mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-09-24 22:05:20 +01:00
a52c436d6a2de444a7aaf3288aff95113dfd5acf
488
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Calibrain
|
a52c436d6a |
fix(search): let manual search switch media type under forced combined search
Manual search browses release sources directly, one media type at a time, so the combined (both) flow never applied to it — yet FORCE_COMBINED_SEARCH locked the content-type selector onto both, pinning manual search to ebook sources with no way to reach audiobook sources (no Audiobay tab). Treat a manual search target as combined-exempt in the search bar: present a plain, switchable Books/Audiobooks selector (unlocked, no combined toggle), even when combined search is forced on for metadata targets. Metadata search behavior is unchanged. Fixes #1256 |
||
|
CaliBrain
|
95e34670f7 |
fix/group archive extracted audiobooks (#1261)
- fix: group multi-file audiobooks that arrive as an archive - Surface the concrete reason when a direct-download fetch fails |
||
|
CaliBrain
|
7d56624ab6 |
fix: group multi-file audiobooks that arrive as an archive (#1254)
Follow-up to #1237. \`rename_and_group\` only grouped when the source root was a directory, so a multi-file audiobook delivered as a single archive fell through to the flat path: a \`Book.zip\` of twelve chapters landed loose in the destination root with its original chapter names — the layout #1181 is about. The \`is_dir()\` guard was there to keep \`Book.zip/\` from becoming the folder name, but skipping the file case gives up the grouping instead of naming it. A non-directory source can only produce several book files by having been extracted (\`collect_staged_files\` returns a single-element list for every other file shape), so the archive stem is the release name and the suffix is packaging: group under \`Book/\`. Also regenerates the env docs for the new option and gives it the same \"do not use with ingest folders\" caveat Rename and Organize carries, since both now create directories in the destination. Tested: reverting only the source fix makes both new tests fail and the \`rename\` control case pass, so grouping stays opt-in. Full non-e2e suite green (2653 passed). |
||
 
|
f4421ff189 |
fix: preserve multi-file audiobook folders (#1237)
Pass the effective source root from `process_folder_output` into `transfer_book_files`, and have the transfer layer select a sanitized child directory named after that source root when an audiobook has multiple files and its organization mode is `none` or `rename`. Create that grouping directory before applying the existing hardlink/copy/move logic so operation accounting, torrent seeding preservation, collision handling, cleanup, and custom-script final paths continue to use the established production path. Completed multi-file audiobook torrents arrive as a directory whose chapter filenames may not identify the book, but folder output currently sends every discovered chapter directly to the configured destination in `none` and `rename` modes. This flattens chapters from unrelated books together and causes directory-oriented consumers such as Audiobookshelf to interpret individual chapters as separate books. A multi-file audiobook torrent in the default `rename` mode copies or hardlinks all supported chapter files beneath `<destination>/<original torrent directory>/` with their original chapter filenames, and places no chapters directly in the destination root; A multi-file audiobook in `none` mode receives the same source-folder grouping without renaming its chapter files. Fixes #1181 --------- Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
CaliBrain
|
e7007865a4 |
fix(prowlarr): stop turning indexer failures into empty results and 404s (#1251)
Two independent bugs, both from an indexer that Prowlarr proxies rather
than answers for itself: the search never reported that it had failed,
and the grab never resolved what it was handed.
Search. A Torznab search is Prowlarr proxying a live request out to the
tracker, so for a Cloudflare-fronted indexer it waits on FlareSolverr.
The client gave it the 30s budget sized for Prowlarr's own JSON
endpoints, then swallowed every failure -- the timeout, the 429 Prowlarr
returns once it has disabled an indexer, a parse error -- into the same
empty list that means "this indexer has nothing". A cold challenge
routinely runs past a minute, so the UI said "No releases found for this
book" while FlareSolverr was still solving. That empty list also drove
the auto-expand retry, which fires on "no results with the category
filter". A timeout satisfies it, so Shelfmark sent a second search to an
indexer still busy with the first -- two Chromes at once, enough to take
FlareSolverr's down on a small host.
torznab_search now raises ProwlarrSearchError, and an empty list
strictly
means the indexer answered with no matches. The source records which
indexer searches failed: one dead indexer no longer sinks the others,
auto-expand runs only when every indexer genuinely answered, and zero
results with at least one failure raises SourceUnavailableError, which
the releases endpoint already turns into a 503 carrying a real message.
Prowlarr being unreachable was the same lie by another route -- the
indexer list came back empty, leaving nothing to query -- and now says
so.
Indexer searches also get their own timeout, PROWLARR_INDEXER_TIMEOUT,
defaulting to 90s and clamped to 5-300. Prowlarr's status and indexer
list keep 30s so Test Connection stays responsive, and the connect
timeout is split out at 10s so an unreachable Prowlarr fails fast rather
than hanging for the whole read budget. The overall per-request search
budget now scales to twice the indexer timeout, capped at 240s, so
raising the setting is not undone by the cap one level up while staying
under the 300s gunicorn worker timeout.
Grab. Prowlarr hands out a proxy download URL, with no magnetUrl and no
infoHash, for any indexer that only publishes torrent files. The native
Real-Debrid client built its magnet as "if not
url.startswith('magnet:') and expected_hash", so with no hash to work
from it left the URL alone and POSTed it to /torrents/addMagnet as the
magnet field. Real-Debrid answered 404 and the grab died on a raw HTTP
error. AllDebrid carried the same line and the same bug.
Both now resolve the URL first, through the extract_torrent_info path
the
torrent clients have used since #1108: pass a magnet through untouched,
follow a redirect or a response body that turns out to be a magnet,
otherwise upload the fetched .torrent, and fall back to a magnet built
from the infoHash only when the fetch failed. The file is preferred over
a synthesized urn:btih: magnet because it carries the tracker list; a
bare hash leaves the service to find the swarm on DHT alone. Fetches are
shared with the rest of the add path through the torrent fetch cache, so
resolving costs at most one request. Real-Debrid takes the file on PUT
/torrents/addTorrent with the raw bytes as the request body, AllDebrid
on
POST /magnet/upload/file as multipart files[]. A URL that resolves to
neither form now raises before any request reaches the service, so the
user reads why instead of a 404. Neither debrid client had any test
coverage; both have some now.
Fixes #1249
Fixes #1250
|
||
|
CaliBrain
|
5b3df2a463 |
docs(hardcover): list the API key scopes Shelfmark needs (#1243)
Hardcover's August 2026 token system replaced blanket access with per-token scopes, and nothing in the docs said which ones Shelfmark actually uses. A key missing write:library or write:lists still passes Test Connection -- the reading-status and auto-remove-on-download calls just fail silently afterwards. Verified against a live hc_pat_ key: every scope in the table backs a query or mutation the provider really issues, and the omitted ones (journal, goals, reviews, prompts, notifications, account) are absent from the provider entirely. Refs #1240v1.3.11 |
||
|
CaliBrain
|
5247ec6124 |
fix(bypass): close the gaps a helper that outlives its request opened (#1244)
assumptions the code around it still made were written for a helper that was killed after every request. A bypass that hits the child's deadline is cancelled from the calling thread, which returns the moment the cancellation is scheduled - so the helper went on to serve the next request while the abandoned one was still closing its browser, on the same loop, sharing the DISPLAY globals and one process group. The deadline now lives inside the loop, where asyncio.wait_for() waits for the unwind before it raises, with the calling thread keeping a bounded backstop in case the cleanup wedges too. Both budgets are set so the child still answers before the parent gives up on it. The helper's cookie store survived the request as well, and the whole of it is exported back to the parent on every answer - so clearance the parent had purged for one host came back the next time some other host was solved, the dead-cookie resurrection _redirect_loop_handoff purges to avoid. The child starts each request from an empty store again; the parent already runs the cached-cookie check against a superset of it. DNS config is compared against what the helper is actually resolving through rather than skipped whenever the parent reports "auto", so a user flipping CUSTOM_DNS back to auto - which applies live - reaches a warm helper instead of leaving it on an abandoned DoH resolver. The 15s exit grace is now asked only of a helper that can still read its stdin. One dropped mid-bypass never returns to that read, so the grace could only end in the kill - while a user cancelling a download, and every bypass queued behind them on LOCKED, waited it out. Result files are cleaned on the timeout and cancellation paths too, staging file included, rather than only when the answer was read. |
||
|
CaliBrain
|
bd21ec1257 |
fix(audiobookbay): search the ASCII punctuation ABB actually stores (#1242)
WordPress texturizes punctuation on output only, so a post stored as "The Stranger's Wife" renders as "The Stranger’s Wife". ABB's search matches the stored value and ANDs its terms, so one typographic character in the query empties the entire result set rather than merely ranking worse. Book metadata and mobile keyboards both hand us those characters. Map curly quotes, dashes and ellipses to ASCII before a query goes out, and on both sides of the relevance comparison, since scraped titles carry the rendered forms. Release titles are still stored and displayed exactly as ABB renders them; only matching normalizes. Also percent-encode the search query properly. The hand-rolled encoder only escaped double quotes and spaces, so a bare "&" started a new query parameter and silently truncated the search: "detective dan riley books 1 & 2 weatherley" reached ABB as "detective dan riley books 1" and returned six confident-looking results without the requested book among them. "%" and "+" were mangled too. |
||
  helgehelge123andhelgehelge123
|
7b9c416df8 |
perf(bypass): keep the helper subprocess alive between bypasses (#1222)
Every protected request spawns a fresh helper subprocess, paying interpreter start and imports before any work begins. Measured inside the container, five consecutive runs of `python -c "import shelfmark.bypass.internal_bypasser"`: ``` 3.53s 3.45s 3.55s 3.54s 3.46s ``` A single search issues several protected requests, so that is paid several times over per search. ## What changed The helper now serves one JSON request per line of stdin until the parent closes the pipe, and an idle timer (`BYPASS_BROWSER_IDLE_TIMEOUT`, default 180s) shuts it down once searching stops. Answers still travel by result file, but the file is now written to a `.part` path and renamed into place — the parent treats the file's existence as the answer, so it must never observe a half-written one. stdout and stderr stay attached to the parent's, so helper logs keep appearing in `docker logs` exactly as before. Failure handling, since a warm helper is exposed to more of it than a per-request one ever was: | Situation | Handling | | --- | --- | | Helper died between requests | Detected via `poll()`, respawned | | Pipe broken at write time (`poll()` can miss this) | One retry on a fresh process; a fresh one failing there is a real failure | | Helper exits without writing a result | `RuntimeError` naming the exit code | | Wedged past the timeout, or cancelled mid-bypass | Helper killed, then `_cleanup_orphan_processes` because a killed helper never got to close Chrome | | Idle reaper racing an arriving request | Re-checks the deadline under the lock and re-arms instead of killing a helper that just did work | The DNS config now travels with every request rather than only at spawn: a warm helper outlives changes the parent makes to its provider. ## `BYPASS_REUSE_BROWSER`, off by default This parks the CDP driver between bypasses. A driver's websockets are bound to the loop that opened them and cannot outlive their process, so the persistent helper is what makes this possible at all — and the warm path runs on `_CDP_WORKER`'s long-lived loop rather than `asyncio.run` for the same reason. The mechanism works. With it on, the browser start disappears from the second request onward: 0.7s from `Reusing warm Chrome browser` to the first bypass attempt, against roughly 16s cold. **It still ships off, because a matched-pair test shows it is a net loss against DDoS-Guard.** Each round primed with one cold bypass, waited 10s, then measured a second — identical timing in both arms, only the browser strategy differing, order balanced (fresh, warm, warm, fresh) so drift over the session cannot masquerade as an effect: | Arm | Measured request | | --- | --- | | fresh browser | 42.8s, 40.6s | | warm browser | 57.1s, 59.6s | Spread within each arm is 2.2s and 2.5s, against 16.7s between them. Reuse removes the ~15s browser start and then gives back roughly twice that in solving: a returning browser draws a harder challenge. Where the cold browser is through on the second bypass method, the warm one fails the first three and only `_bypass_method_humanlike` gets it, at ~30s for that method alone. Worth separating from a second effect I ran into while measuring: five back-to-back searches slow from ~32s to 51–98s with reuse **disabled** as well, so DDoS-Guard escalates on request rate independently of any of this. That is why the pairs above are timed identically rather than simply run in sequence. It is the larger of the two effects, but not something this project can patch around. Reuse is left available rather than dropped because Cloudflare sites may not respond the same way, and because the two concerns are independent: the helper start is pure overhead and always worth removing, the browser is not. ## Verification - 2559 unit tests pass (2542 before, 17 added in `tests/bypass/test_warm_browser.py`) - `ruff check`, `ruff format`, `basedpyright` over backend and tests, and `vulture` all clean - `docs/environment-variables.md` regenerated via `scripts/generate_env_docs.py` - Live against Anna's Archive on a warm helper: searches return their usual ~760KB and 667 results, the app's own search warm-up completes with 50 results, and the container is left with no orphan chrome/Xvfb/ffmpeg processes Happy to drop the `BYPASS_REUSE_BROWSER` half entirely if you would rather not carry a default-off path — the helper persistence stands on its own. Co-authored-by: helgehelge123 <helge.neumann@zollsoft.de> |
||
|
CaliBrain
|
646b531669 |
fix(hardcover): accept the short hc_pat_ keys Hardcover issues now (#1241)
Hardcover replaced its ~500 char JWTs with short opaque personal access
tokens ("hc_pat_..."), and the connection test rejected anything under
100 chars before a request ever left Shelfmark, so every newly created
key failed with "API key seems too short".
The length floor now applies only to keys without the hc_pat_ prefix; a
prefixed key goes straight to Hardcover, which is the authority on
whether it is valid. Also strip a pasted "bearer " prefix regardless of
casing -- Hardcover's docs tell users to paste the token into an
"authorization" header, so the prefix rides along on the copy, and the
old case-sensitive removeprefix() sent it through as part of the token.
The API key field now names the expected shape.
Note that Hardcover's PAT path currently answers every hc_pat_ token
with a 500, a fabricated one included, while non-PAT tokens still get a
clean 401. So a new key cannot connect yet regardless of this change --
that failure is server-side and not something this code can reach.
Refs #1240
|
||
 dependabot[bot]
|
eafb965662 |
build(deps): bump qbittorrent-api from 2026.8.0 to 2026.8.1 in the python-deps group (#1236)
Bumps the python-deps group with 1 update: [qbittorrent-api](https://github.com/rmartin16/qbittorrent-api). Updates `qbittorrent-api` from 2026.8.0 to 2026.8.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/rmartin16/qbittorrent-api/releases">qbittorrent-api's releases</a>.</em></p> <blockquote> <h2>release-2026.8.1</h2> <h2>What's Changed</h2> <h3>Features</h3> <ul> <li>feat: add missing <code>torrents/add</code> and <code>torrents/reannounce</code> parameters by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/656">rmartin16/qbittorrent-api#656</a></li> <li>feat: add endpoints shipped in qBittorrent v5.2.x by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/658">rmartin16/qbittorrent-api#658</a></li> </ul> <h3>Fixes</h3> <ul> <li>fix: accept and forward <code>**kwargs</code> on all API methods by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/655">rmartin16/qbittorrent-api#655</a></li> <li>fix: send <code>seedMode</code> for <code>is_skip_checking</code> on Web API v2.16.0 by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/654">rmartin16/qbittorrent-api#654</a></li> <li>docs: correct version annotations by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/657">rmartin16/qbittorrent-api#657</a></li> </ul> <h3>Chores</h3> <ul> <li>Bump cryptography from 48.0.1 to 50.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/652">rmartin16/qbittorrent-api#652</a></li> <li>retire codeql by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/660">rmartin16/qbittorrent-api#660</a></li> <li>remove xfail for previous python 3.15 issue by <a href="https://github.com/rmartin16"><code>@rmartin16</code></a> in <a href="https://redirect.github.com/rmartin16/qbittorrent-api/pull/638">rmartin16/qbittorrent-api#638</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/rmartin16/qbittorrent-api/compare/v2026.8.0...v2026.8.1">https://github.com/rmartin16/qbittorrent-api/compare/v2026.8.0...v2026.8.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/rmartin16/qbittorrent-api/blob/main/CHANGELOG.md">qbittorrent-api's changelog</a>.</em></p> <blockquote> <h3>v2026.8.1 (16 aug 2026)</h3> <ul> <li>Add support for <code>app/rotateAPIKey</code> and <code>app/deleteAPIKey</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add support for <code>torrents/SSLParameters</code> and <code>torrents/setSSLParameters</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add support for <code>torrents/fetchMetadata</code>, <code>torrents/parseMetadata</code>, and <code>torrents/saveMetadata</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add support for <code>torrents/pieceAvailability</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add support for <code>clientdata/load</code> and <code>clientdata/store</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li>Add <code>file_priorities</code> and <code>downloader</code> for <code>torrents/add</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/656">#656</a>)</li> <li>Add <code>urls</code> for <code>torrents/reannounce</code> (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/656">#656</a>)</li> <li>Fix <code>is_skip_checking</code> for <code>torrents/add</code> being ignored by qBittorrent v5.3.0 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/654">#654</a>)</li> <li>Fix missing <code>**kwargs</code> for several endpoints (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/655">#655</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/97e5f577df0bcfd4a7986c79e8d21e88ae8e64d0"><code>97e5f57</code></a> bump to v2026.8.1 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/661">#661</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/39e05d109dbb427b1e75a33fc96903ee22e3abd3"><code>39e05d1</code></a> remove xfail for previous python 3.15 issue (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/638">#638</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/0c067fdd356b3c2da0cdfbc1501c3badeb697e22"><code>0c067fd</code></a> feat: add endpoints shipped in qBittorrent v5.2.x (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/658">#658</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/64f65eacb62d33b54449ef413047779f6d766022"><code>64f65ea</code></a> fix: send seedMode for is_skip_checking on Web API v2.16.0 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/654">#654</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/f302ac473a66d3943878bf8491080f3ab800264e"><code>f302ac4</code></a> docs: correct version annotations (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/657">#657</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/cd9650277f572d26b1c2c09ff8e86a9917cfe435"><code>cd96502</code></a> feat: add missing torrents/add and torrents/reannounce parameters (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/656">#656</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/7ed08865b11e6f57c7ef0395e8d929c8842de340"><code>7ed0886</code></a> fix: accept and forward **kwargs on all API methods (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/655">#655</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/0b293e28356e74b3aead64ac3fd1e02e85d5de87"><code>0b293e2</code></a> retire codeql (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/660">#660</a>)</li> <li><a href="https://github.com/rmartin16/qbittorrent-api/commit/fd276e2d918c31d78528acc280fbbd36b354cf88"><code>fd276e2</code></a> Bump cryptography from 48.0.1 to 50.0.0 (<a href="https://redirect.github.com/rmartin16/qbittorrent-api/issues/652">#652</a>)</li> <li>See full diff in <a href="https://github.com/rmartin16/qbittorrent-api/compare/v2026.8.0...v2026.8.1">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
7193036626 |
fix(rtorrent): apply the audiobook label to audiobook downloads (#1239)
add_download() picks self._audiobook_label from a content_type kwarg, but the only call site never passed one, so is_audiobook was always False and every download got RTORRENT_LABEL. category does not fill the gap: _get_category_for_task() returns None for rTorrent, which has no category concept, leaving content_type as its only audiobook signal. Pass task.content_type through from base_handler, and match it with the shared is_audiobook() helper instead of == "audiobook". normalize_content_type() treats "book (audiobook)" as an audiobook, so the exact-string check would have mislabeled that value even once it arrived. The existing rTorrent tests passed content_type straight to the client, which is why nothing caught the missing wiring; the new handler test covers the call site itself. Post-processing was never affected: destination.py reads task.content_type directly, so files already landed in DESTINATION_AUDIOBOOK correctly. Fixes #1235 |
||
|
CaliBrain
|
12d554a92f |
fix(download): hand a 503 carrying a challenge to the bypasser (#1238)
503 is in RETRYABLE_CODES, and the bypasser is only ever reached from the 403 branch and the AA redirect-loop rescues. Once Z-Library re-serves its DDoS-Guard interstitial with the same cookie the #1188 handshake already echoed back, the request has nothing left to try and spends every attempt on the same wall. Gate the handoff on the response body rather than the status, so a genuine overloaded-origin 503 keeps its retry path, and on allow_bypasser_fallback, so best-effort fetches still fail fast. The challenge indicators move out of internal_bypasser into shelfmark/bypass/challenge.py so http.py can use them without importing SeleniumBase, which is lazily imported precisely because it is optional. Refs #1233 |
||
|
CaliBrain
|
fae6140c6a |
fix(bypass): scope browser cleanup to the calling session (#1232)
