mirror of
https://github.com/calibrain/shelfmark.git
synced 2026-11-14 18:18:34 +00:00
e575ff0fcb586bc0aa0600a2ea198d5b8c05dd5d
82
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 dependabot[bot]
|
b1a1f46096 |
build(deps): bump astral-sh/uv from 0.13.6 to 0.13.7 in the docker-base-image-digests group (#1670)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.13.6 to 0.13.7 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.13.7</h2> <h2>Release Notes</h2> <p>Released on 2026-11-03.</p> <h3>Preview features</h3> <ul> <li>Add <code>--output-version</code> to <code>uv workspace metadata</code> for requesting a specific schema version (<a href="https://redirect.github.com/astral-sh/uv/pull/22958">#22958</a>)</li> <li>Report aliased OSV records as a single vulnerability in <code>uv audit</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22990">#22990</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Treat workspace member paths added by <code>uv init</code> or <code>uv add</code> as literals instead of glob patterns (<a href="https://redirect.github.com/astral-sh/uv/pull/23008">#23008</a>)</li> <li>Prevent uv's Windows trampolines from closing handles they did not inherit (<a href="https://redirect.github.com/astral-sh/uv/pull/22977">#22977</a>)</li> <li>Allow <code>uvx</code> to run tools with CPython builds whose versions contain local identifiers (<a href="https://redirect.github.com/astral-sh/uv/pull/23013">#23013</a>)</li> <li>Generate valid module names when <code>uv init</code> creates packaged projects whose names start with a digit (<a href="https://redirect.github.com/astral-sh/uv/pull/23022">#23022</a>)</li> <li>Preserve comments around existing inline dependency groups when <code>uv add</code> updates a group (<a href="https://redirect.github.com/astral-sh/uv/pull/23017">#23017</a>)</li> <li>Allow <code>uv remove</code> with an empty inline <code>tool.uv.sources</code> table (<a href="https://redirect.github.com/astral-sh/uv/pull/23012">#23012</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Correct the <code>cache-keys</code> inline table example (<a href="https://redirect.github.com/astral-sh/uv/pull/22984">#22984</a>)</li> </ul> <h2>Install uv 0.13.7</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-installer.ps1 | iex" </code></pre> <h2>Download uv 0.13.7</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-i686-unknown-linux-gnu.tar.gz">uv-i686-unknown-linux-gnu.tar.gz</a></td> <td>x86 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-i686-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-powerpc64le-unknown-linux-gnu.tar.gz">uv-powerpc64le-unknown-linux-gnu.tar.gz</a></td> <td>PPC64LE Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-riscv64gc-unknown-linux-gnu.tar.gz">uv-riscv64gc-unknown-linux-gnu.tar.gz</a></td> <td>RISCV Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.13.7/uv-riscv64gc-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.13.7</h2> <p>Released on 2026-11-03.</p> <h3>Preview features</h3> <ul> <li>Add <code>--output-version</code> to <code>uv workspace metadata</code> for requesting a specific schema version (<a href="https://redirect.github.com/astral-sh/uv/pull/22958">#22958</a>)</li> <li>Report aliased OSV records as a single vulnerability in <code>uv audit</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22990">#22990</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Treat workspace member paths added by <code>uv init</code> or <code>uv add</code> as literals instead of glob patterns (<a href="https://redirect.github.com/astral-sh/uv/pull/23008">#23008</a>)</li> <li>Prevent uv's Windows trampolines from closing handles they did not inherit (<a href="https://redirect.github.com/astral-sh/uv/pull/22977">#22977</a>)</li> <li>Allow <code>uvx</code> to run tools with CPython builds whose versions contain local identifiers (<a href="https://redirect.github.com/astral-sh/uv/pull/23013">#23013</a>)</li> <li>Generate valid module names when <code>uv init</code> creates packaged projects whose names start with a digit (<a href="https://redirect.github.com/astral-sh/uv/pull/23022">#23022</a>)</li> <li>Preserve comments around existing inline dependency groups when <code>uv add</code> updates a group (<a href="https://redirect.github.com/astral-sh/uv/pull/23017">#23017</a>)</li> <li>Allow <code>uv remove</code> with an empty inline <code>tool.uv.sources</code> table (<a href="https://redirect.github.com/astral-sh/uv/pull/23012">#23012</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Correct the <code>cache-keys</code> inline table example (<a href="https://redirect.github.com/astral-sh/uv/pull/22984">#22984</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/316c827e058c16b71d5c507a20729c2995a7bcce"><code>316c827</code></a> Bump version to 0.13.7 (<a href="https://redirect.github.com/astral-sh/uv/issues/23068">#23068</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/917b4c31531e6933c20596b65b49e75c83ff7d93"><code>917b4c3</code></a> Update Rust crate tokio-rustls to v0.26.6 (<a href="https://redirect.github.com/astral-sh/uv/issues/23048">#23048</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/baec6ce829bea457e5452906144115940e1ea896"><code>baec6ce</code></a> Update conda-incubator/setup-miniconda action to v4.1.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23032">#23032</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/da8bbd3365161177fc30909aa0b84d45e8811f09"><code>da8bbd3</code></a> Update fedora Docker tag to v46 (<a href="https://redirect.github.com/astral-sh/uv/issues/23033">#23033</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3db723cf104c685b9f2f31a26834b7d417db652f"><code>3db723c</code></a> Update Rust crate cargo-util to v0.2.32 (<a href="https://redirect.github.com/astral-sh/uv/issues/23045">#23045</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/28c0c65cd01ba9430787eef2f933740095609e09"><code>28c0c65</code></a> Update Rust crate uuid to v1.27.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23052">#23052</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/77168783ec37c93a786fce4bbaabe58d1255c22f"><code>7716878</code></a> Update Rust crate insta to v1.49.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23051">#23051</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3be10e3890b942cb7509e656245b46e7ad63d650"><code>3be10e3</code></a> Update dependency <code>@openai/codex</code> to v0.160.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23050">#23050</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/8eb756a2e7a4a8380d49a3edd6224da4c5af4cea"><code>8eb756a</code></a> Update CodSpeedHQ/action action to v5.4.0 (<a href="https://redirect.github.com/astral-sh/uv/issues/23049">#23049</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/632df30b8e8c8ed1dbba309cc79c2608a63da155"><code>632df30</code></a> Update Rust crate spdx to v0.13.6 (<a href="https://redirect.github.com/astral-sh/uv/issues/23047">#23047</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.13.6...0.13.7">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> <!-- coderabbit-ai-generated:v1 --> ## Summary by CodeRabbit * **Chores** * Updated the build environment’s `uv` version. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 splitsec2
|
99d842b381 |
build(docker): install Chromium from trixie-security without the snapshot pin (#1648)
Following the discussion on #1635, this drops the Chromium snapshot pin and the apt preference, and installs whatever trixie-security currently ships. Thanks @calibrain for suggesting we try it. With no pin there is nothing left to go stale, so the scheduled check that issue asked for isn't needed. Closes #1635. I built the image from this branch and ran it as a scratch container. It has Chromium 156.0.8078.79, and the bypass cleared DDoS-Guard on Anna's Archive and returned search results. That challenge cleared on the auto-wait step, so the click path wasn't exercised, same as the open question in #1635. One thing to know: the build cache is keyed on the Dockerfile text, so a newer Debian Chromium only lands when that layer rebuilds, for example on a base image bump. |
