37163</a>, <a href="https://redirect.github.com/facebook/react/pull/37162">#37162</a>, <a href="https://redirect.github.com/facebook/react/pull/37161">#37161</a>, <a href="https://redirect.github.com/facebook/react/pull/37160">#37160</a>, <a href="https://redirect.github.com/facebook/react/pull/37125">#37125</a>, <a href="https://redirect.github.com/facebook/react/pull/37063">#37063</a>)</li> </ul> <h2>New React DOM Features</h2> <ul> <li><code>browser()</code>: a new <code>react-dom</code> API that returns a usable which errors during server rendering and resolves in the browser. <code>use(browser())</code> inside a <code>&lt;Suspense&gt;</code> boundary marks a subtree as browser-only without reporting a recoverable error (<a href="https://github.com/gnoff"><code>@​gnoff</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37143">#37143</a>, <a href="https://redirect.github.com/facebook/react/pull/37241">#37241</a>) <ul> <li>Added an <code>onBrowserBailout</code> option to the <code>react-dom/server</code> APIs to observe when a subtree defers to the browser (<a href="https://github.com/gnoff"><code>@​gnoff</code></a> <a href="https://redirect.github.com/facebook/react/pull/37193">#37193</a>)</li> </ul> </li> </ul> <h2>Notable changes</h2> <ul> <li>Enable Trusted Types API integration (<a href="https://github.com/rickhanlonii"><code>@​rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35816">#35816</a>)</li> <li>Transitions now render independently instead of being entangled into a single render, so a slow transition no longer holds up unrelated ones (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> <li>Added a DEV-only warning when a component appears to have been unblocked by calling <code>use()</code> conditionally (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> </ul> <h2>All Changes</h2> <h3>React</h3> <ul> <li>Fast Refresh Fixes <ul> <li>Fix Fast Refresh to find and remount edits to components wrapped behind <code>lazy()</code> (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36965">#36965</a>)</li> <li>Fix Fast Refresh so edits to a <code>memo()</code> comparison function take effect (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36964">#36964</a>)</li> <li>Fix Fast Refresh crash when an edit changes the kind of a component's type (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36963">#36963</a>)</li> <li>Unify hot reload type resolution for Fast Refresh (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36962">#36962</a>)</li> <li>Fix Fast Refresh to remount correctly when an edit changes the component kind (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36950">#36950</a>)</li> <li>Double invoke effects in StrictMode after Fast Refresh (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35962">#35962</a>)</li> </ul> </li> <li>Performance Track Fixes <ul> <li>Prevent crash when accessing <code>$$typeof</code> in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35679">#35679</a>)</li> <li>Handle non-string function names in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35659">#35659</a>)</li> <li>Use minus (<code>-</code>) instead of en dash for removed props in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35649">#35649</a>)</li> <li>Handle arrays with bigints in deep objects in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/35648">#35648</a>)</li> <li>Don't enumerate typed array props in Performance Tracks in DEV (<a href="https://github.com/UditDewan"><code>@​UditDewan</code></a> <a href="https://redirect.github.com/facebook/react/pull/36913">#36913</a>)</li> <li>Bail out of diffing wide objects and arrays in Performance Tracks (<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a> <a href="https://redirect.github.com/facebook/react/pull/34742">#34742</a>)</li> <li>Clear potentially large performance measures in DEV (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34803">#34803</a>)</li> <li>Fix missing else branch for renders with no props change in Performance Tracks (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a> <a href="https://redirect.github.com/facebook/react/pull/34837">#34837</a>)</li> </ul> </li> <li>Activity Fixes <ul> <li>Fix <code>useSyncExternalStore</code> missing store mutations that happened while an Activity tree was hidden (<a href="https://github.com/sophiebits"><code>@​sophiebits</code></a> <a href="https://redirect.github.com/facebook/react/pull/36947">#36947</a>)</li> <li>Hide portal contents when an Activity is hidden (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35091">#35091</a>)</li> <li>Prevent metadata hoisting in hidden <code>&lt;Activity&gt;</code> trees (<a href="https://github.com/ronnakamoto"><code>@​ronnakamoto</code></a> <a href="https://redirect.github.com/facebook/react/pull/34983">#34983</a>)</li> <li>Prevent errors thrown inside a hidden Activity from escaping to the visible UI (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/35074">#35074</a>)</li> <li>Don't unhide a node if a direct parent Offscreen is still hidden (<a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a> <a href="https://redirect.github.com/facebook/react/pull/34821">#34821</a>)</li> <li>Don't show internal <code>&lt;Offscreen&gt;</code> component in error messages (<a href="https://github.com/rickhanlonii"><code>@​rickhanlonii</code></a> <a href="https://redirect.github.com/facebook/react/pull/35763">#35763</a>)</li> </ul> </li> <li>Warn in DEV when a component appears to have been unblocked by a conditional <code>use()</code> (<a href="https://github.com/hoxyq"><code>@​hoxyq</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/37104">#37104</a>, <a href="https://redirect.github.com/facebook/react/pull/37203">#37203</a>, <a href="https://redirect.github.com/facebook/react/pull/37491">#37491</a>)</li> <li>Render transitions independently instead of entangling them into a single render (<a href="https://github.com/acdlite"><code>@​acdlite</code></a> <a href="https://redirect.github.com/facebook/react/pull/37290">#37290</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/react/react/blob/main/CHANGELOG.md">react-dom's changelog</a>.</em></p> <blockquote> <h2>19.3.0 (September 9, 2026)</h2> <h3>New React Features</h3> <ul> <li><code>&lt;ViewTransition /&gt;</code>: Adds <code>&lt;ViewTransition /&gt;</code> and <code>addTransitionType</code> APIs to power View Transition animations in React (<a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a>, <a href="https://github.com/jackpope"><code>@​jackpope</code></a>, <a href="https://github.com/gaearon"><code>@​gaearon</code></a>: <a href="https://redirect.github.com/facebook/react/pull/31975">#31975</a>, <a href="https://redirect.github.com/facebook/react/pull/31987">#31987</a>, <a href="https://redirect.github.com/facebook/react/pull/31996">#31996</a>, <a href="https://redirect.github.com/facebook/react/pull/31999">#31999</a>, <a href="https://redirect.github.com/facebook/react/pull/32001">#32001</a>, <a href="https://redirect.github.com/facebook/react/pull/32002">#32002</a>, <a href="https://redirect.github.com/facebook/react/pull/32028">#32028</a>, <a href="https://redirect.github.com/facebook/react/pull/32029">#32029</a>, <a href="https://redirect.github.com/facebook/react/pull/32031">#32031</a>, <a href="https://redirect.github.com/facebook/react/pull/32034">#32034</a>, <a href="https://redirect.github.com/facebook/react/pull/32038">#32038</a>, <a href="https://redirect.github.com/facebook/react/pull/32041">#32041</a>, <a href="https://redirect.github.com/facebook/react/pull/32050">#32050</a>, <a href="https://redirect.github.com/facebook/react/pull/32090">#32090</a>, <a href="https://redirect.github.com/facebook/react/pull/32105">#32105</a>, <a href="https://redirect.github.com/facebook/react/pull/32254">#32254</a>, <a href="https://redirect.github.com/facebook/react/pull/32379">#32379</a>, <a href="https://redirect.github.com/facebook/react/pull/32422">#32422</a>, <a href="https://redirect.github.com/facebook/react/pull/32462">#32462</a>, <a href="https://redirect.github.com/facebook/react/pull/32540">#32540</a>, <a href="https://redirect.github.com/facebook/react/pull/32545">#32545</a>, <a href="https://redirect.github.com/facebook/react/pull/32585">#32585</a>, <a href="https://redirect.github.com/facebook/react/pull/32599">#32599</a>, <a href="https://redirect.github.com/facebook/react/pull/32611">#32611</a>, <a href="https://redirect.github.com/facebook/react/pull/32612">#32612</a>, <a href="https://redirect.github.com/facebook/react/pull/32617">#32617</a>, <a href="https://redirect.github.com/facebook/react/pull/32651">#32651</a>, <a href="https://redirect.github.com/facebook/react/pull/32653">#32653</a>, <a href="https://redirect.github.com/facebook/react/pull/32656">#32656</a>, <a href="https://redirect.github.com/facebook/react/pull/32664">#32664</a>, <a href="https://redirect.github.com/facebook/react/pull/32699">#32699</a>, <a href="https://redirect.github.com/facebook/react/pull/32723">#32723</a>, <a href="https://redirect.github.com/facebook/react/pull/32734">#32734</a>, <a href="https://redirect.github.com/facebook/react/pull/32751">#32751</a>, <a href="https://redirect.github.com/facebook/react/pull/32752">#32752</a>, <a href="https://redirect.github.com/facebook/react/pull/32760">#32760</a>, <a href="https://redirect.github.com/facebook/react/pull/32761">#32761</a>, <a href="https://redirect.github.com/facebook/react/pull/32764">#32764</a>, <a href="https://redirect.github.com/facebook/react/pull/32772">#32772</a>, <a href="https://redirect.github.com/facebook/react/pull/32790">#32790</a>, <a href="https://redirect.github.com/facebook/react/pull/32819">#32819</a>, <a href="https://redirect.github.com/facebook/react/pull/32820">#32820</a>, <a href="https://redirect.github.com/facebook/react/pull/32822">#32822</a>, <a href="https://redirect.github.com/facebook/react/pull/32833">#32833</a>, <a href="https://redirect.github.com/facebook/react/pull/32849">#32849</a>, <a href="https://redirect.github.com/facebook/react/pull/33094">#33094</a>, <a href="https://redirect.github.com/facebook/react/pull/33191">#33191</a>, <a href="https://redirect.github.com/facebook/react/pull/33200">#33200</a>, <a