The orphan sweep ran a container-wide 'pkill -9 -f chrome|chromium|Xvfb|ffmpeg', so it also matched browsers another bypass was still driving. Scope it by process group: kill only our own group and groups whose leader has died. Spawn the helper with start_new_session so its browser tree is identifiable, tear the whole group down after every run (a timed-out helper used to leak its Chrome and Xvfb), and have an orphaned helper take its browser down with it. Fixes #1231.v1.3.10 |
||
|
dependabot[bot]
|
63133097e4 |
build(deps): update httpx[http2] requirement from >=0.27 to >=0.28.1 (#1227)
Updates the requirements on [httpx[http2]](https://github.com/encode/httpx) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/encode/httpx/releases">httpx[http2]'s releases</a>.</em></p> <blockquote> <h2>Version 0.28.1</h2> <h2>0.28.1 (6th December, 2024)</h2> <ul> <li>Fix SSL case where <code>verify=False</code> together with client side certificates.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/encode/httpx/blob/master/CHANGELOG.md">httpx[http2]'s changelog</a>.</em></p> <blockquote> <h2>0.28.1 (6th December, 2024)</h2> <ul> <li>Fix SSL case where <code>verify=False</code> together with client side certificates.</li> </ul> <h2>0.28.0 (28th November, 2024)</h2> <p>Be aware that the default <em>JSON request bodies now use a more compact representation</em>. This is generally considered a prefered style, tho may require updates to test suites.</p> <p>The 0.28 release includes a limited set of deprecations...</p> <p><strong>Deprecations</strong>:</p> <p>We are working towards a simplified SSL configuration API.</p> <p><em>For users of the standard <code>verify=True</code> or <code>verify=False</code> cases, or <code>verify=<ssl_context></code> case this should require no changes. The following cases have been deprecated...</em></p> <ul> <li>The <code>verify</code> argument as a string argument is now deprecated and will raise warnings.</li> <li>The <code>cert</code> argument is now deprecated and will raise warnings.</li> </ul> <p>Our revised <a href="https://github.com/encode/httpx/blob/master/docs/advanced/ssl.md">SSL documentation</a> covers how to implement the same behaviour with a more constrained API.</p> <p><strong>The following changes are also included</strong>:</p> <ul> <li>The deprecated <code>proxies</code> argument has now been removed.</li> <li>The deprecated <code>app</code> argument has now been removed.</li> <li>JSON request bodies use a compact representation. (<a href="https://redirect.github.com/encode/httpx/issues/3363">#3363</a>)</li> <li>Review URL percent escape sets, based on WHATWG spec. (<a href="https://redirect.github.com/encode/httpx/issues/3371">#3371</a>, <a href="https://redirect.github.com/encode/httpx/issues/3373">#3373</a>)</li> <li>Ensure <code>certifi</code> and <code>httpcore</code> are only imported if required. (<a href="https://redirect.github.com/encode/httpx/issues/3377">#3377</a>)</li> <li>Treat <code>socks5h</code> as a valid proxy scheme. (<a href="https://redirect.github.com/encode/httpx/issues/3178">#3178</a>)</li> <li>Cleanup <code>Request()</code> method signature in line with <code>client.request()</code> and <code>httpx.request()</code>. (<a href="https://redirect.github.com/encode/httpx/issues/3378">#3378</a>)</li> <li>Bugfix: When passing <code>params={}</code>, always strictly update rather than merge with an existing querystring. (<a href="https://redirect.github.com/encode/httpx/issues/3364">#3364</a>)</li> </ul> <h2>0.27.2 (27th August, 2024)</h2> <h3>Fixed</h3> <ul> <li>Reintroduced supposedly-private <code>URLTypes</code> shortcut. (<a href="https://redirect.github.com/encode/httpx/issues/2673">#2673</a>)</li> </ul> <h2>0.27.1 (27th August, 2024)</h2> <h3>Added</h3> <ul> <li>Support for <code>zstd</code> content decoding using the python <code>zstandard</code> package is added. Installable using <code>httpx[zstd]</code>. (<a href="https://redirect.github.com/encode/httpx/issues/3139">#3139</a>)</li> </ul> <h3>Fixed</h3> <ul> <li>Improved error messaging for <code>InvalidURL</code> exceptions. (<a href="https://redirect.github.com/encode/httpx/issues/3250">#3250</a>)</li> <li>Fix <code>app</code> type signature in <code>ASGITransport</code>. (<a href="https://redirect.github.com/encode/httpx/issues/3109">#3109</a>)</li> </ul> <h2>0.27.0 (21st February, 2024)</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/encode/httpx/commit/26d48e0634e6ee9cdc0533996db289ce4b430177"><code>26d48e0</code></a> Version 0.28.1 (<a href="https://redirect.github.com/encode/httpx/issues/3445">#3445</a>)</li> <li><a href="https://github.com/encode/httpx/commit/89599a9541af14bcf906fc4ed58ccbdf403802ba"><code>89599a9</code></a> Fix <code>verify=False</code>, <code>cert=...</code> case. (<a href="https://redirect.github.com/encode/httpx/issues/3442">#3442</a>)</li> <li><a href="https://github.com/encode/httpx/commit/8ecb86f0d74ffc52d4663214fae9526bee89358d"><code>8ecb86f</code></a> Add test for request params behavior changes (<a href="https://redirect.github.com/encode/httpx/issues/3364">#3364</a>) (<a href="https://redirect.github.com/encode/httpx/issues/3440">#3440</a>)</li> <li><a href="https://github.com/encode/httpx/commit/0cb7e5a2e736628e2f506d259fcf0d48cd2bde82"><code>0cb7e5a</code></a> Bump the python-packages group with 11 updates (<a href="https://redirect.github.com/encode/httpx/issues/3434">#3434</a>)</li> <li><a href="https://github.com/encode/httpx/commit/15e21e9ea3cad4f06e22a7e704aabefdf43d2e29"><code>15e21e9</code></a> Updating deprecated docstring Client() class (<a href="https://redirect.github.com/encode/httpx/issues/3426">#3426</a>)</li> <li><a href="https://github.com/encode/httpx/commit/80960fa31918d7663c3f4c3ad61661cf0e80628f"><code>80960fa</code></a> Version 0.28.0. (<a href="https://redirect.github.com/encode/httpx/issues/3419">#3419</a>)</li> <li><a href="https://github.com/encode/httpx/commit/a33c87852b8a0dddc65e5f739af1e0a6fca4b91f"><code>a33c878</code></a> Fix <code>extensions</code> type annotation. (<a href="https://redirect.github.com/encode/httpx/issues/3380">#3380</a>)</li> <li><a href="https://github.com/encode/httpx/commit/ce7e14da27abba6574be9b3ea7cd5990556a9343"><code>ce7e14d</code></a> Error on verify as str. (<a href="https://redirect.github.com/encode/httpx/issues/3418">#3418</a>)</li> <li><a href="https://github.com/encode/httpx/commit/47f4a96ffaaaa07dca1614409549b5d7a6e7af49"><code>47f4a96</code></a> Handle empty zstd responses (<a href="https://redirect.github.com/encode/httpx/issues/3412">#3412</a>)</li> <li><a href="https://github.com/encode/httpx/commit/189fc4bcbe5f314128775dec66a616ac9a31ad48"><code>189fc4b</code></a> Update CHANGELOG.md, fix typo(s) (<a href="https://redirect.github.com/encode/httpx/issues/3406">#3406</a>)</li> <li>Additional commits viewable in <a href="https://github.com/encode/httpx/compare/0.27.0...0.28.1">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
82aeee387e |
build(deps-dev): bump the python-deps group with 2 updates (#1226)
Bumps the python-deps group with 2 updates: [basedpyright](https://github.com/detachhead/basedpyright) and [ruff](https://github.com/astral-sh/ruff). Updates `basedpyright` from 1.39.9 to 1.39.10 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/detachhead/basedpyright/releases">basedpyright's releases</a>.</em></p> <blockquote> <h2>v1.39.10 (pyright 1.1.412)</h2> <h2>What's Changed</h2> <ul> <li>add <code>allowedUntypedLibraries</code> and <code>failOnWarnings</code> to <code>pyrightconfig.schema.json</code> by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1851">DetachHead/basedpyright#1851</a></li> <li>Update pycharm setup instructions by <a href="https://github.com/charliecloudberry"><code>@charliecloudberry</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1862">DetachHead/basedpyright#1862</a></li> <li>Merge 1.1.412 by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1869">DetachHead/basedpyright#1869</a></li> <li>fix redundant <code>workspace/configuration</code> request by <a href="https://github.com/DetachHead"><code>@DetachHead</code></a> in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1847">DetachHead/basedpyright#1847</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/vmphase"><code>@vmphase</code></a> made their first contribution in <a href="https://redirect.github.com/DetachHead/basedpyright/pull/1866">DetachHead/basedpyright#1866</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/DetachHead/basedpyright/compare/v1.39.9...v1.39.10">https://github.com/DetachHead/basedpyright/compare/v1.39.9...v1.39.10</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/DetachHead/basedpyright/commit/6d830bac284253dc6587d35eb026a9a30aee7771"><code>6d830ba</code></a> 1.39.10</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/a34496c27eb0805e4ac39976361526c92d6b3f59"><code>a34496c</code></a> fix redundant <code>workspace/configuration</code> request</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/b3074fe4dfa981a1928aebc4d9694ae4e5c03fc9"><code>b3074fe</code></a> fix links in tsp docs</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/979a3fc4d9a86c018a11aeebf17822c468b71ab2"><code>979a3fc</code></a> add <code>nodejs-wheel</code> back as a dev dependency</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/285225059bae1e3d41b7ff198d8f1d3e07b7141a"><code>2852250</code></a> ignore <code>mypy_primer/build</code> in bpr</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/5c4427f639c26a4917747ebd5d133ca425e807cc"><code>5c4427f</code></a> baseline type errors from new upstream python file</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/ae420b5e0cbcad508d93f603282c5e2614d58182"><code>ae420b5</code></a> try to fix primer</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/0e5c88e47a8ee57ab73b37702a72997976706405"><code>0e5c88e</code></a> fixes from merge</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/78adf4f989315b4821d30c3b79f0a0aa3732bb07"><code>78adf4f</code></a> don't support TSP</li> <li><a href="https://github.com/DetachHead/basedpyright/commit/eff463de301edaf268c816a2be618de4c40b6b62"><code>eff463d</code></a> Merge tag '1.1.412' into merge-1.1.412</li> <li>Additional commits viewable in <a href="https://github.com/detachhead/basedpyright/compare/v1.39.9...v1.39.10">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.2 to 0.16.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.3</h2> <h2>Release Notes</h2> <p>Released on 2026-08-13.</p> <h3>Preview features</h3> <ul> <li>[<code>pylint</code>] Fix false negatives on negative numbers (<code>PLR6104</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li> <li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with <code>while True</code> (<code>UP048</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bandit</code>] Also check keyword arguments (<code>S602</code>, <code>S603</code>, <code>S607</code>, <code>S609</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li> <li>[<code>pylint</code>] Allow <code>continue</code> in <code>finally</code> on Python 3.8 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li> <li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with bools (<a href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li> <li>[<code>pylint</code>] Fix false positives and negatives with <code>%b</code> format character (<code>PLE1300</code>, <code>PLE1307</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li> <li>[<code>pylint</code>] Improve handling of concatenated strings (<code>PLE1300</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>numpy</code>] Make <code>np.chararray</code> autofix backwards-compatible (<code>NPY201</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Enable PGO for Linux x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li> <li>Enable PGO for Linux ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li> <li>Enable PGO for Windows x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li> <li>Enable PGO for macOS ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li> <li>Reduce <code>Expr</code> size to 64 bytes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Hyperlink rule codes in <code>ruff check --statistics</code> output (<a href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code> (<code>RUF006</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Use mimalloc v3 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/Andrej730"><code>@Andrej730</code></a></li> <li><a href="https://github.com/alonfaraj"><code>@alonfaraj</code></a></li> <li><a href="https://github.com/romero-deshaw"><code>@romero-deshaw</code></a></li> <li><a href="https://github.com/Avasam"><code>@Avasam</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.3</h2> <p>Released on 2026-08-13.</p> <h3>Preview features</h3> <ul> <li>[<code>pylint</code>] Fix false negatives on negative numbers (<code>PLR6104</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27251">#27251</a>)</li> <li>[<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with <code>while True</code> (<code>UP048</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27190">#27190</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-bandit</code>] Also check keyword arguments (<code>S602</code>, <code>S603</code>, <code>S607</code>, <code>S609</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27687">#27687</a>)</li> <li>[<code>pylint</code>] Allow <code>continue</code> in <code>finally</code> on Python 3.8 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27626">#27626</a>)</li> <li>[<code>pylint</code>] Fix <code>PLE1307</code> false positive with bools (<a href="https://redirect.github.com/astral-sh/ruff/pull/27651">#27651</a>)</li> <li>[<code>pylint</code>] Fix false positives and negatives with <code>%b</code> format character (<code>PLE1300</code>, <code>PLE1307</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27560">#27560</a>)</li> <li>[<code>pylint</code>] Improve handling of concatenated strings (<code>PLE1300</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27659">#27659</a>)</li> </ul> <h3>Rule changes</h3> <ul> <li>[<code>numpy</code>] Make <code>np.chararray</code> autofix backwards-compatible (<code>NPY201</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27527">#27527</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Enable PGO for Linux x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27570">#27570</a>)</li> <li>Enable PGO for Linux ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27574">#27574</a>)</li> <li>Enable PGO for Windows x86-64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27573">#27573</a>)</li> <li>Enable PGO for macOS ARM64 Ruff releases (<a href="https://redirect.github.com/astral-sh/ruff/pull/27572">#27572</a>)</li> <li>Reduce <code>Expr</code> size to 64 bytes (<a href="https://redirect.github.com/astral-sh/ruff/pull/27591">#27591</a>)</li> </ul> <h3>CLI</h3> <ul> <li>Hyperlink rule codes in <code>ruff check --statistics</code> output (<a href="https://redirect.github.com/astral-sh/ruff/pull/27646">#27646</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>[<code>ruff</code>] Also suggest <code>asyncio.TaskGroup</code> (<code>RUF006</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27461">#27461</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Use mimalloc v3 (<a href="https://redirect.github.com/astral-sh/ruff/pull/27586">#27586</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/Andrej730"><code>@Andrej730</code></a></li> <li><a href="https://github.com/alonfaraj"><code>@alonfaraj</code></a></li> <li><a href="https://github.com/romero-deshaw"><code>@romero-deshaw</code></a></li> <li><a href="https://github.com/Avasam"><code>@Avasam</code></a></li> <li><a href="https://github.com/tjkuson"><code>@tjkuson</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/chirizxc"><code>@chirizxc</code></a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/b0e47022cfce4f3594aa26d15ea792681430b6f6"><code>b0e4702</code></a> Bump 0.16.3 (<a href="https://redirect.github.com/astral-sh/ruff/issues/27723">#27723</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/ecdd401fdbc5b0b22e18759c8bd25cda452e8b32"><code>ecdd401</code></a> [ty] Separate script and uv modules from project metadata (<a href="https://redirect.github.com/astral-sh/ruff/issues/27720">#27720</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/126352467217bebfa4cb86fd3c4d20820322d9e3"><code>1263524</code></a> [ty] Simplify display implementations with std::fmt::from_fn (<a href="https://redirect.github.com/astral-sh/ruff/issues/27718">#27718</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/59196baedf23c9876d1fcf1fa2ae78f80d306f94"><code>59196ba</code></a> [ty] Unify polarity-aware relation construction (<a href="https://redirect.github.com/astral-sh/ruff/issues/27707">#27707</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/b8c5e73abe5b15a74fb066e474d30397d1421cfe"><code>b8c5e73</code></a> [ty] Disable CodSpeed cycle estimation for instrumented benchmarks (<a href="https://redirect.github.com/astral-sh/ruff/issues/27706">#27706</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/2b0d21094e2a55491bff60c07fd6f8803876cae5"><code>2b0d210</code></a> [ty] Centralize matched argument relations (<a href="https://redirect.github.com/astral-sh/ruff/issues/27705">#27705</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/a9130f3381fe137626d22288c0d45f996541ca7e"><code>a9130f3</code></a> [<code>pyupgrade</code>] Add rule to replace <code>while 1</code> with <code>while True</code> (<code>while-one</code>, `...</li> <li><a href="https://github.com/astral-sh/ruff/commit/c64c7d6dad1e0a4966ce578b2c03af1e8e7673e1"><code>c64c7d6</code></a> [ty] Model try exception flow with operation checkpoints (<a href="https://redirect.github.com/astral-sh/ruff/issues/27471">#27471</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/9dea5ef180b3de748b5fe45787056716f235d11a"><code>9dea5ef</code></a> [ty] Avoid deriving sequents for typevars with concrete bounds (<a href="https://redirect.github.com/astral-sh/ruff/issues/27587">#27587</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/9798e88de673ec73051980ebd9aeb681161f3c27"><code>9798e88</code></a> [ty] Preserve enum exhaustiveness with custom <em>missing</em> methods (<a href="https://redirect.github.com/astral-sh/ruff/issues/27700">#27700</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.2...0.16.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
4cd1091d16 |
fix(hardcover): send the field count Hardcover's Book search requires (#1224)
Advanced title search, advanced title+author search, and the title typeahead returned zero results every time, and the sort fallback added in #1183 blamed the sort value for it. Hardcover turns the `fields` search parameter into Typesense's `query_by` but keeps `num_typos` and `query_by_weights` as fixed-length presets per query_type. For query_type=Book the preset expects exactly five fields, so a shorter list is not searched loosely - the whole search is rejected with a null results body. Confirmed against the live API: 1, 2, 3, 4 and 6 fields are all rejected, only 5 works, and weights must match one-for-one when sent. Every Book-type list we sent was the wrong length - the title typeahead and advanced title search sent 2, title+author sent 3. - Send BOOK_SEARCH_FIELDS (the full five) for every narrowed Book search and express the intent through weights instead. Weights only bias ranking - a field weighted 0 still matches - so a title search now ranks titles first rather than restricting to them. That is the closest behaviour Hardcover still allows, and there is no client-side filter to restore the old precision. - Pin the field and weight counts in tests, since the failure mode is a silent zero results rather than an error. The sort fallback from #1183 also misread these rejections: - Select the `error` field on every search and log Hardcover's own explanation. The reason is only ever in that sibling field, so a rejection surfaced as "returned no result body" with nothing to act on. Reading it is what made the field-count rule findable. - Drop `sort` entirely on the retry instead of sending an empty string. An empty sort is a value like any other and can be rejected too. - Arm the 900s sticky window only after the sortless retry succeeds. It was armed before the retry and never rolled back, so one rejected typeahead disabled sorting process-wide for 15 minutes whatever the actual cause. Verified against the live Hardcover API: advanced title search 0 -> 84 results, title+author 0 -> 139, title typeahead 0 -> 84 with the exact title top. 2566 unit tests pass; ruff, basedpyright and vulture clean. Refs #1183. The sort_by regression #1183 was written for is gone from Hardcover's side - every sort value it rejected, including the one in the report, is accepted again today. Two plain-search rejections in that report (fields=None) remain unexplained: they could not be reproduced under any per_page, page depth, sort value or query shape, and are most likely transient upstream. They now self-report the reason if they recur. |
||
|
CaliBrain
|
651096ed7b |
fix(bypass): reuse external bypasser clearance instead of re-solving (#1223)
Direct download was unusable behind an external bypasser (FlareSolverr /
Byparr): every request paid a 403 plus a full solve, and a search that
never ran was reported to the user as "No books found".
Clearance was discarded on the external path. get_cf_cookies_for_domain
and get_cf_user_agent_for_domain returned {} / None whenever
USING_EXTERNAL_BYPASSER was set, and _fetch_via_bypasser read only
solution.response - dropping solution.cookies and solution.userAgent,
which FlareSolverr-compatible services do return. A solve therefore
cleared the one request that paid for it and nothing else, and a file
download - which the solver cannot proxy, being binary - presented no
clearance at all. Diagnosed from a v1.3.9 debug bundle: ~35s in the
bypasser per search, on every search.
- Move the cookie jar out of internal_bypasser into bypass/cookie_store.
internal_bypasser imports seleniumbase at module scope, which is the
dependency an external-bypasser deployment is entitled not to have, so
it cannot host a store the external path depends on.
- Harvest solution.cookies and solution.userAgent after a successful
solve. The existing filtering applies unchanged, so the per-check
__ddg8_/__ddg9_/__ddg10_ trio is still dropped and the external path
cannot reintroduce the ?check=1 loop fixed in
|
||
|
CaliBrain
|
ebb833a82c |
fix(bypass): discard rejected DDoS-Guard cookies instead of replaying them (#1221)
A cookie that has been rejected was kept and presented again on every
later
request, so a single bad clearance could re-arm the challenge
indefinitely.
Cookie storage:
- Enforce expiry for every stored cookie, not just cf_clearance.
DDoS-Guard
domains have no cf_clearance, so the existing check never fired for them
and
expired cookies were replayed forever.
- Stop storing the per-check cookies __ddg8_/__ddg9_/__ddg10_ and
ddg_last_challenge. Captured live from Anna's Archive, these carry the
client
IP and the timestamp the check was issued (~40 min), versus ~1 year for
the
__ddg1_/__ddg2_/__ddgid_ clearance. Replaying an IP-bound token stops
describing the caller as soon as the egress IP changes, which is routine
behind a VPN.
Failure handling — every path that is rejected while carrying cookies
now
purges them, not just the redirect loop:
- 403 returned while presenting cookies.
- Cached-cookie attempt rejected, whether by status or by redirect loop.
- Factored the purge into _purge_clearance, guarded on a non-empty
hostname
since clear_cf_cookies("") means "every host" and would wipe clearance
for
sites that are working fine.
Also fix the search warm-up switches shipped inert in v1.3.8:
SEARCH_WARMUP_ENABLED and SEARCH_WARMUP_QUERY are not in the settings
registry, and config.get only consults the environment for keys it
knows, so
both always returned their defaults — the warm-up could not be turned
off or
retargeted. Read os.environ first.
Refs #1220. Deliberately not "Fixes": the reported failure could not be
reproduced on v1.3.8 from a stable IP (the reporter's own queries all
returned
200 on both the pre- and post-change builds), and the new purge paths
did not
fire in live testing because the failures arrive as redirect loops,
which were
already purged. These are correctness fixes with no measured effect on
that
issue. The underlying problem remains that Chrome-obtained cookies never
satisfy DDoS-Guard when replayed by requests, so every search still
re-solves.