||
|
splitsec2
|
c6685feba5 |
fix(docker): drop ffmpeg from the default image; install on demand in Debug mode (#1631)
ffmpeg is in the default image for one thing, the Debug mode screen recording (`_start_ffmpeg_recording`). Nothing else calls it, SeleniumBase included, and it brings 93 packages with it. On real builds that's 406 Trivy findings (149 High) and 78 MB of the gzipped amd64 image. This takes it out of the image and installs it when Debug mode needs it. It came out of the base image discussion on #1616 and helps on any base, though on Wolfi the install line would need `apk`. ## What changed - **Dockerfile:** ffmpeg is gone from the full image's install. - **Guard:** `_start_ffmpeg_recording` checks `shutil.which("ffmpeg")` first. If it's missing it logs a warning and returns, and the bypass carries on. Without this, Debug on with no ffmpeg fails every bypass with `FileNotFoundError`. There's a new test for it. - **Entrypoint:** when Debug is on, the internal bypasser is in use and ffmpeg isn't already there, it installs ffmpeg in the background so the app doesn't wait for it. The download and the install each run under a 120 s `timeout` with `DEBIAN_FRONTEND=noninteractive`. Downloading first means a hung mirror can only be killed before dpkg starts, and the next start runs `dpkg --configure -a` in case a restart cut dpkg off. It logs when it starts, succeeds, times out or fails. - **Docs:** a short paragraph in `docs/troubleshooting.md` covering the install and the non-root limit. ## Debug has two sources Debug can come from the `DEBUG` env var or from the Debug Mode setting in the UI, which is saved to `/config/plugins/advanced.json`. The existing block in `entrypoint.sh` only reads the env var, so an install keyed on `$DEBUG` would miss anyone who turned it on in the UI. The new check asks the app instead (`shelfmark.config.env.DEBUG`), which reads both. The UI setting is `requires_restart`, so the restart it already asks for is what brings it through the entrypoint. ## Non-root mode A container started as `1000:1000` can't run `apt-get`, so the entrypoint logs that it can't install ffmpeg, the guard warns on each bypass, and there's no recording. Everything else works. The workaround for a debugging session is to start as root with `PUID`/`PGID`. ## Startup cost None that I could measure. With Debug on, `/api/health` answers in the same time as main (3-4 s with Debug only in config, 9-10 s from env), and ffmpeg was ready 6-8 s later on the runners. The trade-off is that the first bypass after startup may be unrecorded while the install runs. It logs the warning and passes. I saw both outcomes on a bypass started right after health. From reading the code: the install lives in the container, so recreating the container installs it again. It also runs after `tor.sh` and `wireguard.sh`, so apt goes through whichever egress is active. ## Testing Real Docker builds on GitHub Actions on my fork, amd64 and arm64, with the same result on both for every case below. | Case | Result | |---|---| | Debug off | No install, `/api/health` in 3-4 s, same as main | | Debug only in config | Health in 3-4 s, ffmpeg ready 6-8 s later, real mp4 after a bypass | | Debug from env | Health in 9-10 s (same as main), real mp4 after a bypass | | Started as root, app dropped to uid 1000 | Smoke and bypass pass | | Started with `--user 1000`, Debug on | Logs both messages, bypass passes, no mp4 | | apt blocked (closed proxy) | Logs `Could not install ffmpeg`, bypass passes, no mp4 | | apt's proxy on a dropped address, so no TCP reply at all | Health in 9-10 s, a bypass during the install passes with the warning and no mp4. apt gives up by itself in under a minute. Nothing left running, `dpkg --audit` clean | | DNS server on a dropped address | Health in 9-10 s, `Timed out installing ffmpeg after 120s`. Nothing left running, `dpkg --audit` clean | | `--network none`, Debug on | No hang, health 200 from inside the container | | Container restarted while dpkg was running | Next start finishes the install, `dpkg --audit` clean, real mp4 | | Fresh named volume, Debug only in config | Recording made, uid 1000 can write | | Existing uid-1000 volume, Debug only in config | Same, nothing root-owned afterwards | | `find /config /var/log/shelfmark -user root` | 0 files, same as main | | `find /app -user root` | 245, same count as main | | `tests/e2e/platform/run-e2e.sh` with `dns-blocked` and `baseline` | Pass | The bypass checks ran against example.com. A real Cloudflare challenge was served by a demo page in the same runs, and no build solved it, including main, so that part doesn't say anything about this change. Locally: 5494 Python tests pass, and `ruff`, `basedpyright`, `vulture` and `shellcheck` are clean. The full results are in [the base image report](https://github.com/splitsec2/shelfmark/blob/7afcecfb76727724a71561cbc078f091569b58dc/docs/research/2026-11-01-base-image-report.md). |
||
|
splitsec2
|
d04268c639 |
fix(docker): drop the unused selenium-manager binaries from the image (#1615)
Came out of looking at what is in the image after @wrycu's #1606. The selenium package ships prebuilt `selenium-manager` binaries for four platforms (about 22MB uncompressed), and none of them are used here. They only run when selenium has to find a webdriver, and the bypasser drives the browser through SeleniumBase's Pure-CDP driver, which doesn't use one. This deletes them (and their SBOM file) in the same `RUN` as `uv sync`, so the layer doesn't carry them. As a side effect image scanners stop reporting on the Rust crates compiled into those binaries. To check nothing needs them, I deleted the files in a throwaway container from the current `dev` image and ran `internal_bypasser.get()` against example.com. It started the browser, loaded the page and returned it, same as without the deletion. I haven't run a full image build of this branch, so CI is the first time that exact `RUN` line gets executed. TL;DR dropping an unused feature from an included package lowering size and eliminating flags for security vulnerabilities that don't get exercised. @calibrain this one is optional too, but I don't see a downside, your call. |
||
|
splitsec2
|
3d7d04256f |
fix(docker): bump Chromium pin to 156.0.8078.73 (#1614)
Debian has a newer Chromium in trixie-security (156.0.8078.73), so this moves the pin from .47 to .73 and the snapshot to 20261029T020000Z, the first one that has it for both amd64 and arm64. Same shape as #1601. To check the bypasser still works on it, I started a throwaway container from the current `dev` image, upgraded Chromium to .73 the way the Dockerfile does, and ran `internal_bypasser.get()` against example.com. It starts, loads the page and returns it, the same as on .47. I also pointed both versions at the Cloudflare demo challenge page at scrapingcourse.com. They behave the same there, but neither one solves it from where I ran it (same challenge detected 4 times, then abort), so that only shows no difference, not a working solve. I also ran it against an Anna's Archive search page on both versions. Both returned the full results page, but the log shows no bypass attempts, so that mirror didn't serve a challenge from where I ran it and the solver itself wasn't exercised. @calibrain your call on if we should update to this, it is minor bump to what has already been pushed. |
||
|
dependabot[bot]
|
b2e3c1faf1 |
build(deps): bump python from 3.14.8-slim to 3.14.9-slim (#1610)
Bumps python from 3.14.8-slim to 3.14.9-slim. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
833698fd33 |