href="https://redirect.github.com/facebook/react/pull/33206">#33206</a>, <a href="https://redirect.github.com/facebook/react/pull/33293">#33293</a>, <a href="https://redirect.github.com/facebook/react/pull/33330">#33330</a>, <a href="https://redirect.github.com/facebook/react/pull/33331">#33331</a>, <a href="https://redirect.github.com/facebook/react/pull/33332">#33332</a>, <a href="https://redirect.github.com/facebook/react/pull/33357">#33357</a>, <a href="https://redirect.github.com/facebook/react/pull/33362">#33362</a>, <a href="https://redirect.github.com/facebook/react/pull/33433">#33433</a>, <a href="https://redirect.github.com/facebook/react/pull/33576">#33576</a>, <a href="https://redirect.github.com/facebook/react/pull/34374">#34374</a>, <a href="https://redirect.github.com/facebook/react/pull/34450">#34450</a>, <a href="https://redirect.github.com/facebook/react/pull/34481">#34481</a>, <a href="https://redirect.github.com/facebook/react/pull/34500">#34500</a>, <a href="https://redirect.github.com/facebook/react/pull/34502">#34502</a>, <a href="https://redirect.github.com/facebook/react/pull/34510">#34510</a>, <a href="https://redirect.github.com/facebook/react/pull/34511">#34511</a>, <a href="https://redirect.github.com/facebook/react/pull/34539">#34539</a>, <a href="https://redirect.github.com/facebook/react/pull/35567">#35567</a>, <a href="https://redirect.github.com/facebook/react/pull/35564">#35564</a>, <a href="https://redirect.github.com/facebook/react/pull/35485">#35485</a>, <a href="https://redirect.github.com/facebook/react/pull/35380">#35380</a>, <a href="https://redirect.github.com/facebook/react/pull/35063">#35063</a>, <a href="https://redirect.github.com/facebook/react/pull/35060">#35060</a>, <a href="https://redirect.github.com/facebook/react/pull/34676">#34676</a>, <a href="https://redirect.github.com/facebook/react/pull/36917">#36917</a>, <a href="https://redirect.github.com/facebook/react/pull/35337">#35337</a>, <a href="https://redirect.github.com/facebook/react/pull/35520">#35520</a>)</li> <li>Fragment Refs: Add Refs to <code>&lt;Fragment /&gt;</code> to support composable platform behavior (<a href="https://github.com/jackpope"><code>@​jackpope</code></a>, <a href="https://github.com/sebmarkbage"><code>@​sebmarkbage</code></a>, <a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>, <a href="https://github.com/Dhakshin2007"><code>@​Dhakshin2007</code></a>, <a href="https://github.com/chirokas"><code>@​chirokas</code></a>, <a href="https://github.com/teamleaderleo"><code>@​teamleaderleo</code></a>, <a href="https://github.com/fallintoplace"><code>@​fallintoplace</code></a>: <a href="https://redirect.github.com/facebook/react/pull/32465">#32465</a>, <a href="https://redirect.github.com/facebook/react/pull/32613">#32613</a>, <a href="https://redirect.github.com/facebook/react/pull/32619">#32619</a>, <a href="https://redirect.github.com/facebook/react/pull/32654">#32654</a>, <a href="https://redirect.github.com/facebook/react/pull/32660">#32660</a>, <a href="https://redirect.github.com/facebook/react/pull/32682">#32682</a>, <a href="https://redirect.github.com/facebook/react/pull/32722">#32722</a>, <a href="https://redirect.github.com/facebook/react/pull/32813">#32813</a>, <a href="https://redirect.github.com/facebook/react/pull/32814">#32814</a>, <a href="https://redirect.github.com/facebook/react/pull/33056">#33056</a>, <a href="https://redirect.github.com/facebook/react/pull/33058">#33058</a>, <a href="https://redirect.github.com/facebook/react/pull/33093">#33093</a>, <a href="https://redirect.github.com/facebook/react/pull/34069">#34069</a>, <a href="https://redirect... _Description has been truncated_ Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-19 23:19:07 -04:00
dependabot[bot]	83f86242b4	build(deps): bump the docker-base-image-digests group with 2 updates (#1348) ... > [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `50c8e8c` to `ebfe2f9` Updates `astral-sh/uv` from 0.12.13 to 0.12.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.16</h2> <h2>Release Notes</h2> <p>Released on 2026-09-17.</p> <h3>Python</h3> <ul> <li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify downloaded wheels and source distributions against hashes supplied by package indexes (<a href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li> <li>Allow <code>build-constraint-dependencies</code> entries to include hashes for verifying downloaded build dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li> <li>Honor Darwin <code>platform_release</code> markers in <code>required-environments</code> using macOS wheel deployment targets (<a href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li> <li>Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (<a href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Support <code>lock-without-metadata</code> across all dependency types while retaining <code>package.metadata</code> for remote URL dependencies to enable offline validation (<a href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li> <li>Honor configured and command-line index settings, including credentials, in <code>uv upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li> <li>Allow <code>uv check</code> to run in projects that are not managed by uv and outside workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li> <li>Respect <code>--python</code> and <code>UV_PYTHON</code> when selecting the Python version for <code>uv check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Redact Azure shared access signatures from displayed and logged URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li> <li>Check archive sizes from <code>pylock.toml</code> before reusing cached distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li> <li>Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (<a href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li> <li>Use the bundled <code>uv_build</code> backend only when its version matches active version pins (<a href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li> <li>Handle malformed index URLs without panicking when credentials are configured (<a href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li> <li>Report a configuration error instead of panicking for proxy URLs without a host (<a href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li> <li>Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (<a href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li> </ul> <h2>Install uv 0.12.16</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c &quot;irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 | iex&quot; </code></pre> <h2>Download uv 0.12.16</h2> <p>| File | Platform | Checksum |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.16</h2> <p>Released on 2026-09-17.</p> <h3>Python</h3> <ul> <li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify downloaded wheels and source distributions against hashes supplied by package indexes (<a href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li> <li>Allow <code>build-constraint-dependencies</code> entries to include hashes for verifying downloaded build dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li> <li>Honor Darwin <code>platform_release</code> markers in <code>required-environments</code> using macOS wheel deployment targets (<a href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li> <li>Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (<a href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Support <code>lock-without-metadata</code> across all dependency types while retaining <code>package.metadata</code> for remote URL dependencies to enable offline validation (<a href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li> <li>Honor configured and command-line index settings, including credentials, in <code>uv upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li> <li>Allow <code>uv check</code> to run in projects that are not managed by uv and outside workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li> <li>Respect <code>--python</code> and <code>UV_PYTHON</code> when selecting the Python version for <code>uv check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Redact Azure shared access signatures from displayed and logged URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li> <li>Check archive sizes from <code>pylock.toml</code> before reusing cached distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li> <li>Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (<a href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li> <li>Use the bundled <code>uv_build</code> backend only when its version matches active version pins (<a href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li> <li>Handle malformed index URLs without panicking when credentials are configured (<a href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li> <li>Report a configuration error instead of panicking for proxy URLs without a host (<a href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li> <li>Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (<a href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li> </ul> <h2>0.12.15</h2> <p>Released on 2026-09-15.</p> <h3>Performance</h3> <ul> <li>Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (<a href="https://redirect.github.com/astral-sh/uv/pull/21675">#21675</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix regressions in <code>0.12.14</code> when installing to symlinked destinations or using <code>uv pip install --target .</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21699">#21699</a>)</li> </ul> <h2>0.12.14</h2> <p>Released on 2026-09-15.