Verified: 2542 unit tests pass; ruff, basedpyright and vulture clean;
e2e
platform baseline (10), full (6) and bypasser-external (5) all pass;
five
sequential live searches against Anna's Archive all returned 200 with
zero
"Exceeded 30 redirects".
v1.3.9
|
||
|
CaliBrain
|
b7093f4594 | Fix log to debug DNS (#1219) | ||
|
CaliBrain
|
b656f019be |
feat(download): add DoH wireformat support, mirror quarantine, and search warmup (#1218)
- Add RFC 8484 DNS wireformat codec and HTTP/2 support (httpx) for Quad9/OpenDNS DoH providers. - Quarantine dead, parked, or seized mirrors for the session on hard failure (DNS errors, connection refused, 410/451, parked pages) while preserving bypass clearance on live mirrors. - Add background startup search warmup to prime DNS, elect mirrors, and pre-solve protection challenges to eliminate cold-start search latency. - Add comprehensive test suites for DoH wireformat, mirror quarantine, parked domain detection, and search warmup.v1.3.8 |
||
|
CaliBrain
|
6e96ead519 | Fix frontend timeout search (#1217) | ||
|
CaliBrain
|
7345f6be1a | Fix README and hints for audiobooks (#1215) | ||
|
CaliBrain
|
2b8b35bb52 |
fix(newznab): make indexer book categories configurable (#1214)
Newznab searches hardcoded category 7000 for ebooks and 3030 for audiobooks, so indexers using custom IDs returned no results or the wrong ones. Add NEWZNAB_EBOOK_CATEGORIES and NEWZNAB_AUDIOBOOK_CATEGORIES (tag lists, defaulting to 7000 and 3030) and resolve the search categories from config. Values are parsed leniently — list or comma/whitespace separated, non-numeric entries skipped, duplicates dropped — and fall back to the standard IDs when empty, so a cleared field can't silently widen the search to every category. NEWZNAB_AUTO_EXPAND remains the way to do that on purpose. Results carrying a custom ID outside the standard 7000-7999 / 3030 ranges were typed as "other", which routed custom-category audiobooks as ebooks. Trust the searched content type when a result carries a category we explicitly asked for. Also drop the unused NEWZNAB_BOOKS / NEWZNAB_AUDIOBOOKS constants from api.py — a third copy of the same hardcoding. Closes #1208 |
||
 FlozeandCaliBrain
|
58a5b5ed27 |
fix: sync renamed CWA usernames safely (#1203)
## Summary - sync an existing CWA-backed user's username when CWA renames it - keep username collisions safe by assigning a stable `__cwa` alias instead of overwriting a local account - allow username updates through `UserDB` and cover rename/collision/repeat-sync behavior Fixes #1197. ## Testing - `uv run ruff check shelfmark tests` - `uv run ruff format --check shelfmark tests` - `uv run vulture shelfmark` - `uv run pytest tests/core/test_cwa_user_sync.py tests/core/test_user_db.py tests/core/test_admin_users_api.py tests/core/test_auth_api.py -k "cwa or update_user"` (36 passed) - `uv run pytest tests/ -x --tb=short -m "not integration and not e2e" --ignore=tests/config/test_entrypoint_permissions.py -q` (2445 passed, 5 skipped) The entrypoint permission tests were excluded locally because macOS ships Bash 3.2, which does not support the `${1,,}` expansion used by `entrypoint.sh`; the same failure reproduces on an unchanged checkout. `make python-typecheck` also currently reports the existing `settings.py:147` callback return-type mismatch on the unchanged base. Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
 Sujeito OperatorandCaliBrain
|
52c1702419 |
docker: mount uv at build time instead of copying it into every image (#1200)
### What this PR does
`uv` stops being copied into the image and starts being mounted into the
three `RUN`s that
actually use it. The digest pin stays in exactly one place — it moves
from the `COPY` to a
stage declaration:
```dockerfile
FROM ghcr.io/astral-sh/uv:0.11.3@sha256:90bbb3c... AS uv
```
```dockerfile
RUN --mount=type=cache,target=/root/.cache/uv \
--mount=from=uv,source=/uv,target=/usr/local/bin/uv \
uv sync --locked --no-default-groups
```
A stage consumed only through `--mount=from=` contributes no layer to
anything published, so
`uv` never lands in `base`. The two `RUN rm -f /usr/bin/uv /usr/bin/uvx`
lines then have nothing
left to delete and go with it.
### Why
The `base` stage copies uv in, and both final stages try to take it back
out:
```dockerfile
# uv is only needed while building the image.
RUN rm -f /usr/bin/uv /usr/bin/uvx
```
That intent is exactly right. **The mechanism can't carry it out**: a
`RUN` adds a layer, it
does not rewrite the layer underneath. The `COPY` layer is still pushed
and still pulled by
everyone. What the `rm` produces is a whiteout on top of it.
### Measured, not assumed
Read off the published images over the registry API — `linux/amd64`,
both built
`2026-08-13T17:53Z`, pinned by digest so these numbers stay reproducible
after tonight's
scheduled rebuild:
```
ghcr.io/calibrain/shelfmark@sha256:9b6041f797cbcc1e5c50ab42bd010a8f747dfaac926080cb6269ddfae99cf820
layer COPY /uv /uvx /bin/ 24.3 MB of 585 MB total 4.1% of the pull
layer RUN rm -f /usr/bin/uv /usr/bin/uvx 159 B
ghcr.io/calibrain/shelfmark-lite@sha256:2eae503d791cef685e10135aaaff77077cfb4a31d6911e31216704988ce28b02
layer COPY /uv /uvx /bin/ 24.3 MB of 221 MB total 11.0% of the pull
```
The `rm` layer unpacks to exactly four tar entries:
```
usr/
usr/bin/
usr/bin/.wh.uv 0 bytes
usr/bin/.wh.uvx 0 bytes
```
Two zero-length overlayfs whiteouts. That is the deletion behaving
exactly as specified — and
removing nothing at all from what anyone downloads.
Same thing without the registry API:
```
$ docker manifest inspect ghcr.io/calibrain/shelfmark-lite:latest
```
and look for the ~24 MB layer; or `docker history` on a local build.
### To be clear about what the `rm` does and doesn't do
**It is not useless and I'm not claiming it is.** It removes `uv` from
the flattened filesystem,
which is what the container sees at runtime and what Trivy/Grype scan by
default — so the
"don't ship a stale installer" half of the intent is already working
today, the same way the
`pip` removal above it does. This PR is about the other half: the bytes.
After it, `uv` is
absent from the filesystem *and* absent from the layers, so nothing
regresses.
This is image size, not a vulnerability, and I would not have opened it
as anything else.
### Why this is safe
- **Nothing at runtime can depend on `uv` or `uvx` today**, and that is
read off your own
artifact rather than argued: both are already whiteouted out of both
published images. `uvx`
is never invoked anywhere in the repo — `entrypoint.sh` has no `uv` in
it, and the Makefile's
`uv run` lines are the host-side dev workflow, outside the image.
- `/usr/local/bin` is already on `PATH` in `python:3.14.7-slim`, and
your `ENV PATH=/app/.venv/bin:$PATH`
prepends rather than replaces, so `uv` resolves the same way it does
now.
- The pin does not move. Same image, same `sha256`, same resolution per
target platform as
`COPY --from=<image>` does today, so the `linux/amd64` and `linux/arm64`
builds each keep
getting their own `uv`.
- `RUN --mount=` is already used three times in this file, so the
frontend in use supports
mounts; `from=` is part of the same feature.
- Your `docker-build-check` job builds `shelfmark-lite` on every PR, so
a build is the cheapest
possible review of this change. As a first-time contributor my workflow
runs sit at
`action_required` until someone approves them — approving is enough to
check the whole claim.
### Notes for reviewers
- I have **not** built these images locally. There is no Docker daemon
on the machine I run on.
Every figure above is read from the published images over the registry
API, and my own
selftest re-reads them live on each run rather than trusting a note.
- I left the `pip` removal in `base` alone. It has the same shape, but
its stated goal — keeping
a stale installer out of what scanners see — is genuinely achieved by
the flattened
filesystem, and `pip` arrives in the `python:slim` base layer where a
Dockerfile change can't
reach it anyway.
- Written by an automated agent; saying so plainly seemed better than
not.
Signed-off-by: Sujeito Operator <operator@sujeito.org>
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
|
||
 
|
3e2a7a48d5 |
fix: clear the DDoS-Guard cookie probe on AA search (#1209)
## Summary Two failure modes on the same code path, both reported this week: Anna's Archive `/search` is gated behind a DDoS-Guard cookie probe that the manual redirect follower can never satisfy. **#1202 — the cookie is dropped on every hop.** AA URLs set `allow_redirects = False`, so `html_get_page` follows redirects by hand. The 302 to `?check=1` carries a `Set-Cookie` (`__ddg*`) that has to come back on the next request. Because cookies are passed per call and `requests` keeps no jar across manual hops, it was discarded each time and the server just re-issued the same redirect until `_MAX_REDIRECTS` raised `TooManyRedirects`. The file already had the right helper — `_new_cookies()` — but only the 503 Z-Library handshake branch called it. **#1204 — the loop never reaches the bypasser.** `TooManyRedirects` isn't in `_is_retryable_error` and carries no status code, so the 403 rescue path (`status == _HTTP_STATUS_FORBIDDEN`) never fired and all attempts repeated the identical failure — ~2.5 min, surfacing as the misleading "Network restricted or mirrors are blocked". These interact, which is why #1202's fix alone isn't enough. Requests merge as `cookies={**handshake_cookies, **cookies}`, so **stale bypasser cookies override the fresh handshake ones** — once `_cf_cookies` holds an expired `__ddg*`, the probe can never clear no matter how faithfully we echo. Hence one search per restart, exactly as #1204 describes. ## Changes 1. Harvest cookies in the same-host redirect branch, the way the 503 branch already does. `_new_cookies()` returns only *new* values, so a server re-sending an identical cookie yields an empty dict and a genuine redirect loop still terminates at `_MAX_REDIRECTS`. 2. Treat a redirect loop as a detected challenge: purge the stored cookies for that host and switch to the bypasser, instead of burning the retry budget. Gated on `allow_bypasser_fallback` and `_is_cf_bypass_enabled()`, and skipped when already bypassing, so AudiobookBay (`allow_bypasser_fallback=False`) and external-bypasser setups are unaffected. The broader point in #1204 stands — the fallback would be better gated on "challenge detected" than on specific status codes, since DDoS-Guard presents at least three faces (403 js-challenge, 429, and this redirect loop). This PR fixes the two live exits without that refactor. ## Tests Two regression tests, both failing before and passing after: - `test_html_get_page_echoes_cookies_across_same_host_redirects` — the fake server only returns results if `__ddg2_` comes back on the `?check=1` hop. - `test_html_get_page_redirect_loop_purges_cookies_and_bypasses` — asserts the stored cookies are cleared, the bypasser runs, and the loop is cut short rather than repeated per attempt. `ruff check` and `ruff format` clean. `tests/download/` passes except `test_download_url_ignores_zlib_cookie_refresh_failure`, which fails identically on unmodified `main` in my environment (no `seleniumbase` — the `browser` extra isn't installed). ## Verification Applied on a live v1.3.7 install (Debian LXC, internal CDP bypasser). Before: every search timed out through 10 retries with `TooManyRedirects`, zero results. After: ``` http.py:455 - Redirect loop detected; switching to bypasser internal_bypasser.py:756 - Bypass successful using _bypass_method_cdp_gui_click internal_bypasser.py:322 - Extracted 9 protection cookies for annas-archive.pk direct_download.py:1865 - Found 24 releases via ISBN ``` ~25 s per search, results render. Note the second search still re-solves the challenge, since the freshly stored cookies go stale immediately — the design issue #1204 raises, left for the broader fix. Fixes #1202 Fixes #1204 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012Ln3yVj3sWHG2c6T78W1we --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
dependabot[bot]
|
a178541561 |
Bump the python-deps group with 3 updates (#1205)
Bumps the python-deps group with 3 updates: [gevent](https://github.com/gevent/gevent), [seleniumbase](https://github.com/seleniumbase/SeleniumBase) and [prek](https://github.com/j178/prek). Updates `gevent` from 26.7.0 to 26.8.0 <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gevent/gevent/commit/4f684105f537eeceb9988adbfe81420a1f28d9a0"><code>4f68410</code></a> Preparing release 26.8.0</li> <li><a href="https://github.com/gevent/gevent/commit/10489c56d3b03caae5be00bc46996a0180ab3d8c"><code>10489c5</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2199">#2199</a> from florentinl/florentin.labelle/fix/hubless-thread...</li> <li><a href="https://github.com/gevent/gevent/commit/d4f5f098c5d6655e9700336ed6f15e924a7fd142"><code>d4f5f09</code></a> Document the args[0] cross-thread wakeup mechanism</li> <li><a href="https://github.com/gevent/gevent/commit/9b049915e8e308e4286f922fd51baf9d92187a88"><code>9b04991</code></a> Run test_cross_thread_callback_can_run_before_scheduling_returns on all backends</li> <li><a href="https://github.com/gevent/gevent/commit/ce7996d7048d3555be2869cc6172d47e332efb58"><code>ce7996d</code></a> Address review comments: document cross-thread race, drop unneeded cpdef</li> <li><a href="https://github.com/gevent/gevent/commit/5288a6eec90ca63f9658b44d67f14fbdfe07259d"><code>5288a6e</code></a> Add missing <a href="https://github.com/ignores"><code>@ignores</code></a>_leakcheck to new cross-thread test</li> <li><a href="https://github.com/gevent/gevent/commit/c72eda095d99e82ca0c767afe56baecbc4c131a2"><code>c72eda0</code></a> Fix cross-thread notifier scheduling race</li> <li><a href="https://github.com/gevent/gevent/commit/908b93730ffef5cee0594e4482b3a43b476c43a4"><code>908b937</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2195">#2195</a> from ddorian/fix-popen-exit-reentrant-close</li> <li><a href="https://github.com/gevent/gevent/commit/b58795f8a659e767b0317cd199d68f273b742167"><code>b58795f</code></a> Merge pull request <a href="https://redirect.github.com/gevent/gevent/issues/2191">#2191</a> from ddorian/fix-1865-global-shutdown-lock</li> <li><a href="https://github.com/gevent/gevent/commit/ede2e71a859198b96a22f4c683fa210e750406e6"><code>ede2e71</code></a> Always use 'versionchanged:: NEXT' to let the release machinery fill in the c...</li> <li>Additional commits viewable in <a href="https://github.com/gevent/gevent/compare/26.7.0...26.8.0">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.51.11 to 4.51.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.51.12 - CDP Mode: Patch 128</h2> <h2>CDP Mode: Patch 128</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/2322c11a532a43a00f7224bb02aba30f677457f5">Perform no-op on duplicate quit() calls to avoid coroutine warnings</a> --> This resolves <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4458">seleniumbase/SeleniumBase#4458</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/117c9994dce50e134746580f3f73f62ed22449b2">Refresh Python dependencies</a> --> <code>setuptools</code> and <code>platformdirs</code></li> </ul> <h2>What's Changed</h2> <ul> <li>CDP Mode: Patch 128 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4459">seleniumbase/SeleniumBase#4459</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.51.11...v4.51.12">https://github.com/seleniumbase/SeleniumBase/compare/v4.51.11...v4.51.12</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/2b54219498fdda1a6c689be543f7777ed6c125a4"><code>2b54219</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4459">#4459</a> from seleniumbase/cdp-mode-patch-128</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/6774cef0999b82c3b22dcd5a5a896a6299e8a69b"><code>6774cef</code></a> Version 4.51.12</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/117c9994dce50e134746580f3f73f62ed22449b2"><code>117c999</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/2322c11a532a43a00f7224bb02aba30f677457f5"><code>2322c11</code></a> Perform no-op on duplicate quit() calls to avoid coroutine warnings</li> <li>See full diff in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.51.11...v4.51.12">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.4.12 to 0.4.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.4.13</h2> <h2>Release Notes</h2> <p>Released on 2026-08-10.</p> <h3>Highlights</h3> <h4>Manage hook tools with mise</h4> <p>The new <code>language: mise</code> support lets hooks install tools using <a href="https://mise.jdx.dev/"><code>mise</code></a> in an isolated environment:</p> <pre lang="yaml"><code>repos: - repo: local hooks: - id: golangci-lint name: golangci-lint language: mise additional_dependencies: ["aqua:golangci/golangci-lint@2"] entry: golangci-lint run --fast-only ./... pass_filenames: false </code></pre> <h4>Run commands in hook environments</h4> <p>The new <code>prek exec</code> subcommand can run an explicit command in a configured hook's prepared environment. For example, the hook above makes its managed binary available to this command:</p> <pre lang="console"><code>$ prek exec golangci-lint -- golangci-lint --version </code></pre> <h3>Enhancements</h3> <ul> <li>Add <code>mise</code> language support (<a href="https://redirect.github.com/j178/prek/pull/2540">#2540</a>)</li> <li>Add <code>deny-filename-pattern</code> and <code>require-filename-pattern</code> hooks (<a href="https://redirect.github.com/j178/prek/pull/2488">#2488</a>)</li> <li>Add <code>prek exec</code> for running commands in a hook environment (<a href="https://redirect.github.com/j178/prek/pull/2478">#2478</a>)</li> <li>Add <code>yaml-language-server:</code> comment to YAML sample config (<a href="https://redirect.github.com/j178/prek/pull/2486">#2486</a>)</li> <li>Make <code>prek cache size</code> output terminal-aware (<a href="https://redirect.github.com/j178/prek/pull/2508">#2508</a>)</li> <li>Match file regexes against path bytes (<a href="https://redirect.github.com/j178/prek/pull/2541">#2541</a>)</li> <li>Show hook aliases in run output (<a href="https://redirect.github.com/j178/prek/pull/2497">#2497</a>)</li> <li>Show hook descriptions in run output (<a href="https://redirect.github.com/j178/prek/pull/2490">#2490</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid env cache scans for skipped hooks (<a href="https://redirect.github.com/j178/prek/pull/2502">#2502</a>)</li> <li>Cache Node version queries (<a href="https://redirect.github.com/j178/prek/pull/2500">#2500</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/master/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.4.13</h2> <p>Released on 2026-08-10.</p> <h3>Highlights</h3> <h4>Manage hook tools with mise</h4> <p>The new <code>language: mise</code> support lets hooks install tools using <a href="https://mise.jdx.dev/"><code>mise</code></a> in an isolated environment:</p> <pre lang="yaml"><code>repos: - repo: local hooks: - id: golangci-lint name: golangci-lint language: mise additional_dependencies: ["aqua:golangci/golangci-lint@2"] entry: golangci-lint run --fast-only ./... pass_filenames: false </code></pre> <h4>Run commands in hook environments</h4> <p>The new <code>prek exec</code> subcommand can run an explicit command in a configured hook's prepared environment. For example, the hook above makes its managed binary available to this command:</p> <pre lang="console"><code>$ prek exec golangci-lint -- golangci-lint --version </code></pre> <h3>Enhancements</h3> <ul> <li>Add <code>mise</code> language support (<a href="https://redirect.github.com/j178/prek/pull/2540">#2540</a>)</li> <li>Add <code>deny-filename-pattern</code> and <code>require-filename-pattern</code> hooks (<a href="https://redirect.github.com/j178/prek/pull/2488">#2488</a>)</li> <li>Add <code>prek exec</code> for running commands in a hook environment (<a href="https://redirect.github.com/j178/prek/pull/2478">#2478</a>)</li> <li>Add <code>yaml-language-server:</code> comment to YAML sample config (<a href="https://redirect.github.com/j178/prek/pull/2486">#2486</a>)</li> <li>Make <code>prek cache size</code> output terminal-aware (<a href="https://redirect.github.com/j178/prek/pull/2508">#2508</a>)</li> <li>Match file regexes against path bytes (<a href="https://redirect.github.com/j178/prek/pull/2541">#2541</a>)</li> <li>Show hook aliases in run output (<a href="https://redirect.github.com/j178/prek/pull/2497">#2497</a>)</li> <li>Show hook descriptions in run output (<a href="https://redirect.github.com/j178/prek/pull/2490">#2490</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid env cache scans for skipped hooks (<a href="https://redirect.github.com/j178/prek/pull/2502">#2502</a>)</li> <li>Cache Node version queries (<a href="https://redirect.github.com/j178/prek/pull/2500">#2500</a>)</li> </ul> <h3>Bug fixes</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/6204a68bc591773d8a796e1b6c9898cd35aa520d"><code>6204a68</code></a> Bump version to 0.4.13 (<a href="https://redirect.github.com/j178/prek/issues/2543">#2543</a>)</li> <li><a href="https://github.com/j178/prek/commit/f1c73c5f1780b1d3931d372016c2f9b244be1126"><code>f1c73c5</code></a> Add mise language support (<a href="https://redirect.github.com/j178/prek/issues/2540">#2540</a>)</li> <li><a href="https://github.com/j178/prek/commit/3f08ed41fb440af8cc9430cda729f6f41a497c2d"><code>3f08ed4</code></a> Match file regexes against path bytes (<a href="https://redirect.github.com/j178/prek/issues/2541">#2541</a>)</li> <li><a href="https://github.com/j178/prek/commit/6bc5f06f1f090ecf034109ce5b8cc5c773b096d2"><code>6bc5f06</code></a> Update Rust crate serde-saphyr to v1 (<a href="https://redirect.github.com/j178/prek/issues/2539">#2539</a>)</li> <li><a href="https://github.com/j178/prek/commit/b8c5c69ea3452a77ebc2711ed3b2b8ad011f4791"><code>b8c5c69</code></a> Update Rust crate fancy-regex to 0.19.0 (<a href="https://redirect.github.com/j178/prek/issues/2537">#2537</a>)</li> <li><a href="https://github.com/j178/prek/commit/2557af921bf5ed6a919385dc18e0177c05530c71"><code>2557af9</code></a> Update prek hooks (<a href="https://redirect.github.com/j178/prek/issues/2528">#2528</a>)</li> <li><a href="https://github.com/j178/prek/commit/a9587311bc8aa8bf13de7d5d612b93e00f248500"><code>a958731</code></a> Update Rust crate http to v1.5.0 (<a href="https://redirect.github.com/j178/prek/issues/2538">#2538</a>)</li> <li><a href="https://github.com/j178/prek/commit/fc8b9a45288e005291e1945792543da7a44a2f3a"><code>fc8b9a4</code></a> Update Rust crate clap to v4.6.5 (<a href="https://redirect.github.com/j178/prek/issues/2531">#2531</a>)</li> <li><a href="https://github.com/j178/prek/commit/3bacaa18ad0b0ea67b15e7ea35d4175ad213bd86"><code>3bacaa1</code></a> Update dependency uv to v0.12.1 (<a href="https://redirect.github.com/j178/prek/issues/2536">#2536</a>)</li> <li><a href="https://github.com/j178/prek/commit/222fc00edd3fb3b3b4443ea54bacc1e868e6e6a7"><code>222fc00</code></a> Update Rust crate toml to v1.1.4 (<a href="https://redirect.github.com/j178/prek/issues/2535">#2535</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.4.12...v0.4.13">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