build(deps): bump astral-sh/uv from 0.13.5 to 0.13.6 in the docker-base-image-digests group (#1609)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.13.5 to 0.13.6 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.13.6</h2> <h2>Release Notes</h2> <p>Released on 2026-10-26.</p> <h3>Enhancements</h3> <ul> <li>Accept an empty <code>UV_RUN_RECURSION_DEPTH</code> as zero and report invalid values consistently (<a href="https://redirect.github.com/astral-sh/uv/pull/22814">#22814</a>)</li> <li>Explain how to add project metadata when <code>uv init</code> finds a <code>pyproject.toml</code> without a <code>[project]</code> table (<a href="https://redirect.github.com/astral-sh/uv/pull/22916">#22916</a>)</li> </ul> <h3>Python</h3> <ul> <li>Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 (<a href="https://redirect.github.com/astral-sh/uv/pull/22938">#22938</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Detect NVIDIA GPU capabilities when selecting compatible wheel variants with <code>wheel-variants</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22690">#22690</a>)</li> <li>Nest each module's owners in an object in <code>uv workspace metadata</code> output (<a href="https://redirect.github.com/astral-sh/uv/pull/22638">#22638</a>)</li> <li>Report the unsupported properties required by an incompatible wheel variant (<a href="https://redirect.github.com/astral-sh/uv/pull/22719">#22719</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce peak memory use when resolving large workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/22860">#22860</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22863">#22863</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22864">#22864</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22866">#22866</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22870">#22870</a>)</li> <li>Reduce peak memory use when locking or upgrading large projects (<a href="https://redirect.github.com/astral-sh/uv/pull/22833">#22833</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22834">#22834</a>)</li> <li>Speed up redirected output from <code>uv export</code> and <code>uv pip compile</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22840">#22840</a>)</li> <li>Reuse cached or active environments when running PEP 723 scripts without dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21458">#21458</a>)</li> <li>Reduce parsing overhead for build dependency and build backend settings (<a href="https://redirect.github.com/astral-sh/uv/pull/22848">#22848</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22871">#22871</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22879">#22879</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22884">#22884</a>)</li> <li>Reduce parsing overhead for project sources and workspace references (<a href="https://redirect.github.com/astral-sh/uv/pull/22880">#22880</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22883">#22883</a>)</li> <li>Reduce parsing overhead for cache, exclusion, cutoff, and preview settings (<a href="https://redirect.github.com/astral-sh/uv/pull/22876">#22876</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22877">#22877</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22878">#22878</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22887">#22887</a>)</li> <li>Reduce PyPI metadata parsing overhead (<a href="https://redirect.github.com/astral-sh/uv/pull/22874">#22874</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22875">#22875</a>)</li> <li>Speed up parsing tool receipt requirements (<a href="https://redirect.github.com/astral-sh/uv/pull/22885">#22885</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Prevent <code>uv run --active --script</code> and <code>uv sync --active --script</code> from deleting non-virtual-environment directories (<a href="https://redirect.github.com/astral-sh/uv/pull/21464">#21464</a>)</li> <li>Use <code>AMD64</code> for <code>platform_machine</code> when resolving for x86-64 Windows (<a href="https://redirect.github.com/astral-sh/uv/pull/22935">#22935</a>)</li> <li>Preserve free-threaded and other non-default variants in <code>uv python upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22836">#22836</a>)</li> <li>Allow <code>uv init --no-package</code> and <code>uv init --script</code> when <code>UV_INIT_BUILD_BACKEND</code> is set (<a href="https://redirect.github.com/astral-sh/uv/pull/22907">#22907</a>)</li> <li>Prevent panics when rendering containment markers with local versions (<a href="https://redirect.github.com/astral-sh/uv/pull/22815">#22815</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Update the Docker guide and reproduction examples to use uv 0.13.5 (<a href="https://redirect.github.com/astral-sh/uv/pull/22867">#22867</a>)</li> </ul> <h2>Install uv 0.13.6</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.6/uv-installer.sh | sh </tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.13.6</h2> <p>Released on 2026-10-26.</p> <h3>Enhancements</h3> <ul> <li>Accept an empty <code>UV_RUN_RECURSION_DEPTH</code> as zero and report invalid values consistently (<a href="https://redirect.github.com/astral-sh/uv/pull/22814">#22814</a>)</li> <li>Explain how to add project metadata when <code>uv init</code> finds a <code>pyproject.toml</code> without a <code>[project]</code> table (<a href="https://redirect.github.com/astral-sh/uv/pull/22916">#22916</a>)</li> </ul> <h3>Python</h3> <ul> <li>Add CPython 3.11.18, 3.12.16, 3.13.18, 3.14.10, and 3.15.2 (<a href="https://redirect.github.com/astral-sh/uv/pull/22938">#22938</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Detect NVIDIA GPU capabilities when selecting compatible wheel variants with <code>wheel-variants</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22690">#22690</a>)</li> <li>Nest each module's owners in an object in <code>uv workspace metadata</code> output (<a href="https://redirect.github.com/astral-sh/uv/pull/22638">#22638</a>)</li> <li>Report the unsupported properties required by an incompatible wheel variant (<a href="https://redirect.github.com/astral-sh/uv/pull/22719">#22719</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce peak memory use when resolving large workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/22860">#22860</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22863">#22863</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22864">#22864</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22866">#22866</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22870">#22870</a>)</li> <li>Reduce peak memory use when locking or upgrading large projects (<a href="https://redirect.github.com/astral-sh/uv/pull/22833">#22833</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22834">#22834</a>)</li> <li>Speed up redirected output from <code>uv export</code> and <code>uv pip compile</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22840">#22840</a>)</li> <li>Reuse cached or active environments when running PEP 723 scripts without dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21458">#21458</a>)</li> <li>Reduce parsing overhead for build dependency and build backend settings (<a href="https://redirect.github.com/astral-sh/uv/pull/22848">#22848</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22871">#22871</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22879">#22879</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22884">#22884</a>)</li> <li>Reduce parsing overhead for project sources and workspace references (<a href="https://redirect.github.com/astral-sh/uv/pull/22880">#22880</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22883">#22883</a>)</li> <li>Reduce parsing overhead for cache, exclusion, cutoff, and preview settings (<a href="https://redirect.github.com/astral-sh/uv/pull/22876">#22876</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22877">#22877</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22878">#22878</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22887">#22887</a>)</li> <li>Reduce