</p> <h3>Enhancements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/761ff1379b3b79f61fc8d421dfe4fe064834e084"><code>761ff13</code></a> Bump version to 0.12.16 (<a href="https://redirect.github.com/astral-sh/uv/issues/21809">#21809</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a2f820ad0cebb7118f7686be3619d48df5121f6e"><code>a2f820a</code></a> Assign release pull requests to the workflow initiator (<a href="https://redirect.github.com/astral-sh/uv/issues/21808">#21808</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6dffe7e03898409c04e2f46436bffa60abbae465"><code>6dffe7e</code></a> Ignore <code>UV_NATIVE_TLS</code> when <code>UV_SYSTEM_CERTS</code> is set (<a href="https://redirect.github.com/astral-sh/uv/issues/21805">#21805</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/7bc36767ae3ea0d45e3cc6f219765fdec2992a33"><code>7bc3676</code></a> Avoid warning when both <code>native-tls</code> and <code>system-certs</code> are configured (<a href="https://redirect.github.com/astral-sh/uv/issues/21806">#21806</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/07b838a33179967b87d513825b02504a75b21b3a"><code>07b838a</code></a> Avoid warning when both <code>UV_NATIVE_TLS</code> and <code>UV_SYSTEM_CERTS</code> are set (<a href="https://redirect.github.com/astral-sh/uv/issues/21788">#21788</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/5d64ede21e9e835e59ecd85329ebefd43faa8211"><code>5d64ede</code></a> Remove Hash API (<a href="https://redirect.github.com/astral-sh/uv/issues/21786">#21786</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9ddc4308551335e9c2ab6571ea0cf529eccf3e76"><code>9ddc430</code></a> Move shared thread initialization into uv-threads (<a href="https://redirect.github.com/astral-sh/uv/issues/21746">#21746</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/ef1e0689b4612796d7781ebeae7866028c6c9e82"><code>ef1e068</code></a> Make Git stamping opt-in for development builds (<a href="https://redirect.github.com/astral-sh/uv/issues/21750">#21750</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6ce09770cec30b30cdc66c3595517dce2b112562"><code>6ce0977</code></a> Avoid panics for non-base index URLs (<a href="https://redirect.github.com/astral-sh/uv/issues/21784">#21784</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/47f19ec154f325ade7d6045c4e785531c24635f7"><code>47f19ec</code></a> Return an error for failed VerbatimUrl path conversions (<a href="https://redirect.github.com/astral-sh/uv/issues/21783">#21783</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.13...0.12.16">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-19 23:18:59 -04:00
splitsec2andInfiniteAvenger	44f4e13cce	refactor: extract the per-source release search out of /api/releases (#1355) ... The `/api/releases` route carries an inner `_search_source_releases` helper that builds the search plan for one source, logs the planned query type, runs the search and turns `SourceUnavailableError`/operational errors into an error message instead of raising. Anything outside the route that wants to search one source with exactly those semantics has to go through Flask today. This moves that helper into `shelfmark/core/release_search.py` as `search_source_releases()` and has the route delegate to it. Behaviour is unchanged: same plan construction (including the caller's `user_id`, so per-user default languages still apply), same logging, same error-to-message handling. It is the refactor half of #1047 by @InfiniteAvenger, split out on its own as you asked for other PRs (#1318). Their authorship is preserved on the commit; I rebased it onto current `main` and added tests. ## Verification - `tests/core/test_release_search.py`: unknown source → `"Unknown source: …"`, `SourceUnavailableError` and operational errors → `"<source>: <error>"`, success path forwards `expand_search` / `content_type` and returns the source instance, the plan receives languages / manual query / indexers / `user_id`. (These tests are type-annotated; happy to strip the annotations if you prefer the suite's bare style.) - Full suite, ruff, ruff format, basedpyright, vulture green; the existing `/api/releases` route tests are unchanged and pass. Co-authored-by: InfiniteAvenger <calebewest02@gmail.com>	2026-09-19 23:16:53 -04:00
Marcelo Rodrigo	b7002a6eca	feat: Add TorBox client support and settings integration (#1342) ... Add **TorBox** as a torrent download client for Prowlarr releases. Users can select `TorBox` in the download client settings, configure it with the new `TORBOX_API_KEY` environment variable, and verify their credentials with the connection test button. The integration supports both magnet links and `.torrent` files. It tracks the torrent lifecycle through TorBox, downloads supported book and audiobook files from the TorBox CDN, preserves safe nested file paths, and cleans up remote and local download state. Important: Shared HTTP download logs omit full download URLs and URL-bearing exception text to avoid exposing credentials, following best practices. This applies to all clients that use the shared `download_url()` path; URLs remain available to the HTTP operations themselves. --- There is already related work in progress in #1173, which includes both torrent and direct-download support for TorBox. This PR is not intended to replace or compete with that contribution. It offers the tested torrent client functionality as a smaller, focused change that can make TorBox available to the community sooner. The direct-download integration proposed in #1173 remains valuable and could be reviewed or introduced separately. Automated tests cover configuration, connection validation, magnet and torrent-file submission, API errors, status and progress handling, file retrieval, path traversal protection, cancellation, cleanup, and sensitive URL redaction. I also validated the complete flow locally with several magnet links and `.torrent` downloads. TorBox processed the torrents and Shelfmark downloaded the resulting files as expected. AI was used to help with the implementation, with human validation. This PR and long description? Took me some good minutes at night after work, but gives me joy to open this PR to share with the community this improvement.	2026-09-19 23:15:57 -04:00
Paul Rimmer	aafce2be1d	Added the ability to sort direct search results by Most downloads (#1351) ... Now that we know about the AA Downloads stats for search results (#1336), this PR allows sorting them locally by "Most downloads" without doing another AA search. Not needing to do an AA search for this is faster than the other sorts which do new AA searches asking for their results to be sorted a certain way. Also added the "Settings->Search Mode->Default Sort Order->Most downloads" option. Universal downloads do not allow for results sorting so I did not include this feature there. NOTE: While adding this feature I noticed that shelfmark only looks at the first page of AA search results. So switching between different sort orders may result in different sets of results with the same search term. Here's a couple of pics showing the new sort option: <img width="1186" height="759" alt="search-mode-sort-order-most-downloads" src="https://github.com/user-attachments/assets/c43fe2e7-84ba-48cd-a850-383f1af0d28f" /> <img width="1172" height="828" alt="direct-search-results-most-downloads" src="https://github.com/user-attachments/assets/4e240180-6a9d-4ce1-ab86-006b286570dd" /> Coded with llama.cpp, opencode and 🤖	2026-09-19 23:12:36 -04:00
dependabot[bot]	cdd001bdd9	build(deps): bump python-socketio from 5.16.4 to 5.17.0 in the python-deps group (#1347) ... Bumps the python-deps group with 1 update: [python-socketio](https://github.com/sponsors/miguelgrinberg). Updates `python-socketio` from 5.16.4 to 5.17.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/sponsors/miguelgrinberg/commits">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-18 00:14:55 -04:00
CaliBrain	e5dd34ae0e	fix: unbreak main and follow up on the Blackhole handoff review (#1346) ... DownloadHistoryService.record_download and updated the single production caller, but not the eleven in the test suite, leaving main red with 32 failures. Pass None, which is what the pre-#1336 behaviour recorded. For the Blackhole handoff (#1345): add_download publishes the torrent before the cancel check runs, and BlackholeClient.remove() is a no-op, so the watcher picks the file up regardless. Reporting a bare "Cancelled" hid that from the user. Name the completed handoff in the cancellation message instead, drop the _handle_cancelled_download call whose usenet branch cannot apply to a handoff-only client, and record why the orchestrator no longer verifies HandoffResult.path. Finally, make tests/direct_download a package: test_libgen_extract.py imports tests.libgen.sample_html across test directories, so without an __init__.py pytest named its modules by bare basename and a same-named module elsewhere would collide.	2026-09-17 16:27:53 -04:00
dependabot[bot]	38a429acc8	build(deps): bump the python-deps group across 1 directory with 5 updates (#1344) ... Bumps the python-deps group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [tqdm](https://github.com/tqdm/tqdm) | `4.70.0` | `4.70.1` | | [seleniumbase](https://github.com/seleniumbase/SeleniumBase) | `4.53.7` | `4.54.5` | | [basedpyright](https://github.com/detachhead/basedpyright) | `1.40.0` | `1.40.1` | | [prek](https://github.com/j178/prek) | `0.5.2` | `0.5.3` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.6` | `0.16.7` | Updates `tqdm` from 4.70.0 to 4.70.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tqdm/tqdm/releases">tqdm's releases</a>.</em></p> <blockquote> <h2>tqdm v4.70.1 stable</h2> <ul> <li><code>contrib.concurrent</code>: fix no-len iterables (<a href="https://redirect.github.com/tqdm/tqdm/issues/1830">#1830</a> &lt;- <a href="https://redirect.github.com/tqdm/tqdm/issues/1828">#1828</a>)</li> <li>tests: major overhaul (<a href="https://redirect.github.com/tqdm/tqdm/issues/1819">#1819</a>)</li> <li>update AI policy in PR template</li> <li>misc lint &amp; tidy</li> <li>CI: bump workflow actions &amp; pre-commit hooks</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tqdm/tqdm/commit/9cf5a12b1f955468a17f0ba3c59092b23e4258ac"><code>9cf5a12</code></a> Merge pull request <a href="https://redirect.github.com/tqdm/tqdm/issues/1830">#1830</a> from eaubin/master</li> <li><a href="https://github.com/tqdm/tqdm/commit/24b9e1e08a097f1c30f2d235b63f9eb25ba47974"><code>24b9e1e</code></a> misc tidy</li> <li><a href="https://github.com/tqdm/tqdm/commit/2a9e4e82ddba07c5dd6d126e23a4745b76ea49c8"><code>2a9e4e8</code></a> contrib.concurrent: fix no-len iterables</li> <li><a href="https://github.com/tqdm/tqdm/commit/8d6ff8de5a9066de77d0a9df3e80a022a3dcf146"><code>8d6ff8d</code></a> Merge pull request <a href="https://redirect.github.com/tqdm/tqdm/issues/1819">#1819</a> from tqdm/devel</li> <li><a href="https://github.com/tqdm/tqdm/commit/bed379609c2c8300671c784c8f85a185c8cf6fb3"><code>bed3796</code></a> tests: major overhaul</li> <li><a href="https://github.com/tqdm/tqdm/commit/4d3d3194d5467e0701bc0f4b836a735273ef0868"><code>4d3d319</code></a> AI policy</li> <li><a href="https://github.com/tqdm/tqdm/commit/5dcb022b55553b60ed2131b64aa5bf1e65470df1"><code>5dcb022</code></a> minor syntax update</li> <li><a href="https://github.com/tqdm/tqdm/commit/309effe4244bf45427c5add7f1bcf33f98a7b421"><code>309effe</code></a> tests: pre-commit coverage</li> <li><a href="https://github.com/tqdm/tqdm/commit/604193aa03b5f5c0ad5f3d441951f0fbb515f1e4"><code>604193a</code></a> tests: slight tidy</li> <li><a href="https://github.com/tqdm/tqdm/commit/17f1cac07c89943eb0e6082875b3821205308d4f"><code>17f1cac</code></a> CI: bump workflow actions</li> <li>See full diff in <a href="https://github.com/tqdm/tqdm/compare/v4.70.0...v4.70.1">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.53.7 to 4.54.