78e1f4daba |
Bump python from 83c1ceb to ce40764 (#1206)
Bumps python from `83c1ceb` to `ce40764`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
eeea92280c |
Bump the npm-deps group in /src/frontend with 3 updates (#1207)
Bumps the npm-deps group in /src/frontend with 3 updates: [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip), [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) and [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint). Updates `knip` from 6.32.0 to 6.32.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpro-nl/knip/releases">knip's releases</a>.</em></p> <blockquote> <h2>Release 6.32.1</h2> <ul> <li>Handle referenced config files in their own plugin (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1931">#1931</a>, close <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1932">#1932</a>) (982c1d8e28cc62d3cba5ecde6dd8df2740c7c329)</li> <li>Fix type-check against typescript@5.0.4 (2febefe44a8b39f74158916a2bc73933b4c281ae)</li> <li>Update sentry snapshot (0397bddbf809e2b24fe59a4bea8c0258526bb565)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpro-nl/knip/commit/437b608ebc1e098506deb60842c6ce079ff6164e"><code>437b608</code></a> Release knip@6.32.1</li> <li><a href="https://github.com/webpro-nl/knip/commit/2febefe44a8b39f74158916a2bc73933b4c281ae"><code>2febefe</code></a> Fix type-check against typescript@5.0.4</li> <li><a href="https://github.com/webpro-nl/knip/commit/982c1d8e28cc62d3cba5ecde6dd8df2740c7c329"><code>982c1d8</code></a> Handle referenced config files in their own plugin (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1931">#1931</a>, close <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1932">#1932</a>)</li> <li>See full diff in <a href="https://github.com/webpro-nl/knip/commits/knip@6.32.1/packages/knip">compare view</a></li> </ul> </details> <br /> Updates `oxfmt` from 0.62.0 to 0.63.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md">oxfmt's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <p>All notable changes to this package will be documented in this file.</p> <p>The format is based on <a href="https://keepachangelog.com/en/1.0.0">Keep a Changelog</a>.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a> release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25473">#25473</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/00f490d7f72d43ec88b1afe28de153e376caf8ed"><code>00f490d</code></a> refactor(oxfmt,formatter): split <code>sortImports</code> validation and use type enum (...</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.63.0/npm/oxfmt">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.77.0 to 1.78.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's changelog</a>.</em></p> <blockquote> <h2>[1.78.0] - 2026-08-10</h2> <h3>🚀 Features</h3> <ul> <li>ccb8fe8 linter/jsdoc: Implement <code>no-blank-blocks</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>) (Mikhail Baev)</li> <li>d4a897c linter/eslint: Implement <code>one-var</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>) (Cole Ellison)</li> <li>5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>) (Cole Ellison)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>9573937 linter/typescript: Validate <code>ban-ts-comment</code> description_format (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>) (Mikhail Baev)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/c42d6397eab5b2d5bb2bd6746c57bc2a9cad21bd"><code>c42d639</code></a> release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25473">#25473</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/ccb8fe89db08123ff2b86d7fb2f39d0dd6c33df7"><code>ccb8fe8</code></a> feat(linter/jsdoc): implement <code>no-blank-blocks</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25207">#25207</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/9573937df3cc01f29e1c65bc018ce378ec947e0e"><code>9573937</code></a> fix(linter/typescript): validate <code>ban-ts-comment</code> description_format (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25320">#25320</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/d4a897ce2290bf853720b4fbf371304bfea2c980"><code>d4a897c</code></a> feat(linter/eslint): implement <code>one-var</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24470">#24470</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/5ab9340637eff80539bca89a494e162e94569358"><code>5ab9340</code></a> feat(linter/jsx-a11y/anchor-has-content): add options to match eslint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/24571">#24571</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.78.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
0a5256ecbb |
fix(download): reconcile the two AA redirect-loop rescues (#1213)
#1210 and #1212 both added a DDoS-Guard `?check=1` rescue, and #1212 was branched before #1210 landed, so the merged result had two of them with identical guards. #1212's inline handoff returns before the raise that #1210's exception handler keys on, so the handler was shadowed and its stale-cookie purge — the substance of #1210 — never ran. Its regression test has been failing on main since the merge. Fold both into one path: - `_redirect_loop_handoff()` purges the host's stale clearance cookies, then bypasses, so the inline AA handoff and the exception handler cannot drift apart again. - The exception handler keeps its own reason to exist: non-AA hosts run with allow_redirects=True, so `requests` raises the loop itself and the manual AA follower never sees it. It now invokes the bypasser directly rather than setting a flag and continuing, which was a no-op at MAX_RETRY=1 for the same reason the 403 handoff was. - An unrescuable loop returns empty instead of raising TooManyRedirects into the retry path. That error is not retryable and carries no status, so `/dyn/md5/summary` (allow_bypasser_fallback=False) re-ran the full 6-redirect loop on all 10 attempts: 60 requests to AA and ~30s of backoff, measured. Every AA mirror shares the challenge, so there is nothing to rotate to. - `allow_bypasser_fallback` docs now describe what the flag actually gates; the old text predated #1198 and named the wrong callers. |
||
  David YoungandD
|
6d2af0ac28 |
fix(download): hand AA challenges to the bypasser immediately (#1212)
## Problem
Two defects in `html_get_page`, either of which is enough to make an
Anna's Archive search fail *without the bypasser ever running*. Found
while chasing why AA search returned nothing on v1.3.7 even with
`USE_CF_BYPASS` on and a working bypasser.
### 1. An AA redirect loop is treated as a network fault
AA serves its DDoS-Guard handshake as a same-host redirect loop:
`/search?…` redirects to `/search?…&check=1`, which redirects back,
indefinitely. The manual redirect follower counts those against
`_MAX_REDIRECTS` and raises `TooManyRedirects`:
```python
redirects_followed += 1
if redirects_followed > _MAX_REDIRECTS:
_raise_too_many_redirects(f"Too many redirects for {current_url}")
```
That lands in the retry path, so every one of the `MAX_RETRY` attempts
re-runs the same 6-redirect loop and the URL is never offered to the
bypasser — which is the only thing that can clear the challenge. With
the default `MAX_RETRY=10` that's ~60 requests to AA per search, all of
which can only fail:
```
Retry 5/10 for https://annas-archive.pk/search?…&check=1: TooManyRedirects
Retry 6/10 for https://annas-archive.pk/search?…&check=1: TooManyRedirects
…
Giving up after 10 attempts: https://annas-archive.pk/search?…&check=1
```
Surfaced to the user as `Unable to reach download source. Network
restricted or mirrors are blocked.`
### 2. Both bypasser handoffs are a no-op at `MAX_RETRY=1`
The existing 403 handoff — and the new redirect one — set a flag and
`continue`:
```python
logger.info("403 detected; switching to bypasser: %s", current_url)
use_bypasser_now = True
continue
```
The branch that acts on `use_bypasser_now` sits at the top of the
**next** retry attempt. With `MAX_RETRY=1` there is no next attempt, so
a 403 simply ends the search and the bypasser never runs. `MAX_RETRY` is
user-configurable down to 1, so this is reachable in normal use.
The redirect handoff had an additional problem: it sits inside the inner
redirect `while`, so a `continue` there re-enters *that* loop rather
than reaching the retry branch at all.
## Change
Both handoffs now invoke the bypasser directly, through a shared
`_run_bypasser()` closure extracted from the existing branch body. No
behaviour change to the bypass itself — same grace handling, same error
reporting, same `finally`.
The redirect handoff also honours `allow_bypasser_fallback`, for the
same reason the 403 path does: callers such as the `/dyn/md5/summary/…`
fetch behind the details modal pass `False` precisely so a best-effort
request fails fast instead of holding the UI open for a minutes-long
browser solve.
## Result
Measured against `/api/releases` for the same book, internal bypasser,
default `MAX_RETRY`:
| | searches returning results |
|---|---|
| before | 4 / 9 |
| after | 3 / 3, then 7 / 7 |
Zero `TooManyRedirects` give-ups after, and the new path is visible in
the logs:
```
redirect loop on https://annas-archive.gl/search?…&check=1; switching to bypasser
Bypass successful using _bypass_method_cdp_gui_click
```
The request volume drop is the other half of the win — a failing search
no longer emits ~60 requests to AA before giving up.
## Notes
- Only `shelfmark/download/http.py` changes; no config or API surface.
- `use_bypasser_now` is still set before each direct call, so the guard
against double-invocation is unchanged.
- Tested with the internal bypasser (seleniumbase). The
external-bypasser path goes through the same `get_bypassed_page()` call
and is unaffected by the control-flow change, though I have not measured
it against DDoS-Guard specifically — in my testing
FlareSolverr-compatible solvers do not clear that challenge regardless.
Co-authored-by: D <d@e>
|
||
  Zoltán SzabóandKukkerem
|
056ddd372a |
Send DDoS-Guard's ?check=1 redirect loop to the bypasser (#1210)
Fixes #1204. ## Problem #1198 sends a gated AA `/search` to the bypasser when the origin answers 403. DDoS-Guard has a second response: when the clearance cookies from an earlier solve go stale, it serves an endless `?check=1` redirect instead. `requests` follows that until `_raise_too_many_redirects`, and `TooManyRedirects` carries no status code, so `status == _HTTP_STATUS_FORBIDDEN` is false and the rescue never runs. All 10 retries re-send the same dead cookies, then the search fails as `Unable to reach download source. Network restricted or mirrors are blocked.` Direct-download search therefore works once per container start, and stays dead after the stored cookie ages out. v1.3.7 (`sha256:520715f3…`), internal bypasser, mirrors `.gl/.pk/.gd`: ``` 17:04:36 internal_bypasser.py:756 - Bypass successful using _bypass_method_cdp_gui_click ... 17:11:39 http.py:483 - Retry 1/10 for https://annas-archive.gl/search?...&check=1: TooManyRedirects: Too many redirects 17:12:12 http.py:493 - Giving up after 10 attempts 17:12:12 main.py:2870 - Release search failed for source direct_download: Unable to reach download source. Network restricted or mirrors are blocked. ``` The token is short-lived, which is what makes this reachable in normal use: ``` $ curl -sD - 'https://annas-archive.gl/search?...&check=1' HTTP/2 403 server: ddos-guard set-cookie: __ddg8_=…; Expires=Fri, 14-Aug-2026 15:39:38 GMT # issued 15:19:38, 20 min ``` ## Fix Handle the loop like the 403: drop the domain's stored cookies, then retry through the bypasser. The branch sits above the `status ==` ladder because `_get_status_code()` returns `None` for this exception. Cookies are purged only for the internal bypasser; with an external one `get_cf_cookies_for_domain()` already returns `{}`. Related but not changed here: `get_cf_cookies_for_domain()` enforces expiry for `cf_clearance` only, so `__ddg*` cookies are never evicted on age, which is why they go stale. This patch makes the rescue fire whatever the reason the cookies stopped working. ## Verification The regression test drives a real redirect loop through `html_get_page` (302 to `&check=1`, exception raised by the production path rather than faked) and asserts the cookies are purged and the bypasser runs once. - `pytest tests/download/test_http_bypasser_fallbacks.py`: 8 passed. `test_download_url_ignores_zlib_cookie_refresh_failure` fails in my checkout on a missing `seleniumbase`, unrelated to this change. - `ruff check`, `ruff format --check`: clean. - Running in production since 2026-08-14 on v1.3.7 with only this file replaced: six direct-download searches, five served, three books downloaded end to end, against one search per container start before. The rescue mid-download: ``` 19:12:14 http.py:449 - Redirect loop detected; switching to bypasser: https://annas-archive.gl/md5/cb8fba7abae800ddbae1adfb8d7699d9?&check=1 19:12:38 internal_bypasser.py:756 - Bypass successful using _bypass_method_cdp_gui_click 19:14:36 direct_download.py:1142 - Resolved download URL [aa-slow-nowait]: … 19:14:47 orchestrator.py:735 - download finished; starting post-processing ``` ## Separate issue this exposes DDoS-Guard does not accept a solved cookie from plain `requests` traffic, so after this patch the rescue runs for nearly every AA URL. `internal_bypasser.get()` serializes all solves on one module-wide lock and builds a fresh Chrome each time: 11-16 s uncontended, 43-52 s under concurrent load, measured on the host above. Correctness is cheap here, latency is not. Happy to open a separate PR for a warm browser session if that direction is welcome. Co-authored-by: Kukkerem <Kukkerem@users.noreply.github.com> |
||
|
CaliBrain
|
d0e008adde |
Stop dropping audiobook releases that are not m4b or mp3 (#1199)
An IRC audiobook search returned nothing while OpenBooks, reading the same @search answer from the same channel, listed results. Three separate defects were discarding them. The audiobook format list was maintained by hand in four places and had drifted. The settings UI offered only m4b/mp3/m4a/zip/rar, and that list is the only one a user's config can be built from, so flac, opus, ogg, aac, wav and wma were unreachable everywhere — even though the IRC parser recognized them, the IRC sorter ranked them (dead code that could never fire), archive extraction knew them and Prowlarr searched for them. A FLAC audiobook was invisible in search and, if it arrived anyway, rejected after download as "format not supported". AUDIOBOOK_FORMATS and ARCHIVE_FORMATS now live once in core.utils and every layer derives from them, which also restored the missing .opus in the post-download scan's trackable extensions. Widening the default alone would not have reached anyone already affected: initialize_default_configs() writes field defaults only when a tab has no config file yet, so an existing install keeps its persisted m4b/mp3 list forever. migrate_audiobook_formats rewrites a list that still matches the old default exactly and leaves every other value alone — re-enabling formats someone had deliberately turned off would be worse than leaving them narrow. The IRC parser filtered by file extension alone. Multi-file audiobooks ship as a .rar or .zip of MP3s, which matched neither SUPPORTED_FORMATS nor SUPPORTED_AUDIOBOOK_FORMATS, so they fell out of the ebook bucket and the audiobook bucket both. Results are now classified before the format filter is applied: an audio extension means audiobook, an ebook extension means ebook, and for a container — where the extension says nothing about the contents — the release name decides. An ebook archive stays out of audiobook results. RESULT_LINE_REGEX matched \w+ after any dot, so a line carrying no file extension parsed as format "5mb" out of "::INFO:: 620.5MB", taking the title and the size down with it and guaranteeing every downstream filter dropped it. Any decimal size did this. The extension is now matched against the known formats, so such a line falls through to the simple pattern and comes back as "unknown", which the rest of the parser already handles. ALL_RECOGNIZED_FORMATS became an ordered tuple in the process: it was a set, so which extension won for a line naming two of them depended on set iteration order and could vary between restarts. Refs #1129v1.3.7 |
||
|
CaliBrain
|
03e219eb43 |
Let the bypasser solve bot challenges on Anna's Archive search (#1198)
Anna's Archive put a DDoS-Guard JS challenge in front of /search: the homepage still returns 200, but /search and /md5/<id> answer 403 on every mirror (.gl, .pk, .gd all confirmed). Search fetched both with allow_bypasser_fallback=False, which rotates mirrors on a 403 instead of invoking the bypasser, so it walked the whole mirror list, exhausted it, and surfaced "Unable to reach download source. Network restricted or mirrors are blocked." as a 503 on every query. Adding mirrors could not help — they sit behind the same gate — and neither could USE_CF_BYPASS, since search never reached that branch. Fetch search and the detail page with allow_bypasser_fallback=True so a 403 hands over to the bypasser, which already detects this challenge (DDOS_GUARD_INDICATORS matches the live page). Echoing the __ddg cookies back does not clear it; it needs real JS execution. The download-count fetch keeps allow_bypasser_fallback=False: it is decoration on the details modal and not worth holding the modal open for a browser solve. Fixes #1196 |
||
|
dependabot[bot]
|
0e8608c427 |
Bump transmission-rpc from 7.0.11 to 7.0.12 in the python-deps group (#1195)
Bumps the python-deps group with 1 update: [transmission-rpc](https://github.com/Trim21/transmission-rpc). Updates `transmission-rpc` from 7.0.11 to 7.0.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Trim21/transmission-rpc/releases">transmission-rpc's releases</a>.</em></p> <blockquote> <h2>v7.0.12</h2> <h3>✨ New Features</h3> <ul> <li><a href="https://github.com/trim21/transmission-rpc/commit/849cc3b9a357f903242915301fcd190d5ae932a3"><code>849cc3b</code></a> - add v8 migration deprecations <em>(commit by <a href="https://github.com/trim21"><code>@trim21</code></a>)</em></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/trim21/transmission-rpc/commit/d05e9c6c2953d7f334b46df600af4b47d9ea65f5"><code>d05e9c6</code></a> bump: 7.0.12</li> <li><a href="https://github.com/trim21/transmission-rpc/commit/2800e6f0a0a64c31f44935e5122cb7ad3d581dfd"><code>2800e6f</code></a> ci: pin pyproject schema validation</li> <li><a href="https://github.com/trim21/transmission-rpc/commit/1bc5f0d51888f526ada2026409b00228287d2fc8"><code>1bc5f0d</code></a> ci: run workflows on 7.x</li> <li><a href="https://github.com/trim21/transmission-rpc/commit/849cc3b9a357f903242915301fcd190d5ae932a3"><code>849cc3b</code></a> feat: add v8 migration deprecations</li> <li>See full diff in <a href="https://github.com/Trim21/transmission-rpc/compare/v7.0.11...v7.0.12">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>v1.3.6 |
||
|
dependabot[bot]
|
7f770f54fa |
Bump python from 3.14.6-slim to 3.14.7-slim (#1190)
Bumps python from 3.14.6-slim to 3.14.7-slim. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
0eb8b78dc7 |
Bump the npm-deps group in /src/frontend with 3 updates (#1191)