PyPI metadata parsing overhead (<a href="https://redirect.github.com/astral-sh/uv/pull/22874">#22874</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22875">#22875</a>)</li> <li>Speed up parsing tool receipt requirements (<a href="https://redirect.github.com/astral-sh/uv/pull/22885">#22885</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Prevent <code>uv run --active --script</code> and <code>uv sync --active --script</code> from deleting non-virtual-environment directories (<a href="https://redirect.github.com/astral-sh/uv/pull/21464">#21464</a>)</li> <li>Use <code>AMD64</code> for <code>platform_machine</code> when resolving for x86-64 Windows (<a href="https://redirect.github.com/astral-sh/uv/pull/22935">#22935</a>)</li> <li>Preserve free-threaded and other non-default variants in <code>uv python upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22836">#22836</a>)</li> <li>Allow <code>uv init --no-package</code> and <code>uv init --script</code> when <code>UV_INIT_BUILD_BACKEND</code> is set (<a href="https://redirect.github.com/astral-sh/uv/pull/22907">#22907</a>)</li> <li>Prevent panics when rendering containment markers with local versions (<a href="https://redirect.github.com/astral-sh/uv/pull/22815">#22815</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Update the Docker guide and reproduction examples to use uv 0.13.5 (<a href="https://redirect.github.com/astral-sh/uv/pull/22867">#22867</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/329bf9448afd9f9088d14a4d57fbc61eb454f117"><code>329bf94</code></a> Bump version to 0.13.6 (<a href="https://redirect.github.com/astral-sh/uv/issues/22947">#22947</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/5b5a53e1803d426ba04f4af8ff7d6ff747548218"><code>5b5a53e</code></a> Use checked-in Python download metadata for release preparation (<a href="https://redirect.github.com/astral-sh/uv/issues/22945">#22945</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/b8b339fe4794e2919c7d2ef3214027aebc59d023"><code>b8b339f</code></a> Update Rust crate h2 to v0.4.19 (<a href="https://redirect.github.com/astral-sh/uv/issues/21873">#21873</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/1eb5989ea886d33add8c0ebc0adbfa54b1c32c82"><code>1eb5989</code></a> Update Rust crate hyper to v1.11.1 (<a href="https://redirect.github.com/astral-sh/uv/issues/20903">#20903</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/68677f5439c027db17b4db7821882a9881d376f6"><code>68677f5</code></a> Update Rust crate reqwest to v0.13.5 (<a href="https://redirect.github.com/astral-sh/uv/issues/22475">#22475</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/69e574e368d31145692b3e22e59285316566e6d7"><code>69e574e</code></a> Cargo vet integration (<a href="https://redirect.github.com/astral-sh/uv/issues/21610">#21610</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/acee8d938b52225be3e90ccfcbe69fa4eb8ed215"><code>acee8d9</code></a> Sync latest Python releases, Python 3.11.18, 3.12.16, 3.13.18, 3.14.10, 3.15....</li> <li><a href="https://github.com/astral-sh/uv/commit/4b46af05893283739f94dea65e2bf667bda64d12"><code>4b46af0</code></a> Fix <code>io-bound</code> Windows CI nextest grouping (<a href="https://redirect.github.com/astral-sh/uv/issues/22939">#22939</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d397ecbf703c00768a68d6fad0978cd20f45d8a6"><code>d397ecb</code></a> Add hints when <code>uv init</code> finds <code>pyproject.toml</code> without a project table (<a href="https://redirect.github.com/astral-sh/uv/issues/22916">#22916</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/7b5d227102f51c311cdfed3370b473331144b2c6"><code>7b5d227</code></a> Let <code>--no-package</code> and <code>--script</code> take precedence over `UV_INIT_BUILD_BACKEND...</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.13.5...0.13.6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 CaliBrain
|
16e20679b4 | fix(docker): bump Chromium pin to 156.0.8078.47 (#1601) | ||
|
dependabot[bot]
|
3ff6d88681 |
build(deps): bump astral-sh/uv from 0.12.24 to 0.13.5 in the docker-base-image-digests group (#1550)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.12.24 to 0.13.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.13.5</h2> <h2>Release Notes</h2> <p>Released on 2026-10-21.</p> <p>Following <a href="https://github.com/astral-sh/uv/releases/tag/0.13.4">uv 0.13.4</a>, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to <a href="https://github.com/astral-sh/python-build-standalone/releases/tag/20261021">python-build-standalone 20261021</a>, including the CPython <a href="https://www.python.org/downloads/release/python-3151/">3.15.1</a>, <a href="https://www.python.org/downloads/release/python-3149/">3.14.9</a>, and <a href="https://www.python.org/downloads/release/python-31317/">3.13.17</a> security patch releases. These builds include <a href="https://pip.pypa.io/en/stable/news/#v26-2-2">pip 26.2.2</a> both preinstalled in the managed interpreter and bundled with <code>ensurepip</code>, which installs pip by default when you run <code>python -m venv</code>. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run <code>uv python upgrade</code> to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.</p> <p>Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.</p> <h3>Enhancements</h3> <ul> <li>Report incompatible self-dependencies directly in resolution errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21845">#21845</a>)</li> </ul> <h3>Python</h3> <ul> <li>Add CPython 3.15.1, 3.14.9, and 3.13.17 (<a href="https://redirect.github.com/astral-sh/uv/pull/22802">#22802</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with <code>wheel-variants</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22535">#22535</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22536">#22536</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22687">#22687</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22688">#22688</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce peak memory use when resolving dependencies across multiple environments (<a href="https://redirect.github.com/astral-sh/uv/pull/22769">#22769</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22770">#22770</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22784">#22784</a>)</li> <li>Speed up exports with complex transitive extras by resolving activation across the dependency graph (<a href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li> <li>Reduce uv's binary size by keeping additional error formatters out of line (<a href="https://redirect.github.com/astral-sh/uv/pull/22775">#22775</a>)</li> <li>Reduce overhead when parsing custom build cache keys (<a href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Lock packages distributed only as Android wheels without a source distribution (<a href="https://redirect.github.com/astral-sh/uv/pull/22806">#22806</a>)</li> <li>Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (<a href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li> <li>Reject invalid custom build cache keys instead of silently falling back to the defaults (<a href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li> </ul> <h3>Security</h3> <ul> <li>Reject certificate chains containing compromised eMudhra intermediate keys via <code>rustls-webpki</code> 0.103.16 (<a href="https://redirect.github.com/astral-sh/uv/pull/22777">#22777</a>)</li> <li>Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (<a href="https://redirect.github.com/astral-sh/uv/pull/22773">#22773</a>)</li> </ul> <h2>Install uv 0.13.5</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.13.5/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code></tr></table> </code></pre> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.13.5</h2> <p>Released on 2026-10-21.