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.54.5 - MCP Server: Patch 14</h2> <h2>MCP Server: Patch 14</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/753846cca13b6ead76603781b09f725b3236ae79">Update the MCP Server</a> --&gt; Going for a top tool score in Glama.</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/fda62a2b83b9de176342f1c21c5f72032ffd4628">Update the MCP Server ReadMe</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b6cd1e7c787cbe2c580e624e3576112d0a0de959">Refresh optional Python dependencies</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 14 by <a href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4501">seleniumbase/SeleniumBase#4501</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.4...v4.54.5">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.4...v4.54.5</a></p> <h2>4.54.4 - MCP Server: Patch 13</h2> <h2>MCP Server: Patch 13</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/ec41b905a0202e13e9ed0b2f767cd755ea0f891c">Update CDP Mode (add timeout to a few methods)</a> --&gt; (One of the ReadMe files should've been committed in the next commit with a different message)</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/eaef20040fe624f2b51e369e1ea8bf5c34bb4d9c">Update the MCP Server</a> --&gt; (The MCP ReadMe was updated in the previous commit with the wrong commit message)</li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 13 by <a href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4500">seleniumbase/SeleniumBase#4500</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.3...v4.54.4">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.3...v4.54.4</a></p> <h2>4.54.3 - MCP Server: Patch 12</h2> <h2>MCP Server: Patch 12</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0d04ec82f7b2fa22bd84a67ad07a119c08a62d06">Update the MCP Server</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/f4a86268b1177044e0a4d03348f5fab76838b96b">Update the MCP Server ReadMe</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 12 by <a href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4499">seleniumbase/SeleniumBase#4499</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.2...v4.54.3">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.2...v4.54.3</a></p> <h2>4.54.2 - MCP Server: Patch 11</h2> <h2>MCP Server: Patch 11</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/7ea1bbfdae22951c3914a902c46a8520253eaf05">Update CDP Mode</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/1aa89a962424c6f3b930449844665a3fa2628d55">Update the MCP Server</a></li> </ul> <h2>What's Changed</h2> <ul> <li>MCP Server: Patch 11 by <a href="https://github.com/mdmintz"><code>@​mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4498">seleniumbase/SeleniumBase#4498</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.54.1...v4.54.2">https://github.com/seleniumbase/SeleniumBase/compare/v4.54.1...v4.54.2</a></p> <h2>4.54.1 - MCP Server: Patch 10</h2> <h2>MCP Server: Patch 10</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/3de06e5e22a2f6fe629f47bf5859bc74eebcae48"><code>3de06e5</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4501">#4501</a> from seleniumbase/mcp-server-patch-14</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/4c0aaa7ca4fae594cc2826d3bdbb08cb91ea8ab3"><code>4c0aaa7</code></a> Version 4.54.5</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b6cd1e7c787cbe2c580e624e3576112d0a0de959"><code>b6cd1e7</code></a> Refresh optional Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/37cffca4f6333d87a9f86a3c1322922ddec85d0b"><code>37cffca</code></a> Update MCP Server versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/fda62a2b83b9de176342f1c21c5f72032ffd4628"><code>fda62a2</code></a> Update the MCP Server ReadMe</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/753846cca13b6ead76603781b09f725b3236ae79"><code>753846c</code></a> Update the MCP Server</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/82e3b51cc6941649dda4eed08d7b3efc0eac734a"><code>82e3b51</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4500">#4500</a> from seleniumbase/mcp-server-patch-13</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/bc14832f52674fdf9ee574d87bd7b6fed6ae2f8e"><code>bc14832</code></a> Version 4.54.4</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/8945f2d745770ca06f316e990cd971e76476a1d1"><code>8945f2d</code></a> Refresh MCP Server versioning</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/eaef20040fe624f2b51e369e1ea8bf5c34bb4d9c"><code>eaef200</code></a> Update the MCP Server</li> <li>Additional commits viewable in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.53.7...v4.54.5">compare view</a></li> </ul> </details> <br /> Updates `basedpyright` from 1.40.0 to 1.40.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/detachhead/basedpyright/releases">basedpyright's releases</a>.</em></p> <blockquote> <h2>v1.40.1 (pyright 1.1.414)</h2> <h2>What's Changed</h2> <ul> <li>Merge 1.1.414 by <a href="https://github.com/DetachHead"><code>@​DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1883">DetachHead/basedpyright#1883</a></li> <li>fix multi-line display of indented lines in builtin docstrings by <a href="https://github.com/tommyming"><code>@​tommyming</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1882">DetachHead/basedpyright#1882</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/DetachHead/basedpyright/compare/v1.40.0...v1.40.1">https://github.com/DetachHead/basedpyright/compare/v1.40.0...v1.40.1</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DetachHead/basedpyright/commit/e7fca69a08abb7cb28fc6bc5e30e24a387066694"><code>e7fca69</code></a> 1.40.1</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/f7b6ad01edff0b53cd523a176c99ba62bf44156e"><code>f7b6ad0</code></a> add checks when there are multiline indents for doc strings, update (<a href="https://redirect.github.com/detachhead/basedpyright/issues/1882">#1882</a>)</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/1bc4879cb2a1cffea9ec6009eaa290b301ba4414"><code>1bc4879</code></a> fix broken docs links</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/845bfe14f2862b3747c8146ebd53bef7644368e8"><code>845bfe1</code></a> move and baseline basedpyright errors in new build scripts from upstream</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/a9189ef5e15182e0627dd5a0f28fd2cede4f2bbc"><code>a9189ef</code></a> prettier fix</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/756bfaa06709cd32c100a3fe3d15156ff3faef6a"><code>756bfaa</code></a> fix <code>build:extension:dev</code> script</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/a7a2efdab70c919436ff593bdbd8c3b4acaa96b0"><code>a7a2efd</code></a> syncpack fix</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/5f6749f16bc38608fbf6f0d48b216320676996b8"><code>5f6749f</code></a> fix tests</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/bb9b24fddf007c547baafbd013270f2a6cb7a2cb"><code>bb9b24f</code></a> fix zizmor errors in new workflows from upstream</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/b8ccd0e8cd6cc79be5158e7c4ec2691d9c332594"><code>b8ccd0e</code></a> fix compile errors from merge</li> <li>Additional commits viewable in <a href="https://github.com/detachhead/basedpyright/compare/v1.40.0...v1.40.1">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.5.2 to 0.5.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.5.3</h2> <h2>Release Notes</h2> <p>Released on 2026-09-13.</p> <h3>Enhancements</h3> <ul> <li>Add PEP 740 attestations for PyPI releases (<a href="https://redirect.github.com/j178/prek/pull/2705">#2705</a>)</li> <li>Add a <code>check-jsonc</code> builtin hook (<a href="https://redirect.github.com/j178/prek/pull/2682">#2682</a>)</li> <li>Allow disabling automatic uv installation (<a href="https://redirect.github.com/j178/prek/pull/2702">#2702</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix Julia additional dependency specifiers (<a href="https://redirect.github.com/j178/prek/pull/2703">#2703</a>)</li> <li>Update <code>granit-parser</code> to fix YAML flow indentation (<a href="https://redirect.github.com/j178/prek/pull/2707">#2707</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/clbarnes"><code>@​clbarnes</code></a></li> <li><a href="https://github.com/j178"><code>@​j178</code></a></li> <li><a href="https://github.com/tisonkun"><code>@​tisonkun</code></a></li> </ul> <h2>Install prek 0.5.3</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c &quot;irm https://github.com/j178/prek/releases/download/v0.5.3/prek-installer.ps1 | iex&quot; </code></pre> <h3>Install prebuilt binaries via Homebrew</h3> <pre lang="sh"><code>brew install prek </code></pre> <h2>Download prek 0.5.3</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-apple-darwin.tar.gz">prek-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-apple-darwin.tar.gz">prek-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-pc-windows-msvc.zip">prek-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-pc-windows-msvc.zip">prek-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://github.com/j178/prek/releases/download/v0.5.3/prek-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/master/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.5.3</h2> <p>Released on 2026-09-13.