Bumps the npm-deps group in /src/frontend with 3 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite). Updates `@types/node` from 26.1.2 to 26.2.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node">compare view</a></li> </ul> </details> <br /> Updates `knip` from 6.31.0 to 6.32.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpro-nl/knip/releases">knip's releases</a>.</em></p> <blockquote> <h2>Release 6.32.0</h2> <ul> <li>fix: attribute wildcard subpath-import aliases as dependency usage (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1918">#1918</a>) (4890a2ad5317b9e3f0ab844631ad0f0592802c3e) - thanks <a href="https://github.com/jsmecham"><code>@jsmecham</code></a>!</li> <li>Add Borp plugin (5eb9ad4cfb2ccb7770eac49f6109459d30590211)</li> <li>Add tsd plugin (bd4ae7041f3fc6aef27b027644f80daefc432aca)</li> <li>Resolve Rollup --config argument as plugin configuration (8111f97981406f4327d5e6a655c13308a9dc4426)</li> <li>Resolve babel-jest configFile from Jest transform options (24794ccecb80fdaecfe4d46a26faff46c30d9015)</li> <li>Add pre-commit plugin (ac726b0918cb931a6d538797e342484812a6752e)</li> <li>Thread script words through resolvers to preserve quoting (89f9ada6ca81229bf8f7293439998acc5f87d457)</li> <li>Resolve entries from Mocha script arguments (353f860f8e32f05f7c87dc5501071befc0e5a293)</li> <li>Detect Node test runner through c8 (fa44be722aa35c6e8b441cd8cd0f4cf644027c22)</li> <li>Update dependencies (non-major) (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1922">#1922</a>) (6b1e6f3cbb1749776e3798f46eb2b99cd95ed56a) - thanks <a href="https://github.com/renovate"><code>@renovate</code></a>[bot]!</li> <li>fix(playwright): match config files with .cjs, .cts and .mts extensions (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1919">#1919</a>) (1c1073a1817fdb3bcd3dc00eda2b1d858e444156) - thanks <a href="https://github.com/davidpavlovschi"><code>@davidpavlovschi</code></a>!</li> <li>Restart VS Code language server process (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1923">#1923</a>) (d48eac5a2447567a33e835ce3e1648bf3f4ffb2b)</li> <li>Classify built-ins from module specifiers (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1925">#1925</a>) (3528c5d0f808b7b2155f69a1f98493ee0e3e06c1)</li> <li>Don't turn absolute-path script tokens into entries (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1928">#1928</a>) (e5608e77b434145c8dd5c2c2872bfb90ae622ce7)</li> <li>Update sponsors data (025884bb53eede041732723197ac0415a1a50f71)</li> <li>Update dependencies (d2c0a07c09cea70ab2cae5f97d12da272a6e43e6)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpro-nl/knip/commit/f21bcbb653377682dd690fb99b0f02977ac524d2"><code>f21bcbb</code></a> Release knip@6.32.0</li> <li><a href="https://github.com/webpro-nl/knip/commit/d2c0a07c09cea70ab2cae5f97d12da272a6e43e6"><code>d2c0a07</code></a> Update dependencies</li> <li><a href="https://github.com/webpro-nl/knip/commit/e5608e77b434145c8dd5c2c2872bfb90ae622ce7"><code>e5608e7</code></a> Don't turn absolute-path script tokens into entries (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1928">#1928</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/3528c5d0f808b7b2155f69a1f98493ee0e3e06c1"><code>3528c5d</code></a> Classify built-ins from module specifiers (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1925">#1925</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/1c1073a1817fdb3bcd3dc00eda2b1d858e444156"><code>1c1073a</code></a> fix(playwright): match config files with .cjs, .cts and .mts extensions (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1919">#1919</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/fa44be722aa35c6e8b441cd8cd0f4cf644027c22"><code>fa44be7</code></a> Detect Node test runner through c8</li> <li><a href="https://github.com/webpro-nl/knip/commit/353f860f8e32f05f7c87dc5501071befc0e5a293"><code>353f860</code></a> Resolve entries from Mocha script arguments</li> <li><a href="https://github.com/webpro-nl/knip/commit/89f9ada6ca81229bf8f7293439998acc5f87d457"><code>89f9ada</code></a> Thread script words through resolvers to preserve quoting</li> <li><a href="https://github.com/webpro-nl/knip/commit/ac726b0918cb931a6d538797e342484812a6752e"><code>ac726b0</code></a> Add pre-commit plugin</li> <li><a href="https://github.com/webpro-nl/knip/commit/24794ccecb80fdaecfe4d46a26faff46c30d9015"><code>24794cc</code></a> Resolve babel-jest configFile from Jest transform options</li> <li>Additional commits viewable in <a href="https://github.com/webpro-nl/knip/commits/knip@6.32.0/packages/knip">compare view</a></li> </ul> </details> <br /> Updates `vite` from 8.2.0 to 8.2.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>plugin-legacy@8.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.1/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.1</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.1/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><!-- raw HTML omitted --><a href="https://github.com/vitejs/vite/compare/v8.2.0...v8.2.1">8.2.1</a> (2026-08-06)<!-- raw HTML omitted --></h2> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> make client chunkImportMap work with <code>sharedPlugins: true</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23184">#23184</a>) (<a href="https://github.com/vitejs/vite/commit/15f03073c915d6ffb9a1fda447ef66b02bf5cde8">15f0307</a>)</li> <li><strong>bundled-dev:</strong> inject client script tag before chunk scripts (<a href="https://redirect.github.com/vitejs/vite/issues/23161">#23161</a>) (<a href="https://github.com/vitejs/vite/commit/eac0cc84aa2472a85a19ee84561c1ba71e381a55">eac0cc8</a>)</li> <li><strong>css:</strong> don't re-run lightningcss visitor during minify (fix <a href="https://redirect.github.com/vitejs/vite/issues/23146">#23146</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/23147">#23147</a>) (<a href="https://github.com/vitejs/vite/commit/de041a79b05a0be965c874592fe2c1505bcd48df">de041a7</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23136">#23136</a>) (<a href="https://github.com/vitejs/vite/commit/14454fd8c9a399bc3fdc193e28465b6fcf001e4d">14454fd</a>)</li> <li><strong>deps:</strong> update rolldown-related dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23070">#23070</a>) (<a href="https://github.com/vitejs/vite/commit/7ac6f7f590747bbdab9958e2c016e3dd04f10542">7ac6f7f</a>)</li> <li>don't mutate the user config when resolving the lib entry from the top-level <code>input</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23135">#23135</a>) (<a href="https://github.com/vitejs/vite/commit/b4bf59686a7ac238929e91a6e1708c739b843a2f">b4bf596</a>)</li> <li>handle shebang ending with uncommon line terminators (<a href="https://redirect.github.com/vitejs/vite/issues/23038">#23038</a>) (<a href="https://github.com/vitejs/vite/commit/17f7b2f193a110d0b47742ad296d182cb4666ce7">17f7b2f</a>)</li> <li><strong>server:</strong> use a random port when port is 0 (<a href="https://redirect.github.com/vitejs/vite/issues/23158">#23158</a>) (<a href="https://github.com/vitejs/vite/commit/fddf4ea41de5f7889037a2f957438857ac12a260">fddf4ea</a>)</li> </ul> <h3>Performance Improvements</h3> <ul> <li><strong>css:</strong> look up pure CSS chunks through a Set (<a href="https://redirect.github.com/vitejs/vite/issues/23114">#23114</a>) (<a href="https://github.com/vitejs/vite/commit/1331b0b438b1e7193effb7d2341660bccb9c3155">1331b0b</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>build:</strong> fix incomplete <code>@default</code> for build.minify (<a href="https://redirect.github.com/vitejs/vite/issues/23177">#23177</a>) (<a href="https://github.com/vitejs/vite/commit/ef02435114c57d0422028f0e6987f3df8db72969">ef02435</a>)</li> </ul> <h3>Miscellaneous Chores</h3> <ul> <li><strong>deps:</strong> update dependency rolldown-plugin-dts to ^0.28.0 (<a href="https://redirect.github.com/vitejs/vite/issues/23137">#23137</a>) (<a href="https://github.com/vitejs/vite/commit/4adc1e7931d4beceb4e236d9a271d057c858a06f">4adc1e7</a>)</li> <li><strong>deps:</strong> update dependency strip-literal to v4 (<a href="https://redirect.github.com/vitejs/vite/issues/23140">#23140</a>) (<a href="https://github.com/vitejs/vite/commit/9db65ce63488ea8f08a3c98dcdc4282b17bd33ff">9db65ce</a>)</li> </ul> <h3>Code Refactoring</h3> <ul> <li><strong>bundled-dev:</strong> avoid injecting server values in the bundle (<a href="https://redirect.github.com/vitejs/vite/issues/22967">#22967</a>) (<a href="https://github.com/vitejs/vite/commit/23b8a088dec9dcc3f1c1353f2074f8644b3cc21f">23b8a08</a>)</li> <li><strong>bundled-dev:</strong> remove rolldown lazy stub module workaround (<a href="https://redirect.github.com/vitejs/vite/issues/23129">#23129</a>) (<a href="https://github.com/vitejs/vite/commit/e72036eed2e28936ed824971b18aeaa3900857f6">e72036e</a>)</li> </ul> <h3>Tests</h3> <ul> <li><strong>bundled-dev:</strong> enable sourcemap playgrounds (<a href="https://redirect.github.com/vitejs/vite/issues/23080">#23080</a>) (<a href="https://github.com/vitejs/vite/commit/c2155fe4d5c8d25fba3a7366d367e3296ae669fa">c2155fe</a>)</li> <li>reduce logs (<a href="https://redirect.github.com/vitejs/vite/issues/23138">#23138</a>) (<a href="https://github.com/vitejs/vite/commit/7673c02e53343ae9356c1f496c1c1da2eb732ac1">7673c02</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/421615865dad3ed39137d17281814fc78a41246c"><code>4216158</code></a> release: v8.2.1</li> <li><a href="https://github.com/vitejs/vite/commit/fddf4ea41de5f7889037a2f957438857ac12a260"><code>fddf4ea</code></a> fix(server): use a random port when port is 0 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23158">#23158</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/de041a79b05a0be965c874592fe2c1505bcd48df"><code>de041a7</code></a> fix(css): don't re-run lightningcss visitor during minify (fix <a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23146">#23146</a>) (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23147">#23147</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/15f03073c915d6ffb9a1fda447ef66b02bf5cde8"><code>15f0307</code></a> fix(build): make client chunkImportMap work with <code>sharedPlugins: true</code> (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23184">#23184</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/c2155fe4d5c8d25fba3a7366d367e3296ae669fa"><code>c2155fe</code></a> test(bundled-dev): enable sourcemap playgrounds (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23080">#23080</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/ef02435114c57d0422028f0e6987f3df8db72969"><code>ef02435</code></a> docs(build): fix incomplete <code>@default</code> for build.minify (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23177">#23177</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/eac0cc84aa2472a85a19ee84561c1ba71e381a55"><code>eac0cc8</code></a> fix(bundled-dev): inject client script tag before chunk scripts (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23161">#23161</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/23b8a088dec9dcc3f1c1353f2074f8644b3cc21f"><code>23b8a08</code></a> refactor(bundled-dev): avoid injecting server values in the bundle (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/22967">#22967</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/e72036eed2e28936ed824971b18aeaa3900857f6"><code>e72036e</code></a> refactor(bundled-dev): remove rolldown lazy stub module workaround (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23129">#23129</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/14454fd8c9a399bc3fdc193e28465b6fcf001e4d"><code>14454fd</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/23136">#23136</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/v8.2.1/packages/vite">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
eb98b6a816 |
Bump the gh-actions group with 2 updates (#1192)
Bumps the gh-actions group with 2 updates: [actions/attest-build-provenance](https://github.com/actions/attest-build-provenance) and [dorny/paths-filter](https://github.com/dorny/paths-filter). Updates `actions/attest-build-provenance` from 4.1.1 to 4.2.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/attest-build-provenance/releases">actions/attest-build-provenance's releases</a>.</em></p> <blockquote> <h2>v4.2.2</h2> <blockquote> <p>[!NOTE] As of version 4, <code>actions/attest-build-provenance</code> is simply a wrapper on top of <a href="https://github.com/actions/attest"><code>actions/attest</code></a>.</p> <p>Existing applications may continue to use the <code>attest-build-provenance</code> action, but new implementations should use <code>actions/attest</code> instead.</p> </blockquote> <h2>What's Changed</h2> <ul> <li>Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/attest-build-provenance/pull/862">actions/attest-build-provenance#862</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2">https://github.com/actions/attest-build-provenance/compare/v4.1.1...v4.2.2</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/attest-build-provenance/commit/4d101475d8b20a2381f78447822ac1eab6504dd8"><code>4d10147</code></a> Bump actions/attest from 4.2.0 to 4.2.1 in the actions-minor group (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/862">#862</a>)</li> <li><a href="https://github.com/actions/attest-build-provenance/commit/e3fe62ef559997059fe8380e7d2b4c909e2d65f4"><code>e3fe62e</code></a> Bump the actions-minor group with 2 updates (<a href="https://redirect.github.com/actions/attest-build-provenance/issues/860">#860</a>)</li> <li>See full diff in <a href="https://github.com/actions/attest-build-provenance/compare/0f67c3f4856b2e3261c31976d6725780e5e4c373...4d101475d8b20a2381f78447822ac1eab6504dd8">compare view</a></li> </ul> </details> <br /> Updates `dorny/paths-filter` from 4.0.2 to 4.0.3 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/releases">dorny/paths-filter's releases</a>.</em></p> <blockquote> <h2>v4.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update Outputs in readme to account for the 'every' predicate-quantifier by <a href="https://github.com/hintron"><code>@hintron</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li>fix: scope base-ignored warning to API path by <a href="https://github.com/saschabratton"><code>@saschabratton</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/319">dorny/paths-filter#319</a></li> <li>docs: add contents permission to PR example by <a href="https://github.com/134130"><code>@134130</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li>feat: add 'some-with-excludes' predicate quantifier by <a href="https://github.com/arxeiss"><code>@arxeiss</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> <li>Document safe handling of file list outputs in workflows by <a href="https://github.com/dorny"><code>@dorny</code></a> in <a href="https://redirect.github.com/dorny/paths-filter/pull/326">dorny/paths-filter#326</a></li> </ul> <h2>Security</h2> <ul> <li>Escape multi-line filenames in list-files shell and csv output] by <a href="https://github.com/ken-matsui"><code>@ken-matsui</code></a> and <a href="https://github.com/tjswlsgg"><code>@tjswlsgg</code></a> in <a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">https://github.com/advisories/GHSA-7hc6-8hq5-9q2m</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/hintron"><code>@hintron</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/247">dorny/paths-filter#247</a></li> <li><a href="https://github.com/134130"><code>@134130</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/248">dorny/paths-filter#248</a></li> <li><a href="https://github.com/arxeiss"><code>@arxeiss</code></a> made their first contribution in <a href="https://redirect.github.com/dorny/paths-filter/pull/322">dorny/paths-filter#322</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/dorny/paths-filter/compare/v4...v4.0.3">https://github.com/dorny/paths-filter/compare/v4...v4.0.3</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/dorny/paths-filter/blob/master/CHANGELOG.md">dorny/paths-filter's changelog</a>.</em></p> <blockquote> <h2>v4.0.3</h2> <ul> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/326">Document safe handling of file list outputs in workflows</a></li> <li><a href="https://github.com/advisories/GHSA-7hc6-8hq5-9q2m">Escape multi-line filenames in list-files shell and csv output</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/322">Add 'some-with-excludes' predicate quantifier</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/248">Add contents permission to PR example</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/319">Scope base-ignored warning to API path</a></li> <li><a href="https://redirect.github.com/dorny/paths-filter/pull/247">Update outputs in readme to account for the 'every' predicate-quantifier</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/dorny/paths-filter/commit/ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d"><code>ceb8a2b</code></a> Update CHANGELOG.md for v4.0.3 and v3.0.4 (<a href="https://redirect.github.com/dorny/paths-filter/issues/327">#327</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/ef09b88f3eacdbec6ce135a7c9a193a6849545c1"><code>ef09b88</code></a> Document safe handling of file list outputs in workflows (<a href="https://redirect.github.com/dorny/paths-filter/issues/326">#326</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/44adc5b06dc135dba334efce9bf3cf0624512d2d"><code>44adc5b</code></a> Merge commit from fork</li> <li><a href="https://github.com/dorny/paths-filter/commit/4711b7a31b4aa89103d8c6ffab2e3b8e7b6381c7"><code>4711b7a</code></a> feat: add 'some-with-excludes' predicate quantifier (<a href="https://redirect.github.com/dorny/paths-filter/issues/322">#322</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/93c889f9e58fca66f35a0c83d8673ac7e88bb70a"><code>93c889f</code></a> fix: escape multi-line filenames in list-files shell and csv output</li> <li><a href="https://github.com/dorny/paths-filter/commit/b41dfa943b1939b9b646f67753bfe35cf6e4de03"><code>b41dfa9</code></a> docs: add contents permission to PR example (<a href="https://redirect.github.com/dorny/paths-filter/issues/248">#248</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/9af6e5a9d010d1ae8ec570390b3d793e2b70a402"><code>9af6e5a</code></a> fix: scope base-ignored warning to API path (<a href="https://redirect.github.com/dorny/paths-filter/issues/319">#319</a>)</li> <li><a href="https://github.com/dorny/paths-filter/commit/cae9006b65a1a53044b518c68e13e835c54948a7"><code>cae9006</code></a> docs: update outputs in readme to account for the 'every' predicate-quantifie...</li> <li>See full diff in <a href="https://github.com/dorny/paths-filter/compare/v4.0.2...v4.0.3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
29ce83e274 |
Stop dependabot proposing Python pre-releases, bound the e2e health wait (#1189)
PR #1169 (python:3.14.6-slim -> python:3.15.0b3-slim) ran for 6h before GitHub's max job limit killed it, then did it again on re-run. Two independent defects. Dependabot proposed a beta at all: the config already excluded python from the docker digest group for dependabot-core#9496, but the comment claimed ungrouped python updates get their pre-release filtered. They don't. dependabot-core#13815 rewrote the Docker pre-release heuristic to catch PEP 440 tags (its tests cover 3.15.0a2 and 3.5.0b3), yet the suffixed real tag still got through seven months later. CPython spells pre-releases without a separator, so 3.15.0b3 parses as an ordinary version sorting above 3.14.6. Ignore python semver-minor/major instead of trusting the heuristic; patch and digest updates still flow. The run took hours rather than failing: the health wait looked bounded at 60 iterations x 2s, but bare `curl` has no timeout. The 3.15 image booted a container that bound 8084 without ever serving (greenlet has no 3.15 wheel, so the gevent gunicorn worker was wedged), so curl blocked on read forever and the loop never reached iteration 2. Every job's orphan process at cancellation was that curl. Bound each probe and switch to a wall-clock deadline, and add timeout-minutes so a hang can never reach 6h again. Verified against a socket that accepts and never responds: the old loop was still hung at 30s, the new one exits at 120s with HEALTHY=0 into the existing log-dump path, and a responsive endpoint is still detected immediately. |
||
|
CaliBrain
|
e320b7623d |
Fix LOG_LEVEL being ignored and Z-Library 503 cookie gate (#1188)
LOG_LEVEL never reached the app logger: env.py hardcoded the level to DEBUG or INFO, so INFO lines kept appearing under LOG_LEVEL=error. Read it from the env var and advanced settings, normalize unknown values to INFO, and expose it as a setting. entrypoint.sh now normalizes gunicorn's level too, so a typo falls back to info instead of stopping the container from booting. Z-Library gates the first hit on /md5/<hash> with a 503 whose only payload is a Set-Cookie; echoing that cookie back returns the 302 to the real page. html_get_page dropped it and re-ran the same rejected request on every retry, ending in "No download URL resolved". Retry once with the cookies the 503 issued. Fixes #1185 Fixes #1187 |
||
|
CaliBrain
|
bb848f05bc |
fix/bypass stall watchdog (#1186)
- Fix protection bypass cancelled by stall detection at exactly 300s - make fixes - Try to fix Synology DELETE issues |
||
|
CaliBrain
|
cc1a95f965 |
Fix protection bypass cancelled by stall detection at exactly 300s (#1184)
A download that hits Cloudflare hung on "Bypassing protection..." for five minutes and then died, regardless of which bypasser was configured. html_get_page() started a BypassHeartbeat thread to keep the download marked alive during a bypass, but the thread had no loop: it fired one status event and returned. Even with the loop restored it could not have worked, because update_download_status() dedupes identical (status, message) tuples and returns before refreshing _last_activity, and the heartbeat re-sent the byte-identical payload already emitted just above it. So _last_activity was frozen for the whole bypass, while both bypassers are allowed to run longer than STALL_TIMEOUT (external FlareSolverr ~394s at default settings, internal 420s per get() call). The watchdog always won. From a reporter's log: 403 at 07:04:33.390, cancelled at 07:09:33.987 - exactly 300.000s, and 41s before the bypasser would have finished and reported the real error, an HTTP 500 from FlareSolverr the user never saw. The regression is not one commit. |
||
|
CaliBrain
|
dfcd7c9b00 |
Fix silent Hardcover search failures on rejected sort values (#1183)
Hardcover forwards the `sort` argument to Typesense's `sort_by` and
rejects
the entire search if it dislikes the value -- an unknown field, a bare
field
name with no direction, or more than three sort keys. A rejected search
is
not a GraphQL error: it comes back as HTTP 200, no `errors` key, and a
null
`results` body.
_extract_typesense_hits() reads that null as `hits=[], found=0`, so a
failed
search was indistinguishable from one that matched nothing. Users saw
zero
results with a healthy container and no log line explaining why.
Add _execute_search_query(), used by the three sort-bearing call sites
(book
search, field typeahead, series resolution):
- Detect the rejection via the null `results` body. A search that
genuinely
matched nothing still returns a results object with `found: 0`, so empty
result sets are not mistaken for failures.
- Retry once with an empty sort, which Hardcover always accepts, so
searches
return results instead of nothing.
- Keep that fallback sticky for 15 minutes so every subsequent search
does
not pay for a request known to fail, and let it expire so sort order
comes
back on its own if the index is fixed upstream.
- Log rejections that no sort can explain, and retries that also fail,
at
ERROR instead of discarding them.
While the fallback is active, results fall back to Typesense's default
ordering regardless of the selected sort. Degraded ordering beats no
results,
and it is now logged rather than silent.
SORT_MAPPING itself is unchanged: all five of its values were verified
against
the live API and return results. The `sort: "relevance"` reported in
#1179 was
the raw SortOrder value sent by v1.3.5; the mapping already fixed that.
What
remained unfixed, and is fixed here, is that the failure was invisible.