</p> <p>Following <a href="https://github.com/astral-sh/uv/releases/tag/0.13.4">uv 0.13.4</a>, which removed the affected eMudhra/emSign root from uv's own certificate store, this release updates the latest managed CPython builds for 3.11 and newer to <a href="https://github.com/astral-sh/python-build-standalone/releases/tag/20261021">python-build-standalone 20261021</a>, including the CPython <a href="https://www.python.org/downloads/release/python-3151/">3.15.1</a>, <a href="https://www.python.org/downloads/release/python-3149/">3.14.9</a>, and <a href="https://www.python.org/downloads/release/python-31317/">3.13.17</a> security patch releases. These builds include <a href="https://pip.pypa.io/en/stable/news/#v26-2-2">pip 26.2.2</a> both preinstalled in the managed interpreter and bundled with <code>ensurepip</code>, which installs pip by default when you run <code>python -m venv</code>. Both copies use certifi 2026.10.19, which removes the same affected root. After upgrading uv, run <code>uv python upgrade</code> to install the updated builds. Virtual environments pinned to an older Python patch version do not switch to the updated interpreter automatically. Upgrade pip separately in existing virtual environments.</p> <p>Please note upstream CPython 3.9 and 3.10 still bundle pip releases whose certificate bundles trust the affected eMudhra/emSign root. We recommend migrating off of those versions and will no longer be releasing Docker images with uv installed for EOL Python versions.</p> <h3>Enhancements</h3> <ul> <li>Report incompatible self-dependencies directly in resolution errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21845">#21845</a>)</li> </ul> <h3>Python</h3> <ul> <li>Add CPython 3.15.1, 3.14.9, and 3.13.17 (<a href="https://redirect.github.com/astral-sh/uv/pull/22802">#22802</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Select and rank wheel variants with no required properties or properties from PEP 850 static providers in platform-specific resolutions with <code>wheel-variants</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22535">#22535</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22536">#22536</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22687">#22687</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22688">#22688</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce peak memory use when resolving dependencies across multiple environments (<a href="https://redirect.github.com/astral-sh/uv/pull/22769">#22769</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22770">#22770</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22784">#22784</a>)</li> <li>Speed up exports with complex transitive extras by resolving activation across the dependency graph (<a href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li> <li>Reduce uv's binary size by keeping additional error formatters out of line (<a href="https://redirect.github.com/astral-sh/uv/pull/22775">#22775</a>)</li> <li>Reduce overhead when parsing custom build cache keys (<a href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Lock packages distributed only as Android wheels without a source distribution (<a href="https://redirect.github.com/astral-sh/uv/pull/22806">#22806</a>)</li> <li>Export optional dependencies correctly when transitive extras are activated through different or incompatible environment paths (<a href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li> <li>Reject invalid custom build cache keys instead of silently falling back to the defaults (<a href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li> </ul> <h3>Security</h3> <ul> <li>Reject certificate chains containing compromised eMudhra intermediate keys via <code>rustls-webpki</code> 0.103.16 (<a href="https://redirect.github.com/astral-sh/uv/pull/22777">#22777</a>)</li> <li>Stop publishing uv Docker images based on Python 3.9 and 3.10 images that no longer receive upstream updates (<a href="https://redirect.github.com/astral-sh/uv/pull/22773">#22773</a>)</li> </ul> <h2>0.13.4</h2> <p>Released on 2026-10-20.</p> <h3>Preview features</h3> <ul> <li>Validate PEP 825 variant metadata and treat package versions with invalid metadata as unavailable under <code>wheel-variants</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22512">#22512</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Update the bundled Mozilla root certificates via <code>webpki-root-certs</code> 1.0.10 (<a href="https://redirect.github.com/astral-sh/uv/pull/22760">#22760</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/46776a95d6686ac0160c10611327ce491e6b202f"><code>46776a9</code></a> Use checked-in Python metadata for trampoline checks (<a href="https://redirect.github.com/astral-sh/uv/issues/22811">#22811</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/5babfa90b420ea12a611554f8cbbb41d433534be"><code>5babfa9</code></a> Use checked-in Python download metadata for releases (<a href="https://redirect.github.com/astral-sh/uv/issues/22810">#22810</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/06fbc976b1462d56bc83609e1c26250740e9c656"><code>06fbc97</code></a> Reject Cargo.lock changes from forks (<a href="https://redirect.github.com/astral-sh/uv/issues/22381">#22381</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/b3c01fd5745ab459863b83380dbd79621073a797"><code>b3c01fd</code></a> Prepare 0.13.5 (<a href="https://redirect.github.com/astral-sh/uv/issues/22809">#22809</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a02d446bcddd8a00c98084709b6bdccbc9a8208f"><code>a02d446</code></a> Update to include Python 3.15.1, 3.14.9, 3.13.17 (<a href="https://redirect.github.com/astral-sh/uv/issues/22802">#22802</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0ee565f1d755dfa5d7ba78db287ed342ec3e4d4b"><code>0ee565f</code></a> Reproduce local-version marker rendering panic (<a href="https://redirect.github.com/astral-sh/uv/issues/22807">#22807</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e3810e1e6daf06095ac58a27dd422eb095ea4ed6"><code>e3810e1</code></a> Infer platform markers from Android wheel tags (<a href="https://redirect.github.com/astral-sh/uv/issues/22806">#22806</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/75698b1ed23dd410421de4656304077351641fa7"><code>75698b1</code></a> Update rustup in Docker builders (<a href="https://redirect.github.com/astral-sh/uv/issues/22803">#22803</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/1765e51d67f43299d8fbd37b302b773a80c8499d"><code>1765e51</code></a> Replace actions/attest-build-provenance action with actions/attest v4.2.2 (<a href="https://redirect.github.com/astral-sh/uv/issues/2">#2</a>...</li> <li><a href="https://github.com/astral-sh/uv/commit/0abe802a1a07417f5163e57549c93c132cd7db3f"><code>0abe802</code></a> Update Rust crate test-log to v0.2.21 (<a href="https://redirect.github.com/astral-sh/uv/issues/19721">#19721</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.24...0.13.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 
|
8369f1b626 |
fix(docker): bump Chromium pin to 155.0.8059.79 (#1477)
The `149.0.7827.196` pin from #1105 now lacks fixes for two Chromium CVEs on CISA's Known Exploited Vulnerabilities list: - CVE-2026-85046, fixed in `152.0.7977.82-1~deb13u1` - CVE-2026-87491, fixed in `153.0.8010.47-2~deb13u1` Trivy also reports 46 critical and 534 high Chromium CVEs in `shelfmark:latest` (1.4.0). This browser runs third-party mirror pages with the sandbox off. The 150 regression behind the pin, a missing DevTools TCP port, no longer occurs in Debian's current trixie-security build, **155.0.8059.79-1~deb13u1**. In a copy of `shelfmark:latest` upgraded to that version, `cdp_driver.start_async(...)` with the bypasser's own arguments (`xvfb=True, sandbox=False, incognito=True, ad_block=True`, plus the `_get_browser_args()` flags) starts and loads a page, as it does on 149. A live DDoS-Guard or Cloudflare challenge wasn't tested. The change bumps `CHROMIUM_VERSION` and moves `CHROMIUM_SNAPSHOT` to `20261016T000000Z`, the first snapshot containing that version for amd64 and arm64. It also updates the comment. The Chromium `RUN` step builds on the pinned `python:3.14.7-slim` base. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