</p> <h3>Enhancements</h3> <ul> <li>Add PEP 740 attestations for PyPI releases (<a href="https://redirect.github.com/j178/prek/pull/2705">#2705</a>)</li> <li>Add a <code>check-jsonc</code> builtin hook (<a href="https://redirect.github.com/j178/prek/pull/2682">#2682</a>)</li> <li>Allow disabling automatic uv installation (<a href="https://redirect.github.com/j178/prek/pull/2702">#2702</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix Julia additional dependency specifiers (<a href="https://redirect.github.com/j178/prek/pull/2703">#2703</a>)</li> <li>Update <code>granit-parser</code> to fix YAML flow indentation (<a href="https://redirect.github.com/j178/prek/pull/2707">#2707</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/clbarnes"><code>@​clbarnes</code></a></li> <li><a href="https://github.com/j178"><code>@​j178</code></a></li> <li><a href="https://github.com/tisonkun"><code>@​tisonkun</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/b7eb6027125de7e3b67dd94039a4f69abf3a5fb0"><code>b7eb602</code></a> Bump version to 0.5.3 (<a href="https://redirect.github.com/j178/prek/issues/2708">#2708</a>)</li> <li><a href="https://github.com/j178/prek/commit/4644f81e1c86eeb8e22a1ba4aaa6dec99b4266c5"><code>4644f81</code></a> Update granit-parser to fix YAML flow indentation (<a href="https://redirect.github.com/j178/prek/issues/2707">#2707</a>)</li> <li><a href="https://github.com/j178/prek/commit/87f2ea44c258dc6606ca5556a7b3ff0d9a0a601e"><code>87f2ea4</code></a> Use self-repository syntax in CI workflows</li> <li><a href="https://github.com/j178/prek/commit/f39abae3cafd9ff245843b790fdd9b7c2e933b5c"><code>f39abae</code></a> Add PEP 740 attestations for PyPI releases (<a href="https://redirect.github.com/j178/prek/issues/2705">#2705</a>)</li> <li><a href="https://github.com/j178/prek/commit/f4924dccacd86afab22ae45e634d7f9ca12dd59e"><code>f4924dc</code></a> Allow disabling automatic uv installation (<a href="https://redirect.github.com/j178/prek/issues/2702">#2702</a>)</li> <li><a href="https://github.com/j178/prek/commit/156c0cec12847513ba764d1d87543ab6d0785c64"><code>156c0ce</code></a> Fix Julia additional dependency specifiers (<a href="https://redirect.github.com/j178/prek/issues/2703">#2703</a>)</li> <li><a href="https://github.com/j178/prek/commit/c3ede77b83e7d578e31d076863b755b296256a21"><code>c3ede77</code></a> Add a <code>check-jsonc</code> builtin hook (<a href="https://redirect.github.com/j178/prek/issues/2682">#2682</a>)</li> <li><a href="https://github.com/j178/prek/commit/c0b9749c3ee43f42efd0116624a7922feded3fc2"><code>c0b9749</code></a> Verify checksums for PyPI/mirror wheel installs (<a href="https://redirect.github.com/j178/prek/issues/2688">#2688</a>)</li> <li><a href="https://github.com/j178/prek/commit/fbe5c66737e679f31018dd438d16774c19c6774d"><code>fbe5c66</code></a> Update prek hooks (<a href="https://redirect.github.com/j178/prek/issues/2690">#2690</a>)</li> <li><a href="https://github.com/j178/prek/commit/4687a2c57f8ae58cf0e66b65baf49ea72ccb62ba"><code>4687a2c</code></a> Fix <code>check-hooks-apply</code> for builtin Windows filename checks</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.5.2...v0.5.3">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.6 to 0.16.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.7</h2> <h2>Release Notes</h2> <p>Released on 2026-09-10.</p> <h3>Preview features</h3> <ul> <li>[<code>ruff</code>] Add rule for default values on method receivers (<code>RUF077</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/26700">#26700</a>)</li> <li>[<code>ruff</code>] Recognize <code>re.prefixmatch</code> (<code>RUF039</code>, <code>RUF055</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28311">#28311</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Alternate nested quotes inside format spec interpolations (<a href="https://redirect.github.com/astral-sh/ruff/pull/28259">#28259</a>)</li> <li>[<code>flake8-implicit-str-concat</code>] Mark fix unsafe when it creates a docstring (<code>ISC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27981">#27981</a>)</li> <li>[<code>flake8-tidy-imports</code>] Skip fixes for multi-member imports (<code>TID254</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/26584">#26584</a>)</li> <li>[<code>pylint</code>] Gate <code>ImportCycleError</code> on Python 3.15 (<code>PLW0133</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28310">#28310</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Correct <code>D211</code> and <code>D203</code> rule conflict diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28444">#28444</a>)</li> <li>Recognize <code>slice</code> and <code>frozendict</code> generics (<a href="https://redirect.github.com/astral-sh/ruff/pull/28477">#28477</a>)</li> <li>Stop defining <code>__cached__</code> for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28476">#28476</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending removed <code>typing.no_type_check_decorator</code> (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28475">#28475</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reuse parser name lookups when interning (<a href="https://redirect.github.com/astral-sh/ruff/pull/28399">#28399</a>)</li> <li>Speed up inherited configuration resolution (<a href="https://redirect.github.com/astral-sh/ruff/pull/28299">#28299</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix <code>line-length</code> path in <code>--config</code> example (<a href="https://redirect.github.com/astral-sh/ruff/pull/28392">#28392</a>)</li> <li>Remove the &quot;Who’s Using Ruff?&quot; list (<a href="https://redirect.github.com/astral-sh/ruff/pull/28455">#28455</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Embed archive checksums in the shell installer (<a href="https://redirect.github.com/astral-sh/ruff/pull/28281">#28281</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/The-Compiler"><code>@​The-Compiler</code></a></li> <li><a href="https://github.com/mdiniz97"><code>@​mdiniz97</code></a></li> <li><a href="https://github.com/zsol"><code>@​zsol</code></a></li> <li><a href="https://github.com/gorewilliams"><code>@​gorewilliams</code></a></li> <li><a href="https://github.com/RafaelJohn9"><code>@​RafaelJohn9</code></a></li> <li><a href="https://github.com/qatcod"><code>@​qatcod</code></a></li> <li><a href="https://github.com/zanieb"><code>@​zanieb</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li> <li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.7</h2> <p>Released on 2026-09-10.</p> <h3>Preview features</h3> <ul> <li>[<code>ruff</code>] Add rule for default values on method receivers (<code>RUF077</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/26700">#26700</a>)</li> <li>[<code>ruff</code>] Recognize <code>re.prefixmatch</code> (<code>RUF039</code>, <code>RUF055</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28311">#28311</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Alternate nested quotes inside format spec interpolations (<a href="https://redirect.github.com/astral-sh/ruff/pull/28259">#28259</a>)</li> <li>[<code>flake8-implicit-str-concat</code>] Mark fix unsafe when it creates a docstring (<code>ISC003</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27981">#27981</a>)</li> <li>[<code>flake8-tidy-imports</code>] Skip fixes for multi-member imports (<code>TID254</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/26584">#26584</a>)</li> <li>[<code>pylint</code>] Gate <code>ImportCycleError</code> on Python 3.15 (<code>PLW0133</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28310">#28310</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>Correct <code>D211</code> and <code>D203</code> rule conflict diagnostic (<a href="https://redirect.github.com/astral-sh/ruff/pull/28444">#28444</a>)</li> <li>Recognize <code>slice</code> and <code>frozendict</code> generics (<a href="https://redirect.github.com/astral-sh/ruff/pull/28477">#28477</a>)</li> <li>Stop defining <code>__cached__</code> for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/pull/28476">#28476</a>)</li> <li>[<code>pyupgrade</code>] Stop recommending removed <code>typing.no_type_check_decorator</code> (<code>UP035</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/28475">#28475</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reuse parser name lookups when interning (<a href="https://redirect.github.com/astral-sh/ruff/pull/28399">#28399</a>)</li> <li>Speed up inherited configuration resolution (<a href="https://redirect.github.com/astral-sh/ruff/pull/28299">#28299</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Fix <code>line-length</code> path in <code>--config</code> example (<a href="https://redirect.github.com/astral-sh/ruff/pull/28392">#28392</a>)</li> <li>Remove the &quot;Who’s Using Ruff?&quot; list (<a href="https://redirect.github.com/astral-sh/ruff/pull/28455">#28455</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Embed archive checksums in the shell installer (<a href="https://redirect.github.com/astral-sh/ruff/pull/28281">#28281</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/The-Compiler"><code>@​The-Compiler</code></a></li> <li><a href="https://github.com/mdiniz97"><code>@​mdiniz97</code></a></li> <li><a href="https://github.com/zsol"><code>@​zsol</code></a></li> <li><a href="https://github.com/gorewilliams"><code>@​gorewilliams</code></a></li> <li><a href="https://github.com/RafaelJohn9"><code>@​RafaelJohn9</code></a></li> <li><a href="https://github.com/qatcod"><code>@​qatcod</code></a></li> <li><a href="https://github.com/zanieb"><code>@​zanieb</code></a></li> <li><a href="https://github.com/MichaReiser"><code>@​MichaReiser</code></a></li> <li><a href="https://github.com/ntBre"><code>@​ntBre</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@​charliermarsh</code></a></li> <li><a href="https://github.com/nightt5879"><code>@​nightt5879</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/b5dba861cc38e3f7fb4524c9ceba3e01a474ea13"><code>b5dba86</code></a> Bump version to 0.16.7 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28496">#28496</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/5992d0504697d86565d8fc3a4d8245a5f4047d24"><code>5992d05</code></a> Install rustfmt before linting releases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28495">#28495</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/1713a1f4325494d883a080d590a25a1946f399e8"><code>1713a1f</code></a> ensure prepare release changes pass prek (<a href="https://redirect.github.com/astral-sh/ruff/issues/28488">#28488</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/18cdbb4f3d14058794420e758864795f55336334"><code>18cdbb4</code></a> use scoped token for release workflow (<a href="https://redirect.github.com/astral-sh/ruff/issues/28484">#28484</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/c3813a501faf887fd01948c98bb8d58ad26488bd"><code>c3813a5</code></a> add a workflow for preparing releases (<a href="https://redirect.github.com/astral-sh/ruff/issues/28486">#28486</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/00948c00a671b81f5358af9f038436bcbb993b38"><code>00948c0</code></a> Remove the &quot;Who’s Using Ruff?