Fixes #1179
|
||
|
dependabot[bot]
|
bd9a22bd6c |
Bump node from a0b9bf0 to d32cdf6 in the docker-base-image-digests group (#1168)
Bumps the docker-base-image-digests group with 1 update: node. Updates `node` from `a0b9bf0` to `d32cdf6` [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
ba4f7fb5e6 |
Bump the npm-deps group in /src/frontend with 8 updates (#1170)
Bumps the npm-deps group in /src/frontend with 8 updates: | Package | From | To | | --- | --- | --- | | [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom) | `7.18.1` | `7.18.2` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.4` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.4` | `6.0.5` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.29.0` | `6.31.0` | | [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.61.0` | `0.62.0` | | [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.76.0` | `1.77.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.1.5` | `8.2.0` | Updates `react-router-dom` from 7.18.1 to 7.18.2 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/remix-run/react-router/blob/react-router-dom@7.18.2/packages/react-router-dom/CHANGELOG.md">react-router-dom's changelog</a>.</em></p> <blockquote> <h2>v7.18.2</h2> <h3>Patch Changes</h3> <ul> <li>Updated dependencies: <ul> <li><a href="https://github.com/remix-run/react-router/releases/tag/react-router@7.18.2"><code>react-router@7.18.2</code></a></li> </ul> </li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/remix-run/react-router/commit/69a653ee6ab1ac95b13c917ec56c5f3dc17ca9c1"><code>69a653e</code></a> Release v7.18.2 (<a href="https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom/issues/15354">#15354</a>)</li> <li>See full diff in <a href="https://github.com/remix-run/react-router/commits/react-router-dom@7.18.2/packages/react-router-dom">compare view</a></li> </ul> </details> <br /> Updates `@types/react` from 19.2.17 to 19.2.18 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare view</a></li> </ul> </details> <br /> Updates `@types/react-dom` from 19.2.3 to 19.2.4 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom">compare view</a></li> </ul> </details> <br /> Updates `@vitejs/plugin-react` from 6.0.4 to 6.0.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/releases">@vitejs/plugin-react's releases</a>.</em></p> <blockquote> <h2>plugin-react@6.0.5</h2> <h3>Fixed the react compiler preset filter to be linear (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1353">#1353</a>)</h3> <p>The improved filter in v6.0.3 was non-linear and caused a performance regression (<a href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1349">#1349</a>). The filter was changed to be linear to avoid that.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md">@vitejs/plugin-react's changelog</a>.</em></p> <blockquote> <h2>6.0.5 (2026-07-30)</h2> <h3>Fixed the react compiler preset filter to be linear (<a href="https://redirect.github.com/vitejs/vite-plugin-react/pull/1353">#1353</a>)</h3> <p>The improved filter in v6.0.3 was non-linear and caused a performance regression (<a href="https://redirect.github.com/vitejs/vite-plugin-react/issues/1349">#1349</a>). The filter was changed to be linear to avoid that.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/68c0cb8796ce18bd049c3d05c5210eaf0617eac0"><code>68c0cb8</code></a> release: plugin-react@6.0.5 (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1362">#1362</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/555cdbc126506317b05404481374406771a41e70"><code>555cdbc</code></a> fix(react): make the react compiler preset filter linear (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1353">#1353</a>)</li> <li><a href="https://github.com/vitejs/vite-plugin-react/commit/a00a9f8240d5a7bb4062ee2a5bac68ea4f0defa6"><code>a00a9f8</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react/issues/1327">#1327</a>)</li> <li>See full diff in <a href="https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.5/packages/plugin-react">compare view</a></li> </ul> </details> <br /> Updates `knip` from 6.29.0 to 6.31.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/webpro-nl/knip/releases">knip's releases</a>.</em></p> <blockquote> <h2>Release 6.31.0</h2> <ul> <li>feat: Add basic support for Marko 6 and 5 (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1914">#1914</a>) (c6b151642701f9b4864ddb5ea8e40580623f59d1) - thanks <a href="https://github.com/caseycarroll"><code>@caseycarroll</code></a>!</li> <li>Use Array.from in Marko compiler (5aadf47a22bdfd43bb8ad4082768e07fe37fc5ca)</li> <li>Update release-it and fix release script flags (6fa9c269c65c0923965924226a5ccf0778842967)</li> <li>Downgrade <code>@types/vscode</code> to match extension engines range (6d8e9bf5200cf982d0bc801469c4e2be5627e5b8)</li> </ul> <h2>Release 6.30.0</h2> <ul> <li>docs: migrate to Starlight Blog plugin (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1854">#1854</a>) (c89e3e3c9) - thanks <a href="https://github.com/trueberryless"><code>@trueberryless</code></a>!</li> <li>Include workspace dependencies in scoped runs (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1901">#1901</a>) (a75309eda)</li> <li>Simplify workspace assembly (b3ac16411)</li> <li>Document export declaration safety (ef98a7682)</li> <li>Read object jsPlugin specifiers from Vite+ config (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1879">#1879</a>) (3ea6a92d4) - thanks <a href="https://github.com/matchai"><code>@matchai</code></a>!</li> <li>Compile gitignore negations once (6884cdb20)</li> <li>Cache Node test script detection (d970f67d8)</li> <li>Track only enabled workspace plugins (67d48268a)</li> <li>Skip unsupported Vite config command (545bb2d36)</li> <li>Add SARIF reporter (ce11cf5d4)</li> <li>Track catalog refs in pnpm dlx scripts (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1885">#1885</a>, close <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1886">#1886</a>) (102189a1a)</li> <li>Report unresolved catalog references (b2b86c3e5)</li> <li>Track catalog references across scoped runs (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1905">#1905</a>) (f0365bae0)</li> <li>Track script catalog references across scoped runs (9b3ab3778)</li> <li>Remove tsc from ignoreBinaries (a0a283040)</li> <li>fix: detect dynamic imports in Svelte component templates (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1908">#1908</a>) (aa303fb04) - thanks <a href="https://github.com/firatciftci"><code>@firatciftci</code></a>!</li> <li>fix(remark): support all types of dependency names (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1911">#1911</a>) (3441bea3a) - thanks <a href="https://github.com/voxpelli"><code>@voxpelli</code></a>!</li> <li>Update sanity snapshot (d04aa04e5)</li> <li>feat(stryker): add ts extensions (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1910">#1910</a>) (cfc50886e) - thanks <a href="https://github.com/christopher-buss"><code>@christopher-buss</code></a>!</li> <li>Adopt <code>@e18e/eslint-plugin</code> (adf2511ab)</li> <li>Remove Workleap from sponsors (d4f6af9ff)</li> <li>Update dependencies (3f61542f6)</li> <li>Add ES2023 array types to TypeScript 5 CI (360a47157)</li> <li>Update sentry snapshot (7defc1853)</li> <li>Analyze published type dependencies (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1909">#1909</a>) (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1912">#1912</a>) (87d713e52)</li> <li>Update TanStack and Code Forge logos (39ed8c82b)</li> <li>Track assets referenced from SCSS URLs (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1916">#1916</a>) (cbe13bf87)</li> <li>Consume only the default export of inline dynamic import loaders (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1915">#1915</a>) (b90a299e2)</li> <li>Update ecosystem snapshots (3f6cdee15)</li> <li>Update dependencies (6cdb3a6ac)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/webpro-nl/knip/commit/69c6006ee5938d7e2a6157222a24799eb639ec5c"><code>69c6006</code></a> Release knip@6.31.0</li> <li><a href="https://github.com/webpro-nl/knip/commit/5aadf47a22bdfd43bb8ad4082768e07fe37fc5ca"><code>5aadf47</code></a> Use Array.from in Marko compiler</li> <li><a href="https://github.com/webpro-nl/knip/commit/c6b151642701f9b4864ddb5ea8e40580623f59d1"><code>c6b1516</code></a> feat: Add basic support for Marko 6 and 5 (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1914">#1914</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/837e52ca8601813b6bbbae13f6e7a614449de58a"><code>837e52c</code></a> Release knip@6.30.0</li> <li><a href="https://github.com/webpro-nl/knip/commit/6cdb3a6ac1f221d594fb4e71da00e80e6c2a90e6"><code>6cdb3a6</code></a> Update dependencies</li> <li><a href="https://github.com/webpro-nl/knip/commit/b90a299e2461f618f065cf3cfcededb1b4a4abc0"><code>b90a299</code></a> Consume only the default export of inline dynamic import loaders (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1915">#1915</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/cbe13bf87d80f1d458453b913e5408c22413c11f"><code>cbe13bf</code></a> Track assets referenced from SCSS URLs (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1916">#1916</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/87d713e5288820096bb675a283d873fb3af486e8"><code>87d713e</code></a> Analyze published type dependencies (resolve <a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1909">#1909</a>) (<a href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1912">#1912</a>)</li> <li><a href="https://github.com/webpro-nl/knip/commit/360a47157ec850064da0f946ff233d00e07f87c7"><code>360a471</code></a> Add ES2023 array types to TypeScript 5 CI</li> <li><a href="https://github.com/webpro-nl/knip/commit/3f61542f6eaf07b526d76e5f4f0293ae059ad32f"><code>3f61542</code></a> Update dependencies</li> <li>Additional commits viewable in <a href="https://github.com/webpro-nl/knip/commits/knip@6.31.0/packages/knip">compare view</a></li> </ul> </details> <br /> Updates `oxfmt` from 0.61.0 to 0.62.0 <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md">oxfmt's changelog</a>.</em></p> <blockquote> <h2>[0.62.0] - 2026-08-03</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>e6e584b oxfmt: Type jsdoc. enum options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25008">#25008</a>) (leaysgur)</li> </ul> <h2>[0.59.0] - 2026-07-13</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/24286">#24286</a>) (leaysgur)</li> </ul> <h2>[0.55.0] - 2026-06-15</h2> <h3>🚀 Features</h3> <ul> <li>9a2788b linter/unicorn: Implement <code>prefer-export-from</code> rule (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/22935">#22935</a>) (AliceLanniste)</li> </ul> <h2>[0.54.0] - 2026-06-08</h2> <h3>📚 Documentation</h3> <ul> <li>dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/22965">#22965</a>) (Boshen)</li> <li>f88961a oxfmt: Annotate each config option with supported languages (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/22953">#22953</a>) (leaysgur)</li> </ul> <h2>[0.52.0] - 2026-05-26</h2> <h3>🚀 Features</h3> <ul> <li>16b8058 oxfmt: Support <code>vite-plus/resolveConfig</code> for vite.config.ts (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/22454">#22454</a>) (leaysgur)</li> </ul> <h2>[0.50.0] - 2026-05-15</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>43b9978 formatter/sort_imports: Treat subpath imports as internal (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/22440">#22440</a>) (leaysgur)</li> </ul> <h2>[0.49.0] - 2026-05-11</h2> <h3>🚀 Features</h3> <ul> <li>6e8e818 oxfmt: Experimental .svelte support (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/21700">#21700</a>) (leaysgur)</li> </ul> <h2>[0.45.0] - 2026-04-13</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>50c389b oxfmt: Support <code>.editorconfig</code> <code>quote_type</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/20989">#20989</a>) (leaysgur)</li> </ul> <h2>[0.44.0] - 2026-04-06</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a> release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25251">#25251</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/e6e584b9bee0f85f45874854c79dbf23ae6e527a"><code>e6e584b</code></a> fix(oxfmt): type jsdoc. enum options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/25008">#25008</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.62.0/npm/oxfmt">compare view</a></li> </ul> </details> <br /> Updates `oxlint` from 1.76.0 to 1.77.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/releases">oxlint's releases</a>.</em></p> <blockquote> <h2>oxlint v1.27.0 && oxfmt v0.12.0</h2> <h1>Oxlint v1.27.0</h1> <h3>🚀 Features</h3> <ul> <li>222a8f0 linter/plugins: Implement <code>SourceCode#isSpaceBetween</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15498">#15498</a>) (overlookmotel)</li> <li>2f9735d linter/plugins: Implement <code>context.languageOptions</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15486">#15486</a>) (overlookmotel)</li> <li>bc731ff linter/plugins: Stub out all <code>Context</code> APIs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15479">#15479</a>) (overlookmotel)</li> <li>5822cb4 linter/plugins: Add <code>extend</code> method to <code>FILE_CONTEXT</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15477">#15477</a>) (overlookmotel)</li> <li>7b1e6f3 apps: Add pure rust binaries and release to github (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15469">#15469</a>) (Boshen)</li> <li>2a89b43 linter: Introduce debug assertions after fixes to assert validity (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15389">#15389</a>) (camc314)</li> <li>ad3c45a editor: Add <code>oxc.path.node</code> option (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15040">#15040</a>) (Sysix)</li> </ul> <h3>🐛 Bug Fixes</h3> <ul> <li>6f3cd77 linter/no-var: Incorrect warning for blocks (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15504">#15504</a>) (Hamir Mahal)</li> <li>6957fb9 linter/plugins: Do not allow access to <code>Context#id</code> in <code>createOnce</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15489">#15489</a>) (overlookmotel)</li> <li>7409630 linter/plugins: Allow access to <code>cwd</code> in <code>createOnce</code> in ESLint interop mode (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15488">#15488</a>) (overlookmotel)</li> <li>732205e parser: Reject <code>using</code> / <code>await using</code> in a switch <code>case</code> / <code>default</code> clause (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15225">#15225</a>) (sapphi-red)</li> <li>a17ca32 linter/plugins: Replace <code>Context</code> class (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15448">#15448</a>) (overlookmotel)</li> <li>ecf2f7b language_server: Fail gracefully when tsgolint executable not found (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15436">#15436</a>) (camc314)</li> <li>3c8d3a7 lang-server: Improve logging in failure case for tsgolint (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15299">#15299</a>) (camc314)</li> <li>ef71410 linter: Use jsx if source type is JS in fix debug assertion (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15434">#15434</a>) (camc314)</li> <li>e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15426">#15426</a>) (camc314)</li> <li>6565dbe linter/switch-case-braces: Skip comments when searching for <code>:</code> token (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15425">#15425</a>) (camc314)</li> <li>85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15423">#15423</a>) (camc314)</li> <li>fde753e linter/plugins: Block access to <code>context.settings</code> in <code>createOnce</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15394">#15394</a>) (overlookmotel)</li> <li>ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15388">#15388</a>) (camc314)</li> <li>dac2a9c linter/no-template-curly-in-string: Remove fixer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15387">#15387</a>) (camc314)</li> <li>989b8e3 linter/no-var: Only fix to <code>const</code> if the var has an initializer (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15385">#15385</a>) (camc314)</li> <li>cc403f5 linter/plugins: Return empty object for unimplemented parserServices (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15364">#15364</a>) (magic-akari)</li> </ul> <h3>⚡ Performance</h3> <ul> <li>25d577e language_server: Start tools in parallel (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15500">#15500</a>) (Sysix)</li> <li>3c57291 linter/plugins: Optimize loops (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15449">#15449</a>) (overlookmotel)</li> <li>3166233 linter/plugins: Remove <code>Arc</code>s (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15431">#15431</a>) (overlookmotel)</li> <li>9de1322 linter/plugins: Lazily deserialize settings JSON (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15395">#15395</a>) (overlookmotel)</li> <li>3049ec2 linter/plugins: Optimize <code>deepFreezeSettings</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15392">#15392</a>) (overlookmotel)</li> <li>444ebfd linter/plugins: Use single object for <code>parserServices</code> (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15378">#15378</a>) (overlookmotel)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>97d2104 linter: Update comment in lint.rs about default value for tsconfig path (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15530">#15530</a>) (Connor Shea)</li> <li>2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15411">#15411</a>) (sapphi-red)</li> <li>a0c5203 linter/import/named: Update "ES7" comment in examples (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15410">#15410</a>) (sapphi-red)</li> <li>3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15409">#15409</a>) (sapphi-red)</li> <li>2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15408">#15408</a>) (sapphi-red)</li> <li>57f0ce1 linter: Add backquotes where appropriate (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/15407">#15407</a>) (sapphi-red)</li> </ul> <h1>Oxfmt v0.12.0</h1> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's changelog</a>.</em></p> <blockquote> <h2>[1.77.0] - 2026-08-03</h2> <h3>🐛 Bug Fixes</h3> <ul> <li>5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25151">#25151</a>) (Mikhail Baev)</li> </ul> <h3>📚 Documentation</h3> <ul> <li>9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>) (camc314)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/oxc-project/oxc/commit/9a423f2f485b79c2353c49442c0c7f60f900261d"><code>9a423f2</code></a> release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25251">#25251</a>)</li> <li><a href="https://github.com/oxc-project/oxc/commit/5c0fa61ddbd098fea5101dff356dc9b67adbee95"><code>5c0fa61</code></a> fix(linter/eslint/no-warning-comments): unify config structs and remove manua...</li> <li><a href="https://github.com/oxc-project/oxc/commit/9dc77567291db6ebd0641284f80bf50163c6a257"><code>9dc7756</code></a> docs(linter/typescript/no-unnecessary-condition): clarify options (<a href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25110">#25110</a>)</li> <li>See full diff in <a href="https://github.com/oxc-project/oxc/commits/oxlint_v1.77.0/npm/oxlint">compare view</a></li> </ul> </details> <br /> Updates `vite` from 8.1.5 to 8.2.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/releases">vite's releases</a>.</em></p> <blockquote> <h2>create-vite@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/create-vite@8.2.0/packages/create-vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>plugin-legacy@8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/plugin-legacy@8.2.0/packages/plugin-legacy/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> <h2>v8.2.0-beta.0</h2> <p>Please refer to <a href="https://github.com/vitejs/vite/blob/v8.2.0-beta.0/packages/vite/CHANGELOG.md">CHANGELOG.md</a> for details.