dependabot[bot]
|
6ffcf3b363 |
build(deps): bump python from 3.14.7-slim to 3.14.8-slim (#1470)
Bumps python from 3.14.7-slim to 3.14.8-slim. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
4b7607e224 |
build(deps): bump astral-sh/uv from 0.12.22 to 0.12.24 in the docker-base-image-digests group (#1449)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.12.22 to 0.12.24 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.24</h2> <h2>Release Notes</h2> <p>Released on 2026-10-08.</p> <h3>Enhancements</h3> <ul> <li>Remove orphaned temporary build environments with <code>uv cache prune</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22171">#22171</a>)</li> <li>Accept PEP 508 marker operators directly before grouped expressions (<a href="https://redirect.github.com/astral-sh/uv/pull/22309">#22309</a>)</li> <li>Reject malformed requirements-file options instead of partially parsing or ignoring them (<a href="https://redirect.github.com/astral-sh/uv/pull/22317">#22317</a>)</li> <li>Show underlying filesystem and registry errors when managed Python uninstallation fails (<a href="https://redirect.github.com/astral-sh/uv/pull/22362">#22362</a>)</li> <li>Identify the invalid source URL in Python mirror errors (<a href="https://redirect.github.com/astral-sh/uv/pull/22364">#22364</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Display preferred advisory IDs in <code>uv audit</code> reports, prioritizing PYSEC, GHSA, then CVE identifiers (<a href="https://redirect.github.com/astral-sh/uv/pull/22292">#22292</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Support custom installation mirrors for GraalPy (<a href="https://redirect.github.com/astral-sh/uv/pull/22269">#22269</a>)</li> <li>Support custom installation mirrors for Pyodide (<a href="https://redirect.github.com/astral-sh/uv/pull/22271">#22271</a>)</li> <li>Allow <code>UV_NO_CACHE=false</code> to override <code>no-cache = true</code> in configuration (<a href="https://redirect.github.com/astral-sh/uv/pull/22324">#22324</a>)</li> <li>Report more precise error locations for invalid trusted-host ports and preview-feature list entries (<a href="https://redirect.github.com/astral-sh/uv/pull/22144">#22144</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up later commands after creating an environment by warming its interpreter cache (<a href="https://redirect.github.com/astral-sh/uv/pull/21304">#21304</a>)</li> <li>Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (<a href="https://redirect.github.com/astral-sh/uv/pull/22246">#22246</a>)</li> <li>Enforce resource limits when parsing package indexes and <code>--find-links</code> pages with <code>astral-html</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22203">#22203</a>)</li> <li>Reduce standalone <code>uv-build</code> executable size by 7.5% by omitting unused Zstandard support (<a href="https://redirect.github.com/astral-sh/uv/pull/22242">#22242</a>)</li> <li>Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (<a href="https://redirect.github.com/astral-sh/uv/pull/22144">#22144</a>)</li> <li>Reduce Python download error formatting code size by sharing its formatter (<a href="https://redirect.github.com/astral-sh/uv/pull/22141">#22141</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Verify supplied hashes even when hash presence is disabled with <code>--no-require-hashes</code> or <code>require-hashes = false</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22369">#22369</a>)</li> <li>Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (<a href="https://redirect.github.com/astral-sh/uv/pull/22360">#22360</a>)</li> <li>Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (<a href="https://redirect.github.com/astral-sh/uv/pull/22237">#22237</a>)</li> <li>Exclude optional dependencies from exports when their extras are activated only in incompatible environments (<a href="https://redirect.github.com/astral-sh/uv/pull/22234">#22234</a>)</li> <li>Give explicit <code>uv publish --trusted-publishing</code> values precedence over configuration (<a href="https://redirect.github.com/astral-sh/uv/pull/22279">#22279</a>)</li> <li>Allow <code>UV_OFFLINE=false</code> to override <code>offline = true</code> in configuration (<a href="https://redirect.github.com/astral-sh/uv/pull/22283">#22283</a>)</li> <li>Allow <code>UV_SYSTEM_CERTS=false</code> to override <code>system-certs = true</code> in configuration (<a href="https://redirect.github.com/astral-sh/uv/pull/22291">#22291</a>)</li> <li>Allow <code>uv auth login</code> over IPv6 loopback addresses (<a href="https://redirect.github.com/astral-sh/uv/pull/22306">#22306</a>)</li> <li>Resolve GitHub dependencies whose Git references contain <code>#</code> or <code>%</code> characters (<a href="https://redirect.github.com/astral-sh/uv/pull/22281">#22281</a>)</li> <li>Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (<a href="https://redirect.github.com/astral-sh/uv/pull/22322">#22322</a>)</li> <li>Preserve JSON output from <code>uv version</code> and <code>uv self version</code> with a single <code>--quiet</code> flag (<a href="https://redirect.github.com/astral-sh/uv/pull/22280">#22280</a>)</li> <li>Preserve trailing spaces and tabs in passwords returned by subprocess keyrings (<a href="https://redirect.github.com/astral-sh/uv/pull/22284">#22284</a>)</li> <li>Restore wheel incompatibility hints when <code>WHEEL</code> metadata contains multiple expanded <code>Tag:</code> rows (<a href="https://redirect.github.com/astral-sh/uv/pull/22235">#22235</a>)</li> <li>Preserve Windows wheel-script rename errors unless a cross-drive copy fallback applies (<a href="https://redirect.github.com/astral-sh/uv/pull/22302">#22302</a>)</li> <li>Prevent workspace-cache assertion failures after modifying a project at the workspace root (<a href="https://redirect.github.com/astral-sh/uv/pull/22236">#22236</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.24</h2> <p>Released on 2026-10-08.</p> <h3>Enhancements</h3> <ul> <li>Remove orphaned temporary build environments with <code>uv cache prune</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22171">#22171</a>)</li> <li>Accept PEP 508 marker operators directly before grouped expressions (<a href="https://redirect.github.com/astral-sh/uv/pull/22309">#22309</a>)</li> <li>Reject malformed requirements-file options instead of partially parsing or ignoring them (<a href="https://redirect.github.com/astral-sh/uv/pull/22317">#22317</a>)</li> <li>Show underlying filesystem and registry errors when managed Python uninstallation fails (<a href="https://redirect.github.com/astral-sh/uv/pull/22362">#22362</a>)</li> <li>Identify the invalid source URL in Python mirror errors (<a href="https://redirect.github.com/astral-sh/uv/pull/22364">#22364</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Display preferred advisory IDs in <code>uv audit</code> reports, prioritizing PYSEC, GHSA, then CVE identifiers (<a href="https://redirect.github.com/astral-sh/uv/pull/22292">#22292</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Support custom installation mirrors for GraalPy (<a href="https://redirect.github.com/astral-sh/uv/pull/22269">#22269</a>)</li> <li>Support custom installation mirrors for Pyodide (<a href="https://redirect.github.com/astral-sh/uv/pull/22271">#22271</a>)</li> <li>Allow <code>UV_NO_CACHE=false</code> to override <code>no-cache = true</code> in configuration (<a href="https://redirect.github.com/astral-sh/uv/pull/22324">#22324</a>)</li> <li>Report