&quot; list (<a href="https://redirect.github.com/astral-sh/ruff/issues/28455">#28455</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/86a2eba7b48e3c10386f7ab8a5425c7275d2b427"><code>86a2eba</code></a> [<code>pyupgrade</code>] Stop recommending removed <code>typing.no_type_check_decorator</code> (`UP...</li> <li><a href="https://github.com/astral-sh/ruff/commit/609e184aa35f0034b7ef63e3e04327081c484af6"><code>609e184</code></a> Stop defining <code>__cached__</code> for Python 3.15 (<a href="https://redirect.github.com/astral-sh/ruff/issues/28476">#28476</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/859ff2f01670c43ffff1ea597c8a2e375ada0fbe"><code>859ff2f</code></a> [ty] Track symlinked directory status in listings (<a href="https://redirect.github.com/astral-sh/ruff/issues/28482">#28482</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/77f653825800ddaf3bc221ae6db49a500e1002d5"><code>77f6538</code></a> Use paid GitHub-hosted runners for Linux (<a href="https://redirect.github.com/astral-sh/ruff/issues/28478">#28478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.6...0.16.7">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-17 15:53:10 -04:00
Vinicius Gabriel	c53545d9fe	Add configurable word separator for naming templates (#1333) ... Closes #1230 ## What Adds a "Word Separator" setting (Space / Dot / Underscore / Hyphen / Custom) that replaces internal whitespace in each naming-template placeholder's rendered value — e.g. `{Author}` renders "Arthur.Conan.Doyle" instead of "Arthur Conan Doyle" when Dot is selected. This follows option 2 from the issue rather than inventing new dotted-keyword template syntax (`{Author.}`), since it's a smaller surface: one setting applies uniformly across all four templates (books/audiobooks × rename/organize) instead of needing a parallel token for every existing one. ## How it works - Literal characters typed into the template itself (e.g. the `.` in `{Author}.-.{Title}`) are never touched — only whitespace *inside* a placeholder's resolved value is affected. - Default is "Space", which is a no-op: existing templates produce byte-identical output after this change (verified via the existing test suite, unmodified, still passing). ## Where - `shelfmark/core/naming.py` — `word_separator` param on `parse_naming_template` / `build_library_path`. - `shelfmark/download/postprocess/policy.py` — `get_word_separator()`, mirroring the existing `get_file_organization()` accessor. - `shelfmark/download/postprocess/transfer.py` — wires the resolved separator through the four existing template-rendering call sites. - `shelfmark/config/settings.py` — new `Word Separator` / `Custom Word Separator` fields next to the existing naming-template fields. - `src/frontend/.../namingTemplatePreview.ts` + `NamingTemplateField.tsx` — the settings UI has its own TS mirror of the Python renderer for the live preview; updated it in lockstep so the preview doesn't lie about what the separator will actually do. - Tests added on both sides (pytest + vitest). ## Testing - `uv run pytest tests/core/test_naming.py tests/core/test_destination_file_organization.py` — all pass, including new cases. - `uv run pytest` (full suite) — same pre-existing failures as on `main` before this change (browser/network-dependent bypass & e2e tests unrelated to this diff), everything else green. - `uv run ruff check` / `ruff format --check` / `basedpyright` — clean. - `npm run lint` / `format:check` / `typecheck` / `test:unit` (196 tests) — clean.	2026-09-17 15:52:21 -04:00
Atirna	8f608f2e64	fix(download): complete consumed Blackhole handoffs (#1345) ... A Blackhole watcher can consume the torrent before Shelfmark checks it, leaving the task in error even though the handoff succeeded. Complete the handoff when `add_download` successfully publishes the file, and stop requiring a `HandoffResult` path to remain present. Follow-up to #1312. ## Verification - A watcher that immediately reads and removes the torrent receives the exact bytes. The task changes from ERROR before this fix to COMPLETE afterward, without running book postprocessing. - The consumed-file regression fails on current main and passes here. Resident files, write failures, cancellation, magnet rejection and normal downloads remain covered: 81 focused tests pass. - Ruff lint and formatting pass for the changed files.	2026-09-17 15:51:20 -04:00
David Young	2bb84a17a2	Extract archives when zip/rar are enabled as supported formats (#1343) ... The default audiobook formats include `zip` and `rar`. `scan_directory_tree` checks the supported-format list before checking for archives, so a downloaded archive lands in `book_files` and is imported as-is. The extraction branch in `collect_directory_files` is never reached. This keeps archives out of `book_files`, so they always take the archive path: extracted when extraction is allowed, imported as-is when it isn't (unchanged). Tests added in `tests/download/test_postprocess_scan_archives.py`; three of the four fail without the change.	2026-09-17 15:50:52 -04:00
Paul Rimmer	2ed2e9a5d4	Feature: Add Download counts to search result displays and Download sidebar (#1336) ... Having the download counts from AA as an input on choosing which of the many search results to pick for downloading is useful. This PR makes the downloads numbers available on all the search result pages and also on the Download sidebar after the user presses a download button for a Direct Download. I have also included a SKILL.md and associated download_books.py that can be used just as a reference or with an LLM harness for automation. The Downloads info is used by the script to pick which search result to download out of the many available. Since a picture is worth a thousand words: <img width="1225" height="812" alt="search-results-with-downloads" src="https://github.com/user-attachments/assets/e108ebe2-4cad-45e2-bb6a-d4f49b502de9" /> <img width="443" height="267" alt="download-sidebar-with-downloads" src="https://github.com/user-attachments/assets/9ce9e6c4-dcf5-4f7c-ab22-71850398b534" /> Coded with llama.cpp and 🤖	2026-09-17 15:49:57 -04:00
Alex Guerrieri	c6b70a6844	fix(sources): send a Referer when fetching libgen ads.php pages (#1340) ... ## What libgen.li's `ads.php?md5=` now returns an **empty `200`** to any request without a `Referer` — an anti-hotlinking check the mirrors added recently. Both libgen paths fetch it without one, so the page comes back blank and the download silently fails while **search keeps working** (which is exactly why it looks like rate-limiting or mirror drift rather than a bug). Same one-line cause, two call sites: the Libgen search source (`libgen/scraper.py:fetch_page`) and the AA-md5 → libgen fallback (`direct_download/annas_archive.py:_extract_libgen_download_url`). Fix: send a same-origin `Referer: <scheme>://<host>/` on the `ads.php` fetch in both. ## Worth a look in review - **The referer goes on the *resolution* fetch, not the download.** `download_url(..., referer=...)` was already correct — the blank page happens one step earlier, at the `ads.php` GET. - Reproduced against live mirrors: `ads.php` returns `Content-Length: 0` bare, the full page with a `Referer`, and resolvable files download valid bytes again. Regression tests in `tests/libgen/` and `tests/direct_download/` assert the header on both paths. Lint/format/typecheck clean. Follow-up to #1326.	2026-09-17 15:47:45 -04:00
CaliBrain	35b89b0d78	fix(sources): restore Direct Download search errors and language matches (#1339) ... Fixes two regressions from the provider-driven refactor (#1337). First, the composite search caught RuntimeError, TypeError, ValueError and request errors from each provider and returned an empty list, so a failed search looked like one with no hits. It now raises the first provider failure when no provider returned releases. Second, the shared parser re-matched every row's language locally, dropping rows Anna's Archive had already matched with &lang= (free-text cells like 'English, French' or 'unknown'). parse_search_items gains a filter_languages option, which AA turns off, so AA's own language-from-path filter is again the only local one.	2026-09-14 01:30:05 -04:00
Tom	a5cd9f0bfb	refactor: make direct download provider-driven (#1337) ... This is the refactor for the download handler	2026-09-14 01:16:53 -04:00
Alex Guerrieri	af21d1da1f	feat(sources): add Libgen as a direct catalogue search source (#1326) ... ## What Adds **Libgen as a search source**. Today Libgen is only a download mirror (reached by an Anna's Archive md5), so anything in Libgen but not in AA's search index is invisible — and that's where most of the CBZ/CBR comics and manga live. A Libgen search for *One Piece*, for instance, turns up ~99 volumes that AA search never shows. It's a self-contained `release_sources/libgen/` package (source + handler + settings) plus one line to register it. **No changes to `direct_download.py`** — it reuses the existing `ads.php → get.php` resolution and the mirrors already configured in `LIBGEN_MIRROR_URLS`. Plain HTTP, no bypasser needed (libgen.li isn't behind DDoS-Guard). Opt-in via a settings toggle. ## Worth a look in review - **`source_id` is `libgen:<md5>`, not the bare md5.** The download queue keys on `task_id` (= `source_id`), and `direct_download` already uses the bare md5. Since AA indexes a lot of Libgen, the same md5 shows up from both sources — a bare id would collide in the queue. The handler strips the prefix before downloading. - **Reachable like the other non-default sources** (Prowlarr, AudiobookBay, …): it appears in the per-book release search, not the free-text box (that stays wired to `direct_download`). Tests in `tests/libgen/` cover parsing (both row layouts), the source, the handler, and `get_record`. Lint/format/typecheck clean.	2026-09-14 01:08:08 -04:00