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/vitejs/vite/compare/v8.2.0-beta.0...v8.2.0">8.2.0</a> (2026-07-30)</h2> <h3>Features</h3> <ul> <li>add <code>input</code> to <code>server.fs.allow</code> (<a href="https://redirect.github.com/vitejs/vite/issues/23035">#23035</a>) (<a href="https://github.com/vitejs/vite/commit/95a3cdab83e1125b03d2e8dd942fb6b64209e5fa">95a3cda</a>)</li> <li><strong>bundled-dev:</strong> reload once after rebuild instead of via the fallback page (<a href="https://redirect.github.com/vitejs/vite/issues/23106">#23106</a>) (<a href="https://github.com/vitejs/vite/commit/b24381d741941b9ce2b1c07db62cc5f4d7bad981">b24381d</a>)</li> <li><strong>bundled-dev:</strong> support worker file update accepted by HMR (<a href="https://redirect.github.com/vitejs/vite/issues/23068">#23068</a>) (<a href="https://github.com/vitejs/vite/commit/0d04351fdc12258c75b9f1cda5780fdb836ed0ef">0d04351</a>)</li> <li><strong>config:</strong> include column in config incompatibility location (<a href="https://redirect.github.com/vitejs/vite/issues/23064">#23064</a>) (<a href="https://github.com/vitejs/vite/commit/8a245726944ed29225920d49be77c33c6e03afc8">8a24572</a>)</li> <li><strong>dev:</strong> resolve interface name for explicit host in network URLs (<a href="https://redirect.github.com/vitejs/vite/issues/22965">#22965</a>) (<a href="https://github.com/vitejs/vite/commit/3ac77d9dd742968961af38a5a91ed6b061ceda7d">3ac77d9</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>bundledDev:</strong> print build errors to the terminal when an HMR update fails (<a href="https://redirect.github.com/vitejs/vite/issues/23024">#23024</a>) (<a href="https://github.com/vitejs/vite/commit/41c465896e8b11b1eb9c5fbdafbdcc528e189a2c">41c4658</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/23069">#23069</a>) (<a href="https://github.com/vitejs/vite/commit/4c07b74416f859d7e8bdace13409ef2d080edf76">4c07b74</a>)</li> <li><strong>hmr:</strong> preserve environment snapshot during server restart (<a href="https://redirect.github.com/vitejs/vite/issues/22992">#22992</a>) (<a href="https://github.com/vitejs/vite/commit/b1186c36d06bb94941c58e8272fc4acb8512c93b">b1186c3</a>)</li> <li><strong>importAnalysis:</strong> interop imports injected into optimized dep files by plugins (<a href="https://redirect.github.com/vitejs/vite/issues/23029">#23029</a>) (<a href="https://github.com/vitejs/vite/commit/8c2a87d41fb24536e59643351758084cde4d0dd7">8c2a87d</a>)</li> <li><strong>module-runner:</strong> keep stack trace interception working when <code>Object.prototype</code> is frozen (<a href="https://redirect.github.com/vitejs/vite/issues/23073">#23073</a>) (<a href="https://github.com/vitejs/vite/commit/599c5b02a8b6879b05ede988020f1331e877aaea">599c5b0</a>)</li> <li><strong>server:</strong> strip base in indexHtml module graph lookup (<a href="https://redirect.github.com/vitejs/vite/issues/22932">#22932</a>) (<a href="https://github.com/vitejs/vite/commit/fa005d19af5d847931c6dbefc63841c137383e6c">fa005d1</a>)</li> <li>support resolving top-level input option with plugins (<a href="https://redirect.github.com/vitejs/vite/issues/23101">#23101</a>) (<a href="https://github.com/vitejs/vite/commit/41df81a6a4c3eef08f7a9a8ac9530cd136c0eafa">41df81a</a>)</li> </ul> <h3>Documentation</h3> <ul> <li><strong>config:</strong> correct cacheDir default fallback description (<a href="https://redirect.github.com/vitejs/vite/issues/23060">#23060</a>) (<a href="https://github.com/vitejs/vite/commit/aafa103af5d71fb59d7c3dd617d0cbef3b222f1f">aafa103</a>)</li> </ul> <h3>Tests</h3> <ul> <li>config CJS module vars in ESM case (<a href="https://redirect.github.com/vitejs/vite/issues/23010">#23010</a>) (<a href="https://github.com/vitejs/vite/commit/d8cd38830251b95fd7dddcd0eee0ce94cc61c2f4">d8cd388</a>)</li> </ul> <h2><a href="https://github.com/vitejs/vite/compare/v8.1.5...v8.2.0-beta.0">8.2.0-beta.0</a> (2026-07-22)</h2> <h3>Features</h3> <ul> <li>add <code>input</code> option (<a href="https://redirect.github.com/vitejs/vite/issues/22642">#22642</a>) (<a href="https://github.com/vitejs/vite/commit/9beae37d7221b25463a011feb40b0303ca328d87">9beae37</a>)</li> <li><strong>config:</strong> warn features incompatible with native loader in bundle loader (<a href="https://redirect.github.com/vitejs/vite/issues/22850">#22850</a>) (<a href="https://github.com/vitejs/vite/commit/05302b07267f6b4f9dbeac5b1d73fcc3dc06d730">05302b0</a>)</li> <li><strong>css:</strong> export PostCSS config type for type-safe configs (<a href="https://redirect.github.com/vitejs/vite/issues/22792">#22792</a>) (<a href="https://github.com/vitejs/vite/commit/302c755a8125b9a26214e3b413922b5513e41981">302c755</a>)</li> <li><strong>dev:</strong> label network URLs with their interface name (<a href="https://redirect.github.com/vitejs/vite/issues/22830">#22830</a>) (<a href="https://github.com/vitejs/vite/commit/78accc42a5b8887d9df624f7d4a934d3ead677d1">78accc4</a>)</li> <li><strong>optimizer:</strong> support aube lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/22813">#22813</a>) (<a href="https://github.com/vitejs/vite/commit/6319827116c5be2a19c1b91c84ba3d38ad26a41c">6319827</a>)</li> <li><strong>optimizer:</strong> support nub lockfile (<a href="https://redirect.github.com/vitejs/vite/issues/22891">#22891</a>) (<a href="https://github.com/vitejs/vite/commit/65d3604f6fdbfcf6e86244d7fe3c1ca86acae701">65d3604</a>)</li> <li>update rolldown-related dependencies and use client-side HMR in bundled-dev (<a href="https://redirect.github.com/vitejs/vite/issues/22961">#22961</a>) (<a href="https://github.com/vitejs/vite/commit/960e9efbc1372000caac46cc2f123cef4824e2bb">960e9ef</a>)</li> <li><strong>wasm:</strong> expand test suite, unwrap WebAssembly.Global and enable js-string builtins (<a href="https://redirect.github.com/vitejs/vite/issues/22674">#22674</a>) (<a href="https://github.com/vitejs/vite/commit/9e79b51579457a9af4fa623b68a0bfabbf38010b">9e79b51</a>)</li> </ul> <h3>Bug Fixes</h3> <ul> <li><strong>build:</strong> map CSS chunks in chunk import maps (fix <a href="https://redirect.github.com/vitejs/vite/issues/22946">#22946</a>) (<a href="https://redirect.github.com/vitejs/vite/issues/22947">#22947</a>) (<a href="https://github.com/vitejs/vite/commit/e16ff3a1199293ac9cdfa6132c08fdea162215f3">e16ff3a</a>)</li> <li><strong>config:</strong> exclude virtual modules from native config compat check (<a href="https://redirect.github.com/vitejs/vite/issues/22979">#22979</a>) (<a href="https://github.com/vitejs/vite/commit/2ced1fe4e4e480ed78cb7aa5c78319e57bfa7783">2ced1fe</a>)</li> <li><strong>css:</strong> rewrite urls in OnceExit-injected content (<a href="https://redirect.github.com/vitejs/vite/issues/22983">#22983</a>) (<a href="https://github.com/vitejs/vite/commit/abb793e18c92592c21fbb8e1f3fc450b5839f04f">abb793e</a>)</li> <li><strong>deps:</strong> update all non-major dependencies (<a href="https://redirect.github.com/vitejs/vite/issues/22985">#22985</a>) (<a href="https://github.com/vitejs/vite/commit/04f345b37064cd0bba6447eb5c32be5c22162f3d">04f345b</a>)</li> <li><strong>deps:</strong> update dependency magic-string to v1 (<a href="https://redirect.github.com/vitejs/vite/issues/22998">#22998</a>) (<a href="https://github.com/vitejs/vite/commit/c60b4d7cdb85b7d4f78671cdcfb863e5f8b66bb7">c60b4d7</a>)</li> <li><strong>hmr:</strong> remove hot data after prune (<a href="https://redirect.github.com/vitejs/vite/issues/23002">#23002</a>) (<a href="https://github.com/vitejs/vite/commit/be9631658f5191ee5c5665e780239d42a330280a">be96316</a>)</li> <li>resolve root to real path (<a href="https://redirect.github.com/vitejs/vite/issues/22832">#22832</a>) (<a href="https://github.com/vitejs/vite/commit/55bba7bbd9de40d031360e4408fe91bff5b29ec9">55bba7b</a>)</li> </ul> <h3>Performance Improvements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/vitejs/vite/commit/24a611f1c83a976d32262628d42f683609746635"><code>24a611f</code></a> release: v7.2.4</li> <li><a href="https://github.com/vitejs/vite/commit/2d66b7b14aa6dfd62f3d6a59ee8382ed5ca6fd32"><code>2d66b7b</code></a> fix: revert "perf(deps): replace debug with obug (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21107">#21107</a>)"</li> <li><a href="https://github.com/vitejs/vite/commit/a668014dba377c2b82a32d8124f1761e9ea74f82"><code>a668014</code></a> release: v7.2.3</li> <li><a href="https://github.com/vitejs/vite/commit/acfe939e1f7c303c34b0b39b883cc302da767fa2"><code>acfe939</code></a> perf(deps): replace debug with obug (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21107">#21107</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/4f8171eb3046bd70c83964689897dab4c6b58bc0"><code>4f8171e</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21128">#21128</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/50297208452241061cb44d09a4bbdf77a11ac01e"><code>5029720</code></a> chore(deps): update rolldown-related dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21127">#21127</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/5909efd8fbfd1bf1eab65427aea0613124b2797a"><code>5909efd</code></a> fix: allow multiple <code>bindCLIShortcuts</code> calls with shortcut merging (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21103">#21103</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/39a0a15fd24ed37257c48b795097a3794e54d255"><code>39a0a15</code></a> chore(deps): update rolldown-related dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21095">#21095</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/6a34ac3422686e7cf7cc9a25d299cb8e5a8d92a0"><code>6a34ac3</code></a> fix(deps): update all non-major dependencies (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21096">#21096</a>)</li> <li><a href="https://github.com/vitejs/vite/commit/02ceaec45e17bef19159188a28d9196fed1761be"><code>02ceaec</code></a> chore(deps): update dependency <code>@rollup/plugin-commonjs</code> to v29 (<a href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/21099">#21099</a>)</li> <li>Additional commits viewable in <a href="https://github.com/vitejs/vite/commits/create-vite@8.2.0/packages/vite">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
f1de248ed5 |
Bump the gh-actions group with 4 updates (#1171)
Bumps the gh-actions group with 4 updates: [docker/login-action](https://github.com/docker/login-action), [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action). Updates `docker/login-action` from 4.5.2 to 4.6.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/docker/login-action/releases">docker/login-action's releases</a>.</em></p> <blockquote> <h2>v4.6.0</h2> <ul> <li>Harden buildx scoped config path handling by <a href="https://github.com/crazy-max"><code>@crazy-max</code></a> in <a href="https://redirect.github.com/docker/login-action/pull/1059">docker/login-action#1059</a></li> <li>Bump <code>@aws-sdk/client-ecr</code> and <code>@aws-sdk/client-ecr-public</code> to 3.1095.0 in <a href="https://redirect.github.com/docker/login-action/pull/1051">docker/login-action#1051</a></li> <li>Bump js-yaml from 5.2.1 to 5.2.2 in <a href="https://redirect.github.com/docker/login-action/pull/1057">docker/login-action#1057</a></li> <li>Bump postcss from 8.5.10 to 8.5.22 in <a href="https://redirect.github.com/docker/login-action/pull/1056">docker/login-action#1056</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/docker/login-action/compare/v4.5.2...v4.6.0">https://github.com/docker/login-action/compare/v4.5.2...v4.6.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/docker/login-action/commit/dbcb813823bdd20940b903addbd779551569679f"><code>dbcb813</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1051">#1051</a> from docker/dependabot/npm_and_yarn/aws-sdk-dependen...</li> <li><a href="https://github.com/docker/login-action/commit/5bcb015ee6ec720ecdeaef2dc1164122e9b209fc"><code>5bcb015</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/b30b2f2d3196c1714318ba0c3c3bec211d949752"><code>b30b2f2</code></a> build(deps): bump the aws-sdk-dependencies group across 1 directory with 2 up...</li> <li><a href="https://github.com/docker/login-action/commit/9087f1e6d666fe0292409e3c819680c18526e108"><code>9087f1e</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1057">#1057</a> from docker/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/docker/login-action/commit/0009830ea169ca16c24c0ea4cac1c325bfa3aee4"><code>0009830</code></a> [dependabot skip] chore: update generated content</li> <li><a href="https://github.com/docker/login-action/commit/23255232d3e43c8f0052d9a0dba82a515a88ce92"><code>2325523</code></a> build(deps): bump js-yaml from 5.2.1 to 5.2.2</li> <li><a href="https://github.com/docker/login-action/commit/4ec1d4a769e8b05a89a7396551dc38b329211688"><code>4ec1d4a</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1056">#1056</a> from docker/dependabot/npm_and_yarn/postcss-8.5.22</li> <li><a href="https://github.com/docker/login-action/commit/5fc99ba47bca274c5a499688f71c7ea79c0ea1b3"><code>5fc99ba</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1053">#1053</a> from docker/dependabot/github_actions/aws-actions/co...</li> <li><a href="https://github.com/docker/login-action/commit/e512bd59d16c53d79ea5c0f0e345fe554453c4bb"><code>e512bd5</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1052">#1052</a> from docker/dependabot/github_actions/codeql-actions...</li> <li><a href="https://github.com/docker/login-action/commit/a146c91b8f371700d323bae808af7cbdc2766ed5"><code>a146c91</code></a> Merge pull request <a href="https://redirect.github.com/docker/login-action/issues/1059">#1059</a> from crazy-max/harden-buildx-scope-paths</li> <li>Additional commits viewable in <a href="https://github.com/docker/login-action/compare/371161bbe7024a29a25c5e19bfcbc0804fe9ad2c...dbcb813823bdd20940b903addbd779551569679f">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.3 to 4.37.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/autobuild` from 4.37.3 to 4.37.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.3 to 4.37.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.6</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>v4.37.4</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/5595ccaf912efad79be6eef63a5619ff05969be3"><code>5595cca</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4071">#4071</a> from github/update-v4.37.6-6a9359a1b</li> <li><a href="https://github.com/github/codeql-action/commit/ec9c75796a7f2cee5af0c5ffa0b81dc3bb58754b"><code>ec9c757</code></a> Add change note for PR 4070</li> <li><a href="https://github.com/github/codeql-action/commit/45c8742e17cbd668814137f95e605d925b8722a2"><code>45c8742</code></a> Update changelog for v4.37.6</li> <li><a href="https://github.com/github/codeql-action/commit/6a9359a1bd054c53cae7bb737bd8d796cfbf3014"><code>6a9359a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4070">#4070</a> from github/mbg/remote-address/change-file-default</li> <li><a href="https://github.com/github/codeql-action/commit/065cdc0394d424981db720df63ebc570e41b775f"><code>065cdc0</code></a> Change <code>DEFAULT_CONFIG_FILE_NAME</code></li> <li><a href="https://github.com/github/codeql-action/commit/f99dd5aeee9cf92e92d0c700cb0aa7afd7bbf431"><code>f99dd5a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4066">#4066</a> from github/dependabot/npm_and_yarn/js-yaml-5.2.2</li> <li><a href="https://github.com/github/codeql-action/commit/1804b211a343d69a6584d26fb3a68a8fe6ca39d4"><code>1804b21</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4068">#4068</a> from github/mergeback/v4.37.5-to-main-d1ba80a1</li> <li><a href="https://github.com/github/codeql-action/commit/3020a2f46286abb1704269b22ada83bd0e81c64f"><code>3020a2f</code></a> Rebuild</li> <li><a href="https://github.com/github/codeql-action/commit/93c3a5a40b7affbf8ea6a480767ed0db8e8d3c5c"><code>93c3a5a</code></a> Update changelog and version after v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81...5595ccaf912efad79be6eef63a5619ff05969be3">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
78d5d0632a |
Bump the python-deps group across 1 directory with 5 updates (#1182)
Bumps the python-deps group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [python-socketio](https://github.com/miguelgrinberg/python-socketio) | `5.16.3` | `5.16.4` | | [rarfile](https://github.com/markokr/rarfile) | `4.4` | `4.5` | | [seleniumbase](https://github.com/seleniumbase/SeleniumBase) | `4.51.8` | `4.51.11` | | [prek](https://github.com/j178/prek) | `0.4.11` | `0.4.12` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.1` | `0.16.2` | Updates `python-socketio` from 5.16.3 to 5.16.4 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/miguelgrinberg/python-socketio/releases">python-socketio's releases</a>.</em></p> <blockquote> <h2>Release 5.16.4</h2> <p>See <a href="https://github.com/miguelgrinberg/python-socketio/blob/main/CHANGES.md">CHANGES.md</a> for release notes.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/miguelgrinberg/python-socketio/blob/main/CHANGES.md">python-socketio's changelog</a>.</em></p> <blockquote> <h1>python-socketio change log</h1> <p><strong>Release 5.16.4</strong> - 2026-08-07</p> <ul> <li>Delete incomplete binary packet when client disconnects (<a href="https://github.com/miguelgrinberg/python-socketio/commit/4bec3ef87bcfd6ab5b94cd3ac09d873283a6960e">commit</a>)</li> </ul> <p><strong>Release 5.16.3</strong> - 2026-06-15</p> <ul> <li>Catch all exceptions in redis and rabbitmq client managers <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1581">#1581</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/80bb5c9b07e6b53e45f610ec29a24124c539d41b">commit</a>)</li> </ul> <p><strong>Release 5.16.2</strong> - 2026-05-21</p> <ul> <li>Prevent unnecessary resource allocations <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1574">#1574</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/ca140fe44d0ceb3004073645222abec182d8784b">commit</a>)</li> <li>Add zizmor to CI builds <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1570">#1570</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/664dc27ec6f34179ed1724430eda3520627fc642">commit</a>)</li> </ul> <p><strong>Release 5.16.1</strong> - 2026-02-06</p> <ul> <li>Use configured JSON module in managers <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1549">#1549</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/6229261ae6e8c01e675097242e333ee84587a544">commit</a>)</li> <li>Admin UI fixes: remove duplicate tasks, report transport upgrades (<a href="https://github.com/miguelgrinberg/python-socketio/commit/1c2eab13a92fac9e43663eb0b5f099eb1c40ea5b">commit</a>)</li> <li>Switch to Furo documentation template (<a href="https://github.com/miguelgrinberg/python-socketio/commit/add47d8c7abca697a2804141bbf29bfb095f7d5e">commit</a>)</li> <li>Add Python free-threading to CI <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1554">#1554</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/ccdd2004a038ae4b8171a05120c5d0787332f7ee">commit</a>)</li> </ul> <p><strong>Release 5.16.0</strong> - 2025-12-24</p> <ul> <li>Address deprecation warnings (<a href="https://github.com/miguelgrinberg/python-socketio/commit/b235699d9b06564753c570b76055997e9d62a938">commit</a>)</li> <li>Drop Python 3.8 and 3.9 from CI builds (<a href="https://github.com/miguelgrinberg/python-socketio/commit/d0728d2f74538762dd551fa9cd0cd1fd5aedfa37">commit</a>)</li> </ul> <p><strong>Release 5.15.1</strong> - 2025-12-16</p> <ul> <li>Restore support multiple arguments via pubsub emits <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1540">#1540</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/c279f26bb8c9887c4ca99d4d81ad331c4844438c">commit</a>)</li> </ul> <p><strong>Release 5.15.0</strong> - 2025-11-22</p> <ul> <li>Retry initial Redis connection <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1536">#1534</a> ([commit <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1">#1</a>](<a href="https://github.com/miguelgrinberg/python-socketio/commit/1e903e173a2d7b04599c4f7f9630c1abbb531fad">https://github.com/miguelgrinberg/python-socketio/commit/1e903e173a2d7b04599c4f7f9630c1abbb531fad</a>) [commit <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/2">#2</a>](<a href="https://github.com/miguelgrinberg/python-socketio/commit/5e898a9b93526e6e667767e54c60f4c84589989d">https://github.com/miguelgrinberg/python-socketio/commit/5e898a9b93526e6e667767e54c60f4c84589989d</a>))</li> <li>Correctly regenerate RabbitMQ binding after a connection failure <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1516">#1516</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/c52e93b4a328d98a968bfbdec0cfd598b73ee913">commit</a>) (thanks <strong>Gritty_dev</strong>!)</li> <li>Support <code>ext_type</code> in the <code>MsgPackPacket</code> class <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1521">#1521</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/208925344a48485d2cd56e40eb74266c3bcb5311">commit</a>)</li> <li>Support sending <code>bytesarray</code>s when using pub/sub managers (<a href="https://github.com/miguelgrinberg/python-socketio/commit/6c9b9974f72e2efdf62407ecab24ee6995448098">commit</a>)</li> <li>Fix typos in documentation <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1520">#1520</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/db3f1c2a0105c30cb833ddfca8f05fe4320468fd">commit</a>) (thanks <strong>Lê Nam Khánh</strong>!)</li> <li>Improvements to the logging documentation (<a href="https://github.com/miguelgrinberg/python-socketio/commit/b423d0e38eef559b7e81acb7e32059de305f982c">commit</a>)</li> </ul> <p><strong>Release 5.14.3</strong> - 2025-10-29</p> <ul> <li>Support Python's native <code>ConnectionRefusedError</code> exception to reject a connection <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1515">#1515</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/f3b18bde3f16437b223491d4c3e440ea37105fe3">commit</a>)</li> <li>Push binary data to the aiopika client manager <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1514">#1514</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/194e1b7f277b5f72e1de78d3f614e7b8b6c788ac">commit</a>)</li> </ul> <p><strong>Release 5.14.2</strong> - 2025-10-15</p> <ul> <li>Restore binary message support in message queue setups <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1509">#1509</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/bab4a10f48aaae11d7f832ebe5c30ad3f85d31b3">commit</a>)</li> <li>Fix formatting of client connection error <a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1507">#1507</a> (<a href="https://github.com/miguelgrinberg/python-socketio/commit/f298c9b54d76ab09ff72935937e1b9575bc45ffd">commit</a>)</li> <li>Add 3.14 and pypy-3.11 CI tasks (<a href="https://github.com/miguelgrinberg/python-socketio/commit/1f4cd3b025c294f25208ec3c05b5f8df6209e403">commit</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/miguelgrinberg/python-socketio/commit/d0cf60952281c0b8f41a7a73f01da8129da89032"><code>d0cf609</code></a> Release 5.16.4</li> <li><a href="https://github.com/miguelgrinberg/python-socketio/commit/4bec3ef87bcfd6ab5b94cd3ac09d873283a6960e"><code>4bec3ef</code></a> Delete incomplete binary packet when client disconnects</li> <li><a href="https://github.com/miguelgrinberg/python-socketio/commit/1e44ea3be1258ca2344872a98a4840743738080e"><code>1e44ea3</code></a> Bump socket.io-parser from 4.2.6 to 4.2.7 in /examples/client/javascript (<a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/15">#15</a>...</li> <li><a href="https://github.com/miguelgrinberg/python-socketio/commit/a8568a449f28a81decb2f3d7adc7b0a2af88e12c"><code>a8568a4</code></a> Bump aiohttp from 3.14.1 to 3.14.3 in /examples/server/aiohttp (<a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1591">#1591</a>) #nolog</li> <li><a href="https://github.com/miguelgrinberg/python-socketio/commit/3826ad453ba50b7d6876180a149a5b2fb0a01e73"><code>3826ad4</code></a> Bump body-parser from 1.20.5 to 1.20.6 in /examples/client/javascript (<a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1590">#1590</a>)...</li> <li><a href="https://github.com/miguelgrinberg/python-socketio/commit/2d21903008b185b66ee644bfe231bb953298e9b1"><code>2d21903</code></a> Remove failing codecov service</li> <li><a href="https://github.com/miguelgrinberg/python-socketio/commit/cb558519ffcc290974478902ceebd7d1a96a220e"><code>cb55851</code></a> Bump aiohttp from 3.14.0 to 3.14.1 in /examples/server/aiohttp (<a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1584">#1584</a>) #nolog</li> <li><a href="https://github.com/miguelgrinberg/python-socketio/commit/71585b1df83f36029b1ead9c1b4cb42da85192de"><code>71585b1</code></a> Bump tornado from 6.5.5 to 6.5.7 in /examples/server/tornado (<a href="https://redirect.github.com/miguelgrinberg/python-socketio/issues/1583">#1583</a>) #nolog</li> <li><a href="https://github.com/miguelgrinberg/python-socketio/commit/02950be3756c3baedd63b5109de9ddac0af10a99"><code>02950be</code></a> Version 5.16.4.dev0</li> <li>See full diff in <a href="https://github.com/miguelgrinberg/python-socketio/compare/v5.16.3...v5.16.4">compare view</a></li> </ul> </details> <br /> Updates `rarfile` from 4.4 to 4.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/markokr/rarfile/releases">rarfile's releases</a>.</em></p> <blockquote> <h2>rarfile v4.5</h2> <p>Security fixes:</p> <ul> <li>Skip comments that are larger than 256k.