more precise error locations for invalid trusted-host ports and preview-feature list entries (<a href="https://redirect.github.com/astral-sh/uv/pull/22144">#22144</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up later commands after creating an environment by warming its interpreter cache (<a href="https://redirect.github.com/astral-sh/uv/pull/21304">#21304</a>)</li> <li>Reduce code-signature verification work for ARM64 macOS releases with 16 KiB signature pages (<a href="https://redirect.github.com/astral-sh/uv/pull/22246">#22246</a>)</li> <li>Enforce resource limits when parsing package indexes and <code>--find-links</code> pages with <code>astral-html</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22203">#22203</a>)</li> <li>Reduce standalone <code>uv-build</code> executable size by 7.5% by omitting unused Zstandard support (<a href="https://redirect.github.com/astral-sh/uv/pull/22242">#22242</a>)</li> <li>Reduce uv's binary size by about 232 KB by simplifying configuration deserialization (<a href="https://redirect.github.com/astral-sh/uv/pull/22144">#22144</a>)</li> <li>Reduce Python download error formatting code size by sharing its formatter (<a href="https://redirect.github.com/astral-sh/uv/pull/22141">#22141</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Verify supplied hashes even when hash presence is disabled with <code>--no-require-hashes</code> or <code>require-hashes = false</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22369">#22369</a>)</li> <li>Honor exact managed Python patch pins when creating script environments instead of following patch upgrades (<a href="https://redirect.github.com/astral-sh/uv/pull/22360">#22360</a>)</li> <li>Prevent dependency overrides and constraints from activating optional dependencies when their extras are not selected (<a href="https://redirect.github.com/astral-sh/uv/pull/22237">#22237</a>)</li> <li>Exclude optional dependencies from exports when their extras are activated only in incompatible environments (<a href="https://redirect.github.com/astral-sh/uv/pull/22234">#22234</a>)</li> <li>Give explicit <code>uv publish --trusted-publishing</code> values precedence over configuration (<a href="https://redirect.github.com/astral-sh/uv/pull/22279">#22279</a>)</li> <li>Allow <code>UV_OFFLINE=false</code> to override <code>offline = true</code> in configuration (<a href="https://redirect.github.com/astral-sh/uv/pull/22283">#22283</a>)</li> <li>Allow <code>UV_SYSTEM_CERTS=false</code> to override <code>system-certs = true</code> in configuration (<a href="https://redirect.github.com/astral-sh/uv/pull/22291">#22291</a>)</li> <li>Allow <code>uv auth login</code> over IPv6 loopback addresses (<a href="https://redirect.github.com/astral-sh/uv/pull/22306">#22306</a>)</li> <li>Resolve GitHub dependencies whose Git references contain <code>#</code> or <code>%</code> characters (<a href="https://redirect.github.com/astral-sh/uv/pull/22281">#22281</a>)</li> <li>Recognize existing Pyodide interpreters as satisfying Pyodide Python requests (<a href="https://redirect.github.com/astral-sh/uv/pull/22322">#22322</a>)</li> <li>Preserve JSON output from <code>uv version</code> and <code>uv self version</code> with a single <code>--quiet</code> flag (<a href="https://redirect.github.com/astral-sh/uv/pull/22280">#22280</a>)</li> <li>Preserve trailing spaces and tabs in passwords returned by subprocess keyrings (<a href="https://redirect.github.com/astral-sh/uv/pull/22284">#22284</a>)</li> <li>Restore wheel incompatibility hints when <code>WHEEL</code> metadata contains multiple expanded <code>Tag:</code> rows (<a href="https://redirect.github.com/astral-sh/uv/pull/22235">#22235</a>)</li> <li>Preserve Windows wheel-script rename errors unless a cross-drive copy fallback applies (<a href="https://redirect.github.com/astral-sh/uv/pull/22302">#22302</a>)</li> <li>Prevent workspace-cache assertion failures after modifying a project at the workspace root (<a href="https://redirect.github.com/astral-sh/uv/pull/22236">#22236</a>)</li> <li>Hide the ignored <code>--keyring-provider</code> option from <code>uv auth</code> help (<a href="https://redirect.github.com/astral-sh/uv/pull/19520">#19520</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/5411378eb76dc1ea1ad90aeb10e84e997e5bbd96"><code>5411378</code></a> Bump version to 0.12.24 (<a href="https://redirect.github.com/astral-sh/uv/issues/22371">#22371</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/213e6de8b643a831a84bbc12ff9f9ee6f0bfc13d"><code>213e6de</code></a> Clarify integration test style in agent guidance (<a href="https://redirect.github.com/astral-sh/uv/issues/22372">#22372</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/35deef2029377b87a293579f4c89548f2ec41f14"><code>35deef2</code></a> Skip Python setup in static version and credential tests (<a href="https://redirect.github.com/astral-sh/uv/issues/22370">#22370</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/bbddf2f44a7be6888b24264eb2d8a35293e7a58f"><code>bbddf2f</code></a> Share requirements-file arguments across commands (<a href="https://redirect.github.com/astral-sh/uv/issues/22145">#22145</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9a123eb638016dee70515e326a4a5fa88e74e090"><code>9a123eb</code></a> Deserialize trusted hosts and preview features directly (<a href="https://redirect.github.com/astral-sh/uv/issues/22144">#22144</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/57a9256bf0ee3bb75e438f193c6a2afe2adc6e9c"><code>57a9256</code></a> Share archive decoding across reader types (<a href="https://redirect.github.com/astral-sh/uv/issues/22143">#22143</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3e3374b961fefaed663747868c09e95863c9a3d2"><code>3e3374b</code></a> Verify hashes even when they are not required (<a href="https://redirect.github.com/astral-sh/uv/issues/22369">#22369</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d3c092a30ed2712d15c855af652d5741d4d5c7c5"><code>d3c092a</code></a> Move installation layout operations out of Python types (<a href="https://redirect.github.com/astral-sh/uv/issues/22367">#22367</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/1be3e88341157061a75b68f78953ff3a3c309576"><code>1be3e88</code></a> Accept PEP 508 marker operators before parentheses (<a href="https://redirect.github.com/astral-sh/uv/issues/22309">#22309</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e27def75aaf746634b7c6576bc23ebf572d101a5"><code>e27def7</code></a> Retain Python download request errors directly (<a href="https://redirect.github.com/astral-sh/uv/issues/22366">#22366</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.22...0.12.24">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
33010efa16 |