CaliBrain	1b17fe179a	fix(irc): rank a surname-only result as partial, not wrong (#1332) (#1334) ... "David Petrie" as "D. Petrie", then ranked the answer by the full name to recover the precision the surname gave up. The two halves disagreed. author_affinity needs two agreeing tokens before it calls a name the same person, so "Petrie" - the name on the filenames a surname search exists to reach - matched one and came back AUTHOR_MISMATCH. It therefore sorted below "Unknown" and level with "Gordon Petrie", a different author who merely shares the surname. The widened query pulled those rows in and the ranker buried them. Falling short of agreement is now separated from disagreeing with it. A name whose every token fits the one asked for is an abbreviation of it and ranks AUTHOR_PARTIAL, between agreement and "no author reported"; a name carrying a token that fits nothing still ranks AUTHOR_MISMATCH. Nothing that agreed before changes tier - "Homer"/"Homer Simpson" is still a match, since the extra token must not demote a mononym that already met its one-token requirement - so Prowlarr's #1293 ordering is unchanged except that a tracker listing a bare surname stops being read as the wrong author. Measured on the issue's own case, wanted "David Petrie": before: D Petrie, Unknown, Petrie, Gordon Petrie after: D Petrie, Petrie, Unknown, Gordon Petrie Second fix, same release: a book with no title posted the surname on its own. _build_query fell back to book.search_title or book.title, which is empty on exactly the path where the plan has no title variants, so the line reaching the channel was "@search Petrie" - not a search for anything, and the kind of bare over-broad post is_available refuses unaddressed queries to avoid. It now returns "" and the existing "No search query could be built" guard takes it. Tested with make python-lint, python-format, python-dead-code, python-typecheck and python-test.	2026-09-11 22:26:28 -04:00
Zoltán Szabó	35037b35fd	fix(irc): search by surname, and rank the answer by author (#1331) (#1332) ... Fixes #1331. A search bot ANDs every term against a filename, so the given name is the term that empties the result set. Measured against irchighway's #ebooks: "Revelations David Petrie" is answered "no results", "Revelations Petrie" returns 9 matches, 6 of which parse, all filed as "D Petrie". The query now carries the title and the surname, read off the search variant so the ISBN fallback and a manual query - which set author="" on purpose - keep their current shape. Title-only, the shape #1295 settled on for Prowlarr, does not transfer: the bot caps an answer at 1000 matches, and a bare "Revelations" hits that cap with 923 parsed rows across 500 authors, so the cap itself can drop the wanted book. The surname is the token the two spellings share and it keeps the answer small. The full author then orders what comes back, reusing author_affinity from #1295, since a surname also matches a different author who shares it. It sits under server availability the way indexer priority does in #1295: a download addresses one named bot and waits 120s for it, so a match from a bot that has left the channel must not outrank a mismatch that can answer. Ranking runs on the way out rather than before the cache, because one query identity is shared by every book that produced that query. Two things found while testing: - The parser writes the literal "Unknown" when a filename has no " - " separator (parser.py:168). Ranked literally that sorts as a wrong author, so author_affinity's middle tier was unreachable here; it is now read as absent. 5 of those 923 rows are affected. - author_affinity moves to shelfmark/core/author_match.py, unchanged, so IRC does not import from the Prowlarr package. Prowlarr behaviour is untouched and its tests pass as they are. The three IRC assertions in the #1252 regression file move to the surname form. The invariant they pin - one contributor's name reaches the query, never the whole credit list - is unchanged. Tested with make python-lint, python-format, python-dead-code, python-typecheck and python-test, and end to end against irchighway with the patched source: it posts "Revelations Petrie" and returns 6 releases.	2026-09-11 22:14:37 -04:00
dependabot[bot]	8c902d7f7a	build(deps-dev): bump vitest from 4.1.11 to 5.0.0 in /src/frontend (#1330) ... Bumps [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) from 4.1.11 to 5.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitest-dev/vitest/releases">vitest's releases</a>.</em></p> <blockquote> <h2>v5.0.0</h2> <p>Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our <a href="https://vitest.dev/blog/vitest-5.html">blog post</a> for the official announcement.</p> <h3>   🚨 Breaking Changes</h3> <ul> <li>Replace <code>loupe.inspect</code> with pretty-format  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Claude Opus 5 (1M context)</strong> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9609">vitest-dev/vitest#9609</a> <a href="https://github.com/vitest-dev/vitest/commit/3f802da4b"><!-- raw HTML omitted -->(3f802)<!-- raw HTML omitted --></a></li> <li>Remove quotes from string values in <code>test.for/each</code> title <code>$</code> variable (take 2)  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10170">vitest-dev/vitest#10170</a> <a href="https://github.com/vitest-dev/vitest/commit/04d37e9d7"><!-- raw HTML omitted -->(04d37)<!-- raw HTML omitted --></a></li> <li>Default <code>attachmentsDir</code> from <code>.vitest-attachements/</code> to <code>.vitest/attachments/</code>  -  by <a href="https://github.com/MdSadiqMd"><code>@​MdSadiqMd</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10186">vitest-dev/vitest#10186</a> <a href="https://github.com/vitest-dev/vitest/commit/1ba7338c3"><!-- raw HTML omitted -->(1ba73)<!-- raw HTML omitted --></a></li> <li>Remove <code>sequential</code> test/suite options in favor of <code>concurrent</code>  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10198">vitest-dev/vitest#10198</a> <a href="https://github.com/vitest-dev/vitest/commit/9229f2edc"><!-- raw HTML omitted -->(9229f)<!-- raw HTML omitted --></a></li> <li>Represent locator as an object instead of a string  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10212">vitest-dev/vitest#10212</a> <a href="https://github.com/vitest-dev/vitest/commit/80f07edf6"><!-- raw HTML omitted -->(80f07)<!-- raw HTML omitted --></a></li> <li>Inline <code>expect</code> package  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10221">vitest-dev/vitest#10221</a> <a href="https://github.com/vitest-dev/vitest/commit/ad16223e7"><!-- raw HTML omitted -->(ad162)<!-- raw HTML omitted --></a></li> <li>Remove deprecated entry points  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10222">vitest-dev/vitest#10222</a> <a href="https://github.com/vitest-dev/vitest/commit/994c6ddb9"><!-- raw HTML omitted -->(994c6)<!-- raw HTML omitted --></a></li> <li>Require Node.js 22 and Vite 6.4  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10178">vitest-dev/vitest#10178</a> <a href="https://github.com/vitest-dev/vitest/commit/3876283e8"><!-- raw HTML omitted -->(38762)<!-- raw HTML omitted --></a></li> <li>Fail <code>expect.poll</code> when function didn't resolve in time  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10233">vitest-dev/vitest#10233</a> <a href="https://github.com/vitest-dev/vitest/commit/4df048c11"><!-- raw HTML omitted -->(4df04)<!-- raw HTML omitted --></a></li> <li>Throw an error if hoistable methods are outside the top level scope  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10460">vitest-dev/vitest#10460</a> <a href="https://github.com/vitest-dev/vitest/commit/d0b4fddcb"><!-- raw HTML omitted -->(d0b4f)<!-- raw HTML omitted --></a></li> <li><code>toHaveTextContent</code> is strict, add <code>toMatchTextContent</code> as alternative  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10473">vitest-dev/vitest#10473</a> <a href="https://github.com/vitest-dev/vitest/commit/18f303079"><!-- raw HTML omitted -->(18f30)<!-- raw HTML omitted --></a></li> <li>Don't lookup config file from ancestor directories  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>OpenAI Codex</strong> and <strong>Hiroshi Ogawa</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10428">vitest-dev/vitest#10428</a> <a href="https://github.com/vitest-dev/vitest/commit/945d9090e"><!-- raw HTML omitted -->(945d9)<!-- raw HTML omitted --></a></li> <li>Inline <code>@vitest/runner</code> package, do not publish it anymore  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10511">vitest-dev/vitest#10511</a> <a href="https://github.com/vitest-dev/vitest/commit/6d6e46b1e"><!-- raw HTML omitted -->(6d6e4)<!-- raw HTML omitted --></a></li> <li>Allow mutating happy-dom/jsdom window object  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10373">vitest-dev/vitest#10373</a> <a href="https://github.com/vitest-dev/vitest/commit/206e8cff8"><!-- raw HTML omitted -->(206e8)<!-- raw HTML omitted --></a></li> <li>Expose <code>concurrencyId</code>/<code>workerId</code> on TestModule's diagnostics, make id 1-based  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10516">vitest-dev/vitest#10516</a> <a href="https://github.com/vitest-dev/vitest/commit/bdd985433"><!-- raw HTML omitted -->(bdd98)<!-- raw HTML omitted --></a></li> <li>Add <code>screenshotDirectory</code> config to <code>browser.expect.toMatchScreenshot</code>  -  by <a href="https://github.com/macarie"><code>@​macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10592">vitest-dev/vitest#10592</a> <a href="https://github.com/vitest-dev/vitest/commit/a60ded0fb"><!