</li> </ul> <p>Fixes:</p> <ul> <li>Truncate filenames at NUL byte.</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/markokr/rarfile/blob/master/doc/news.rst">rarfile's changelog</a>.</em></p> <blockquote> <h2>Version 4.5 (2026-08-02)</h2> <p>Security fixes:</p> <ul> <li>Skip comments that are larger than 256k. [<code>GHSA-94vx-95fq-wwvp <https://github.com/markokr/rarfile/security/advisories/GHSA-94vx-95fq-wwvp></code>_]</li> </ul> <p>Fixes:</p> <ul> <li>Truncate filenames at NUL byte.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/markokr/rarfile/commit/60c8513276ea462c39822db487c10111b9039442"><code>60c8513</code></a> Refresh apt index</li> <li><a href="https://github.com/markokr/rarfile/commit/d62647091dc24bb384788c75b966d9dd4f0deaaf"><code>d626470</code></a> v4.4</li> <li><a href="https://github.com/markokr/rarfile/commit/8321daa5417a62adce0db160510a1cdc43744af0"><code>8321daa</code></a> Limit comment size</li> <li><a href="https://github.com/markokr/rarfile/commit/be6a4a69069852dcc16af3f6ad180e0266cbf15a"><code>be6a4a6</code></a> Truncate filenames at NUL</li> <li>See full diff in <a href="https://github.com/markokr/rarfile/compare/v4.4...v4.5">compare view</a></li> </ul> </details> <br /> Updates `seleniumbase` from 4.51.8 to 4.51.11 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/seleniumbase/SeleniumBase/releases">seleniumbase's releases</a>.</em></p> <blockquote> <h2>4.51.11 - CDP Mode: Patch 127</h2> <h2>CDP Mode: Patch 127</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/3ba187938eca01c8582c0c832b5d00c44105b96f">Fix memory leaks, fix bugs, and update timing</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/8372dbc85d60c504c678a738df648791d712aec1">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/710ae0abd46732bd145e578b6a22fb5eecde27b9">Update examples</a></li> </ul> <p>Special thanks to <a href="https://github.com/crippledgeek"><code>@crippledgeek</code></a> (<a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4454">seleniumbase/SeleniumBase#4454</a> and <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4455">seleniumbase/SeleniumBase#4455</a>)</p> <h2>What's Changed</h2> <ul> <li>CDP Mode: Patch 127 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4457">seleniumbase/SeleniumBase#4457</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.51.10...v4.51.11">https://github.com/seleniumbase/SeleniumBase/compare/v4.51.10...v4.51.11</a></p> <h2>4.51.10 - CDP Mode: Patch 126</h2> <h2>CDP Mode: Patch 126</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/a7e28ac407fc63afdcfbaadc642b5a97b77a1375">Patch the vendored version of nest_asyncio for Python 3.14+</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/076956c14a944b25ff191189b32123220e490fff">Update timing of stealthy CDP Mode clicks</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0455ee62040c1b5185430035fd851518a9c83b84">Refresh Python dependencies</a></li> </ul> <h2>What's Changed</h2> <ul> <li>CDP Mode: Patch 126 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4453">seleniumbase/SeleniumBase#4453</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.51.9...v4.51.10">https://github.com/seleniumbase/SeleniumBase/compare/v4.51.9...v4.51.10</a></p> <h2>4.51.9 - CDP Mode: Patch 125</h2> <h2>CDP Mode: Patch 125</h2> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/9954e1df1c17fd33a95999a78e011506d3e7bcc5">Fix non-authenticated proxy in the sb_cdp format</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/35bad5b60b1f47a54a129d8aeb01ac0dcabadccd">Refresh Python dependencies</a></li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/2bac11ba394f8edff0fff591f34400c946c01c62">Update CDP Mode examples</a></li> </ul> <h2>What's Changed</h2> <ul> <li>CDP Mode: Patch 125 by <a href="https://github.com/mdmintz"><code>@mdmintz</code></a> in <a href="https://redirect.github.com/seleniumbase/SeleniumBase/pull/4450">seleniumbase/SeleniumBase#4450</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.51.8...v4.51.9">https://github.com/seleniumbase/SeleniumBase/compare/v4.51.8...v4.51.9</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/85ca8c17da2bb85ca584c19ccc1773f64f0e1f8d"><code>85ca8c1</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4457">#4457</a> from seleniumbase/cdp-mode-patch-127</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/e5c180747c8fdc7da7990f6c8cf78fc166b5d801"><code>e5c1807</code></a> Version 4.51.11</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/710ae0abd46732bd145e578b6a22fb5eecde27b9"><code>710ae0a</code></a> Update examples</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/8372dbc85d60c504c678a738df648791d712aec1"><code>8372dbc</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/3ba187938eca01c8582c0c832b5d00c44105b96f"><code>3ba1879</code></a> Fix memory leaks, fix bugs, and update timing</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/58995fc57a3bc2e6169fde7a4b210c557d768e52"><code>58995fc</code></a> Merge pull request <a href="https://redirect.github.com/seleniumbase/SeleniumBase/issues/4453">#4453</a> from seleniumbase/cdp-mode-patch-126</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/9d98315c3989a4739d6e1b2aa1da7d0cb8a56732"><code>9d98315</code></a> Version 4.51.10</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/b050714d848b370bd7500acfc01010607b6cb6d3"><code>b050714</code></a> Update CDP Mode examples</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/0455ee62040c1b5185430035fd851518a9c83b84"><code>0455ee6</code></a> Refresh Python dependencies</li> <li><a href="https://github.com/seleniumbase/SeleniumBase/commit/076956c14a944b25ff191189b32123220e490fff"><code>076956c</code></a> Update timing of stealthy CDP Mode clicks</li> <li>Additional commits viewable in <a href="https://github.com/seleniumbase/SeleniumBase/compare/v4.51.8...v4.51.11">compare view</a></li> </ul> </details> <br /> Updates `prek` from 0.4.11 to 0.4.12 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/releases">prek's releases</a>.</em></p> <blockquote> <h2>0.4.12</h2> <h2>Release Notes</h2> <p>Released on 2026-08-03.</p> <h3>Enhancements</h3> <ul> <li>Add <code>--require-group</code> for hook group intersections (<a href="https://redirect.github.com/j178/prek/pull/2472">#2472</a>)</li> <li>Align fast-path and builtin pre-commit hooks (<a href="https://redirect.github.com/j178/prek/pull/2433">#2433</a>)</li> <li>Do not shuffle file list for verbose output (<a href="https://redirect.github.com/j178/prek/pull/2431">#2431</a>)</li> <li>Improve top-level command descriptions (<a href="https://redirect.github.com/j178/prek/pull/2429">#2429</a>)</li> <li>Install <code>uv</code> from Astral CDN and drop source racing (<a href="https://redirect.github.com/j178/prek/pull/2455">#2455</a>)</li> <li>Make <code>prek install --force</code> bypass external hooks paths (<a href="https://redirect.github.com/j178/prek/pull/2437">#2437</a>)</li> <li>Show builtin hook flags in verbose list output (<a href="https://redirect.github.com/j178/prek/pull/2427">#2427</a>)</li> <li>Verify uv release archive checksums (<a href="https://redirect.github.com/j178/prek/pull/2456">#2456</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Precompute file tags in parallel (<a href="https://redirect.github.com/j178/prek/pull/2440">#2440</a>)</li> <li>Skip diffs after known hook modifications (<a href="https://redirect.github.com/j178/prek/pull/2447">#2447</a>)</li> <li>Skip worktree diffs for read-only languages (<a href="https://redirect.github.com/j178/prek/pull/2432">#2432</a>)</li> <li>Track builtin hook file changes directly (<a href="https://redirect.github.com/j178/prek/pull/2404">#2404</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Use full object IDs in diff snapshots (<a href="https://redirect.github.com/j178/prek/pull/2448">#2448</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add a multi-repository configuration example (<a href="https://redirect.github.com/j178/prek/pull/2434">#2434</a>)</li> <li>Rewrite benchmark documentation (<a href="https://redirect.github.com/j178/prek/pull/2469">#2469</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178"><code>@j178</code></a></li> <li><a href="https://github.com/BitWeaverDev"><code>@BitWeaverDev</code></a></li> <li><a href="https://github.com/allanlewis"><code>@allanlewis</code></a></li> </ul> <h2>Install prek 0.4.12</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://github.com/j178/prek/releases/download/v0.4.12/prek-installer.ps1 | iex" </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/j178/prek/blob/master/CHANGELOG.md">prek's changelog</a>.</em></p> <blockquote> <h2>0.4.12</h2> <p>Released on 2026-08-03.</p> <h3>Enhancements</h3> <ul> <li>Add <code>--require-group</code> for hook group intersections (<a href="https://redirect.github.com/j178/prek/pull/2472">#2472</a>)</li> <li>Align fast-path and builtin pre-commit hooks (<a href="https://redirect.github.com/j178/prek/pull/2433">#2433</a>)</li> <li>Do not shuffle file list for verbose output (<a href="https://redirect.github.com/j178/prek/pull/2431">#2431</a>)</li> <li>Improve top-level command descriptions (<a href="https://redirect.github.com/j178/prek/pull/2429">#2429</a>)</li> <li>Install <code>uv</code> from Astral CDN and drop source racing (<a href="https://redirect.github.com/j178/prek/pull/2455">#2455</a>)</li> <li>Make <code>prek install --force</code> bypass external hooks paths (<a href="https://redirect.github.com/j178/prek/pull/2437">#2437</a>)</li> <li>Show builtin hook flags in verbose list output (<a href="https://redirect.github.com/j178/prek/pull/2427">#2427</a>)</li> <li>Verify uv release archive checksums (<a href="https://redirect.github.com/j178/prek/pull/2456">#2456</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Precompute file tags in parallel (<a href="https://redirect.github.com/j178/prek/pull/2440">#2440</a>)</li> <li>Skip diffs after known hook modifications (<a href="https://redirect.github.com/j178/prek/pull/2447">#2447</a>)</li> <li>Skip worktree diffs for read-only languages (<a href="https://redirect.github.com/j178/prek/pull/2432">#2432</a>)</li> <li>Track builtin hook file changes directly (<a href="https://redirect.github.com/j178/prek/pull/2404">#2404</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Use full object IDs in diff snapshots (<a href="https://redirect.github.com/j178/prek/pull/2448">#2448</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Add a multi-repository configuration example (<a href="https://redirect.github.com/j178/prek/pull/2434">#2434</a>)</li> <li>Rewrite benchmark documentation (<a href="https://redirect.github.com/j178/prek/pull/2469">#2469</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/j178"><code>@j178</code></a></li> <li><a href="https://github.com/BitWeaverDev"><code>@BitWeaverDev</code></a></li> <li><a href="https://github.com/allanlewis"><code>@allanlewis</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/j178/prek/commit/728238cf01e7b9e9ee8d1457f20c772fdc8e8426"><code>728238c</code></a> Bump version to 0.4.12 (<a href="https://redirect.github.com/j178/prek/issues/2473">#2473</a>)</li> <li><a href="https://github.com/j178/prek/commit/e5403ca77cf44eb2d285328f0dd63386efddbddd"><code>e5403ca</code></a> Add <code>--require-group</code> for hook group intersections (<a href="https://redirect.github.com/j178/prek/issues/2472">#2472</a>)</li> <li><a href="https://github.com/j178/prek/commit/370fc41b6b520b5fa0e34deb80d6415fc4417f7d"><code>370fc41</code></a> Use ssl-certs to load custom certificates (<a href="https://redirect.github.com/j178/prek/issues/2470">#2470</a>)</li> <li><a href="https://github.com/j178/prek/commit/7cc64cac5f95c71b152406dd63658499ede597fe"><code>7cc64ca</code></a> Rewrite benchmark documentation (<a href="https://redirect.github.com/j178/prek/issues/2469">#2469</a>)</li> <li><a href="https://github.com/j178/prek/commit/6a81c105d682e48bd5cff68533cf66ec150f19c1"><code>6a81c10</code></a> Update ubuntu Docker tag to v26 (<a href="https://redirect.github.com/j178/prek/issues/2466">#2466</a>)</li> <li><a href="https://github.com/j178/prek/commit/500a9d4149febbe639b8ac01fe1f8065ba5204ec"><code>500a9d4</code></a> Run Conda tests sequentially (<a href="https://redirect.github.com/j178/prek/issues/2468">#2468</a>)</li> <li><a href="https://github.com/j178/prek/commit/ebc1c38f41a44995394fb2c0f4ba971763d23be5"><code>ebc1c38</code></a> Run .NET tests sequentially on Unix (<a href="https://redirect.github.com/j178/prek/issues/2467">#2467</a>)</li> <li><a href="https://github.com/j178/prek/commit/88fec177545361e7b2618b84defc8d24195ad048"><code>88fec17</code></a> Update Rust crate tokio-util to v0.7.19 (<a href="https://redirect.github.com/j178/prek/issues/2463">#2463</a>)</li> <li><a href="https://github.com/j178/prek/commit/9d9c9f504a62b78c6b2154273d635b080c69e625"><code>9d9c9f5</code></a> Use full object IDs in diff snapshots (<a href="https://redirect.github.com/j178/prek/issues/2448">#2448</a>)</li> <li><a href="https://github.com/j178/prek/commit/0c7fc8474377fde1811eec879eb0a42010129d80"><code>0c7fc84</code></a> Update Rust crate tokio to v1.53.1 (<a href="https://redirect.github.com/j178/prek/issues/2462">#2462</a>)</li> <li>Additional commits viewable in <a href="https://github.com/j178/prek/compare/v0.4.11...v0.4.12">compare view</a></li> </ul> </details> <br /> Updates `ruff` from 0.16.1 to 0.16.2 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/releases">ruff's releases</a>.</em></p> <blockquote> <h2>0.16.2</h2> <h2>Release Notes</h2> <p>Released on 2026-08-06.</p> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-pyi</code>] Avoid false positives on <code>singledispatch</code> functions (<code>PYI041</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27335">#27335</a>)</li> </ul> <h3>Server</h3> <ul> <li>Register formatting capabilities dynamically to exclude TOML files (<a href="https://redirect.github.com/astral-sh/ruff/pull/27332">#27332</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/MeGaGiGaGon"><code>@MeGaGiGaGon</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/epage"><code>@epage</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> </ul> <h2>Install ruff 0.16.2</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-installer.ps1 | iex" </code></pre> <h2>Download ruff 0.16.2</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-aarch64-apple-darwin.tar.gz">ruff-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-x86_64-apple-darwin.tar.gz">ruff-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-aarch64-pc-windows-msvc.zip">ruff-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-i686-pc-windows-msvc.zip">ruff-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-x86_64-pc-windows-msvc.zip">ruff-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-aarch64-unknown-linux-gnu.tar.gz">ruff-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-i686-unknown-linux-gnu.tar.gz">ruff-i686-unknown-linux-gnu.tar.gz</a></td> <td>x86 Linux</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-i686-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-powerpc64-unknown-linux-gnu.tar.gz">ruff-powerpc64-unknown-linux-gnu.tar.gz</a></td> <td>PPC64 Linux</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-powerpc64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-powerpc64le-unknown-linux-gnu.tar.gz">ruff-powerpc64le-unknown-linux-gnu.tar.gz</a></td> <td>PPC64LE Linux</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-powerpc64le-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-riscv64gc-unknown-linux-gnu.tar.gz">ruff-riscv64gc-unknown-linux-gnu.tar.gz</a></td> <td>RISCV Linux</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-riscv64gc-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-s390x-unknown-linux-gnu.tar.gz">ruff-s390x-unknown-linux-gnu.tar.gz</a></td> <td>S390x Linux</td> <td><a href="https://releases.astral.sh/github/ruff/releases/download/0.16.2/ruff-s390x-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md">ruff's changelog</a>.</em></p> <blockquote> <h2>0.16.2</h2> <p>Released on 2026-08-06.</p> <h3>Bug fixes</h3> <ul> <li>[<code>flake8-pyi</code>] Avoid false positives on <code>singledispatch</code> functions (<code>PYI041</code>) (<a href="https://redirect.github.com/astral-sh/ruff/pull/27335">#27335</a>)</li> </ul> <h3>Server</h3> <ul> <li>Register formatting capabilities dynamically to exclude TOML files (<a href="https://redirect.github.com/astral-sh/ruff/pull/27332">#27332</a>)</li> </ul> <h3>Contributors</h3> <ul> <li><a href="https://github.com/MeGaGiGaGon"><code>@MeGaGiGaGon</code></a></li> <li><a href="https://github.com/charliermarsh"><code>@charliermarsh</code></a></li> <li><a href="https://github.com/epage"><code>@epage</code></a></li> <li><a href="https://github.com/sharkdp"><code>@sharkdp</code></a></li> <li><a href="https://github.com/ntBre"><code>@ntBre</code></a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/ruff/commit/5b48a040974781ba90b47c8df628f8fd9b6c95dd"><code>5b48a04</code></a> Bump 0.16.2 (<a href="https://redirect.github.com/astral-sh/ruff/issues/27555">#27555</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/1b9e5fc483b95a01fe02ff104820280b1b32e8ae"><code>1b9e5fc</code></a> Update Swatinem/rust-cache action to v2.9.2 (<a href="https://redirect.github.com/astral-sh/ruff/issues/27568">#27568</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/c4e86fc0394c92a9334ba2eb026c77c21db403be"><code>c4e86fc</code></a> [ty] Add helper extension methods for half-range and equality constraints (<a href="https://redirect.github.com/astral-sh/ruff/issues/2">#2</a>...</li> <li><a href="https://github.com/astral-sh/ruff/commit/17a00de2e298612201a8fe30790e9399204af1b9"><code>17a00de</code></a> [ty] Reuse primer commands in memory reports (<a href="https://redirect.github.com/astral-sh/ruff/issues/27553">#27553</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/6ea296b96923e142eb13af2bc6ad261c280d8eb1"><code>6ea296b</code></a> [ty] Normalize type labels in structured docstrings (<a href="https://redirect.github.com/astral-sh/ruff/issues/26923">#26923</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/2fc445f0053f4ec27c717fae0de3671d73c103be"><code>2fc445f</code></a> [ty] Diagnose invalid <strong>getattr</strong> calls (<a href="https://redirect.github.com/astral-sh/ruff/issues/27502">#27502</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/22c7823c4e8bffcca97688d8438c9b567d6817d8"><code>22c7823</code></a> [ty] Enable (but downrank) auto-import completion suggestions from stub-only ...</li> <li><a href="https://github.com/astral-sh/ruff/commit/05160d507f05345a72db9c28ab4edf7c92334819"><code>05160d5</code></a> [ty] Diagnose invalid descriptor <code>__get__</code> calls (<a href="https://redirect.github.com/astral-sh/ruff/issues/27400">#27400</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/baea3d0dcec6d6f6d1659321940f3725771c5f45"><code>baea3d0</code></a> [ty] Expose strict analysis options in the playground (<a href="https://redirect.github.com/astral-sh/ruff/issues/27543">#27543</a>)</li> <li><a href="https://github.com/astral-sh/ruff/commit/c88946ebeb92be6d276087f0d528cd6471df4ead"><code>c88946e</code></a> [ty] Bump ecosystem-analyzer for strict project settings (<a href="https://redirect.github.com/astral-sh/ruff/issues/27542">#27542</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/ruff/compare/0.16.1...0.16.2">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 Guflly
|
3c51b7cfaa |
Fix OIDC redirects on custom ports (#1180)
Fixes #1175 Preserves the forwarded host and port when Shelfmark builds OIDC callback URLs. The reverse-proxy examples now retain custom ports as well. Tests: - `uv run pytest -n 0 -q tests/core/test_proxy_headers.py tests/core/test_oidc_routes.py` - `uv run ruff check shelfmark/main.py tests/core/test_proxy_headers.py` - `uv run ruff format --check shelfmark/main.py tests/core/test_proxy_headers.py` |
||
  FlyinPancakeandCopilot Autofix powered by AI
|
3a9cff9816 |
feat(metadata): add Moly.hu metadata provider (#1172)
First of all, I don't know if you even want to merge a scraper-based metadata provider. I made this just for my use-case. If you'd rather not, I completely understand it. An alternative would be adopting [Audiobookshelf's Metadata Provider API](https://audiobookshelf.org/docs/documentation/community/community-providers) which I contributed to it for exactly the reason to not have scrapers. ## What Adds [Moly.hu](https://moly.hu) — the Hungarian community book catalog — as a metadata provider, following the existing provider plugin architecture (`@register_provider` + settings tab with enable checkbox and Test Connection button, disabled by default). ## Why None of the current providers cover Hungarian editions well: Hardcover and Open Library rarely index them, and Google Books coverage is spotty. Moly.hu is the de-facto catalog for Hungarian books (local editions *and* Hungarian translations of foreign works). With this provider, Universal mode works end-to-end for Hungarian titles: moly search → localized title/author feed the release search → indexers that carry Hungarian content can actually match. Related pain points: #595 (books missing from metadata providers), #1035 (interest in niche sources). ## How - HTML scraping with BeautifulSoup (already a dependency), no API key needed - Scraping approach (search URL, page structure, language-tag mapping) adapted from the long-lived Calibre `Moly_hu` plugin (GPL v3, credited in the module docstring), with fallback selector chains inherited from it - Sliding-window rate limit (30 req/min) to stay polite to a small community site - Standard `@cacheable` decorators; fetch failures return `None` so they are not cached (same behavior as the Google Books provider) - Search results carry cover thumbnails, rating and series info as display fields; `get_book` parses title (zero-width chars stripped, nested series link excluded), authors, ISBN-13/10, publisher, publish year, description (spoiler-warning prefix stripped), tags/genres, cover, and language (from moly's language tags, defaulting to `hu`) - ISBN search resolves through moly's site search ## Testing - `tests/metadata/test_moly_parse.py`: offline tests with fixture HTML mirroring live moly.hu markup — search parsing/dedup, pagination guard, failure-not-cached behavior, book-page parsing, ISBN resolution, ISBN validation helper - `uv run pytest tests/metadata` green (45 passed), `ruff check` / `ruff format` clean - Verified live against moly.hu (search, get_book, ISBN lookup) and running in Docker alongside Hardcover --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> |