-- raw HTML omitted -->(a60de)<!-- raw HTML omitted --></a></li> <li>Update <code>@sinonjs/fake-timers</code> and support mocking <code>Temporal</code>  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (gpt-5.6-sol)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10654">vitest-dev/vitest#10654</a> <a href="https://github.com/vitest-dev/vitest/commit/f8b1532fe"><!-- raw HTML omitted -->(f8b15)<!-- raw HTML omitted --></a></li> <li>Remove webdriverio package  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10675">vitest-dev/vitest#10675</a> <a href="https://github.com/vitest-dev/vitest/commit/5fed68f72"><!-- raw HTML omitted -->(5fed6)<!-- raw HTML omitted --></a></li> <li>Clear mocks by default before each test  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10613">vitest-dev/vitest#10613</a> <a href="https://github.com/vitest-dev/vitest/commit/0f6463bf2"><!-- raw HTML omitted -->(0f646)<!-- raw HTML omitted --></a></li> <li>Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10293">vitest-dev/vitest#10293</a> <a href="https://github.com/vitest-dev/vitest/commit/334edef92"><!-- raw HTML omitted -->(334ed)<!-- raw HTML omitted --></a></li> <li>Separate config resolution from the server creation  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10554">vitest-dev/vitest#10554</a> <a href="https://github.com/vitest-dev/vitest/commit/1c0ec3444"><!-- raw HTML omitted -->(1c0ec)<!-- raw HTML omitted --></a></li> <li>Inline projects extend the root config by default  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10750">vitest-dev/vitest#10750</a> <a href="https://github.com/vitest-dev/vitest/commit/fec001ad3"><!-- raw HTML omitted -->(fec00)<!-- raw HTML omitted --></a></li> <li>Enable mocking Temporal without fake timers  -  by <a href="https://github.com/fabon-f"><code>@​fabon-f</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenCode (gpt-5.6-sol)</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10757">vitest-dev/vitest#10757</a> <a href="https://github.com/vitest-dev/vitest/commit/ac2d46b42"><!-- raw HTML omitted -->(ac2d4)<!-- raw HTML omitted --></a></li> <li>Support nested projects  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10846">vitest-dev/vitest#10846</a> <a href="https://github.com/vitest-dev/vitest/commit/ec367cf2a"><!-- raw HTML omitted -->(ec367)<!-- raw HTML omitted --></a></li> <li>Use <code>&gt;</code> as separator in <code>-t</code>, calculate <code>only</code> once  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10686">vitest-dev/vitest#10686</a> <a href="https://github.com/vitest-dev/vitest/commit/a0b20bc86"><!-- raw HTML omitted -->(a0b20)<!-- raw HTML omitted --></a></li> <li>Fail the test when an asynchronous assertion is not awaited  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10868">vitest-dev/vitest#10868</a> <a href="https://github.com/vitest-dev/vitest/commit/86d4a9da9"><!-- raw HTML omitted -->(86d4a)<!-- raw HTML omitted --></a></li> <li>Share the Vite server between inline projects  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10848">vitest-dev/vitest#10848</a> <a href="https://github.com/vitest-dev/vitest/commit/d87c96ee4"><!-- raw HTML omitted -->(d87c9)<!-- raw HTML omitted --></a></li> <li>Parse files statically in vitest list by default  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/11088">vitest-dev/vitest#11088</a> <a href="https://github.com/vitest-dev/vitest/commit/51e949416"><!-- raw HTML omitted -->(51e94)<!-- raw HTML omitted --></a></li> <li><strong>benchmark</strong>: <ul> <li>Rewrite the public API  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10113">vitest-dev/vitest#10113</a> <a href="https://github.com/vitest-dev/vitest/commit/19f6e8947"><!-- raw HTML omitted -->(19f6e)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>browser</strong>: <ul> <li>Iframe scale  -  by <a href="https://github.com/macarie"><code>@​macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9745">vitest-dev/vitest#9745</a> <a href="https://github.com/vitest-dev/vitest/commit/b639852cc"><!-- raw HTML omitted -->(b6398)<!-- raw HTML omitted --></a></li> <li>Enable <code>locators.exact</code> by default  -  by <a href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10430">vitest-dev/vitest#10430</a> <a href="https://github.com/vitest-dev/vitest/commit/e203202f9"><!-- raw HTML omitted -->(e2032)<!-- raw HTML omitted --></a></li> <li>Require <code>sessionId</code> for orchestrator html request  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong> and <strong>OpenAI Codex</strong> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10522">vitest-dev/vitest#10522</a> <a href="https://github.com/vitest-dev/vitest/commit/79b7d8fcc"><!-- raw HTML omitted -->(79b7d)<!-- raw HTML omitted --></a></li> <li>Save failure screenshots in <code>attachmentsDir</code>  -  by <a href="https://github.com/macarie"><code>@​macarie</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10917">vitest-dev/vitest#10917</a> <a href="https://github.com/vitest-dev/vitest/commit/3b5bbd8b4"><!-- raw HTML omitted -->(3b5bb)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>coverage</strong>: <ul> <li><code>include/exclude</code> globs too eager  -  by <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9818">vitest-dev/vitest#9818</a> <a href="https://github.com/vitest-dev/vitest/commit/edacb0fd4"><!-- raw HTML omitted -->(edacb)<!-- raw HTML omitted --></a></li> <li>Allow <code>thresholds.perFile</code> to accept an object  -  by <a href="https://github.com/vladlenskiy"><code>@​vladlenskiy</code></a> and <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10190">vitest-dev/vitest#10190</a> <a href="https://github.com/vitest-dev/vitest/commit/13b78d98b"><!-- raw HTML omitted -->(13b78)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>expect</strong>: <ul> <li>Fix <code>toThrow(&quot;&quot;)</code> behavior by reverting <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/6710">#6710</a>  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/9643">vitest-dev/vitest#9643</a> and <a href="https://redirect.github.com/vitest-dev/vitest/issues/6710">vitest-dev/vitest#6710</a> <a href="https://github.com/vitest-dev/vitest/commit/6c3e4bdbf"><!-- raw HTML omitted -->(6c3e4)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>mocker</strong>: <ul> <li>Deserialize automock as automock  -  by <a href="https://github.com/nami8824"><code>@​nami8824</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10192">vitest-dev/vitest#10192</a> <a href="https://github.com/vitest-dev/vitest/commit/2f892712d"><!-- raw HTML omitted -->(2f892)<!-- raw HTML omitted --></a></li> </ul> </li> <li><strong>reporters</strong>: <ul> <li><code>blob</code> reporter and <code>--merge-reports</code> default to <code>.vitest/blob/</code>  -  by <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10232">vitest-dev/vitest#10232</a> <a href="https://github.com/vitest-dev/vitest/commit/d22b029ae"><!-- raw HTML omitted -->(d22b0)<!-- raw HTML omitted --></a></li> <li>Write json and junit reporter output files to <code>.vitest</code> by default  -  by <a href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>, <strong>Hiroshi Ogawa</strong>, <strong>OpenCode (gpt-5.6-sol)</strong> and <a href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a href="https://redirect.github.com/vitest-dev/vitest/issues/10621">vitest-dev/vitest#10621</a> <a href="https://github.com/vitest-dev/vitest/commit/58577290a"><!-- raw HTML omitted -->(58577)<!-- raw HTML omitted --></a></li> </ul> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitest-dev/vitest/commit/f441c6fab25e579c5b7dd3dd50538416f415fbae"><code>f441c6f</code></a> chore: release v5.0.0 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11130">#11130</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/d46a7472266d5bb43595ea51dcdd64ab0f560f12"><code>d46a747</code></a> fix: treat test.describe as a suite during static collection (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11128">#11128</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/584cf308437069385b0fb905fa3ff7d7b7f65a90"><code>584cf30</code></a> fix: add a warning if inline project has duplicate plugins due to unexpected ...</li> <li><a href="https://github.com/vitest-dev/vitest/commit/f08ce4b7144542af128dcb884150c42074223653"><code>f08ce4b</code></a> fix: apply queued mocks from doMock() in queue order (fixes <a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/10706">#10706</a>) (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11127">#11127</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/897f51fd2493046c52ec9539b7d02fe3763bd63e"><code>897f51f</code></a> chore: release v5.0.0-rc.4 (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11107">#11107</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/1339b0655dc4679aeb8f905bacee83b6f76f6b23"><code>1339b06</code></a> chore(deps): update all non-major dependencies (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11104">#11104</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/51e9494166d8d0108a621fce80c41b6dba760bae"><code>51e9494</code></a> feat!: parse files statically in vitest list by default (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11088">#11088</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/2122ffdfb42d86c9a2f1238100d6a031312cae32"><code>2122ffd</code></a> fix: propagate --maxWorkers to projects (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11102">#11102</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/dc10f5f8fb69b026afcf56f8a7a9dd36bd964d73"><code>dc10f5f</code></a> fix(browser): report the action error when a task times out (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11101">#11101</a>)</li> <li><a href="https://github.com/vitest-dev/vitest/commit/d4fe1986fe334d22940039e815ccdbcc907baa6a"><code>d4fe198</code></a> feat: promote clearCache out of experimental (<a href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11086">#11086</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitest-dev/vitest/commits/v5.0.0/packages/vitest">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-09-11 02:07:57 -04:00