build(deps): bump astral-sh/uv from 0.12.19 to 0.12.22 in the docker-base-image-digests group (#1413)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.12.19 to 0.12.22 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.22</h2> <h2>Release Notes</h2> <p>Released on 2026-10-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/22147">#22147</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Accept uppercase release suffixes in wheel platform tags (<a href="https://redirect.github.com/astral-sh/uv/pull/22113">#22113</a>)</li> <li>Record workspace-member default groups in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22010">#22010</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li> <li>Record workspace-member dependency-group Python requirements in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22044">#22044</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li> <li>Record default groups for non-project workspace roots in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li> <li>Record dependency-group Python requirements for non-project workspace roots in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li> <li>Format URLs and paths consistently in CLI messages (<a href="https://redirect.github.com/astral-sh/uv/pull/21937">#21937</a>)</li> <li>Hide the unsupported <code>--offline</code> option from <code>uv publish</code> help (<a href="https://redirect.github.com/astral-sh/uv/pull/22124">#22124</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Honor <code>--no-default-groups</code> in <code>uv audit</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22090">#22090</a>)</li> <li>Report a clear error when <code>uv audit</code> or <code>uv tool audit</code> runs offline and hide the unsupported option from help (<a href="https://redirect.github.com/astral-sh/uv/pull/22114">#22114</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Add <code>UV_PYTHON_ARCH</code> to select an interpreter architecture independently of its Python version (<a href="https://redirect.github.com/astral-sh/uv/pull/22098">#22098</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce uv's binary size by compressing embedded Python download metadata (<a href="https://redirect.github.com/astral-sh/uv/pull/22126">#22126</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Verify unchanged requirements against existing lockfile hashes when relocking (<a href="https://redirect.github.com/astral-sh/uv/pull/22083">#22083</a>)</li> <li>Honor dependency-group Python requirements at non-project workspace roots (<a href="https://redirect.github.com/astral-sh/uv/pull/22101">#22101</a>)</li> <li>Use each selected workspace member's recorded default groups during frozen sync (<a href="https://redirect.github.com/astral-sh/uv/pull/22015">#22015</a>)</li> <li>Avoid false entry-point warnings for required workspace members (<a href="https://redirect.github.com/astral-sh/uv/pull/22112">#22112</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Raise the minimum supported Rust version for building uv to 1.97 and update the toolchain to Rust 1.99 (<a href="https://redirect.github.com/astral-sh/uv/pull/22121">#22121</a>)</li> </ul> <h2>Install uv 0.12.22</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.22/uv-installer.sh | sh </code></pre> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.22</h2> <p>Released on 2026-10-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.22, 3.11.17, 3.12.15, 3.13.16, and 3.14.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/22147">#22147</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Accept uppercase release suffixes in wheel platform tags (<a href="https://redirect.github.com/astral-sh/uv/pull/22113">#22113</a>)</li> <li>Record workspace-member default groups in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22010">#22010</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li> <li>Record workspace-member dependency-group Python requirements in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22044">#22044</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/22103">#22103</a>)</li> <li>Record default groups for non-project workspace roots in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li> <li>Record dependency-group Python requirements for non-project workspace roots in lockfiles (<a href="https://redirect.github.com/astral-sh/uv/pull/22104">#22104</a>)</li> <li>Format URLs and paths consistently in CLI messages (<a href="https://redirect.github.com/astral-sh/uv/pull/21937">#21937</a>)</li> <li>Hide the unsupported <code>--offline</code> option from <code>uv publish</code> help (<a href="https://redirect.github.com/astral-sh/uv/pull/22124">#22124</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Honor <code>--no-default-groups</code> in <code>uv audit</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/22090">#22090</a>)</li> <li>Report a clear error when <code>uv audit</code> or <code>uv tool audit</code> runs offline and hide the unsupported option from help (<a href="https://redirect.github.com/astral-sh/uv/pull/22114">#22114</a>)</li> </ul> <h3>Configuration</h3> <ul> <li>Add <code>UV_PYTHON_ARCH</code> to select an interpreter architecture independently of its Python version (<a href="https://redirect.github.com/astral-sh/uv/pull/22098">#22098</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Reduce uv's binary size by compressing embedded Python download metadata (<a href="https://redirect.github.com/astral-sh/uv/pull/22126">#22126</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Verify unchanged requirements against existing lockfile hashes when relocking (<a href="https://redirect.github.com/astral-sh/uv/pull/22083">#22083</a>)</li> <li>Honor dependency-group Python requirements at non-project workspace roots (<a href="https://redirect.github.com/astral-sh/uv/pull/22101">#22101</a>)</li> <li>Use each selected workspace member's recorded default groups during frozen sync (<a href="https://redirect.github.com/astral-sh/uv/pull/22015">#22015</a>)</li> <li>Avoid false entry-point warnings for required workspace members (<a href="https://redirect.github.com/astral-sh/uv/pull/22112">#22112</a>)</li> </ul> <h3>Other changes</h3> <ul> <li>Raise the minimum supported Rust version for building uv to 1.97 and update the toolchain to Rust 1.99 (<a href="https://redirect.github.com/astral-sh/uv/pull/22121">#22121</a>)</li> </ul> <h2>0.12.21</h2> <p>Released on 2026-09-29.</p> <h3>Python</h3> <ul> <li>Update CPython to use OpenSSL 3.5.9 (<a href="https://redirect.github.com/astral-sh/uv/pull/22076">#22076</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/70fe1196a546e49148a73b1c592b2f74c33af80e"><code>70fe119</code></a> Bump version to 0.12.22 (<a href="https://redirect.github.com/astral-sh/uv/issues/22148">#22148</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/7e9d252e37065168cd3ed8419bb31da512133604"><code>7e9d252</code></a> Sync latest Python releases (<a href="https://redirect.github.com/astral-sh/uv/issues/22147">#22147</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d644be28bdb7820055801b9796e56b553cfd513c"><code>d644be2</code></a> Compress embedded Python download metadata (<a href="https://redirect.github.com/astral-sh/uv/issues/22126">#22126</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0a41ee38ec6009877a77702265bcd18ceeece5ef"><code>0a41ee3</code></a> Benchmark Python download catalog loading (<a href="https://redirect.github.com/astral-sh/uv/issues/22125">#22125</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/cbf610678ba180054ce502ba803bc4403fac630e"><code>cbf6106</code></a> Use Cargo warning policy for Clippy (<a href="https://redirect.github.com/astral-sh/uv/issues/22122">#22122</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/60776645b718e5141a6969922c4d027008a9c2b9"><code>6077664</code></a> Update Rust to 1.99 and MSRV to 1.97 (<a href="https://redirect.github.com/astral-sh/uv/issues/22121">#22121</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/69025fdd3b437447909dcf71e8e751652873b1b9"><code>69025fd</code></a> Hide the <code>--offline</code> flag in <code>uv publish</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/22124">#22124</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3f70ccf04396802654de142c40925bdad39311e9"><code>3f70ccf</code></a> Defer cache format changes to 0.13 (<a href="https://redirect.github.com/astral-sh/uv/issues/22128">#22128</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e71ab8f9b46398cc2d73f866dd4d1776e9969953"><code>e71ab8f</code></a> Add <code>UV_PYTHON_ARCH</code> for requesting an interpreter architecture (<a href="https://redirect.github.com/astral-sh/uv/issues/22098">#22098</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d62a205c091f12a90db2c77f596b3a53bca22051"><code>d62a205</code></a> Hide the <code>--offline</code> flag for uv audit (<a href="https://redirect.github.com/astral-sh/uv/issues/22114">#22114</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.19...0.12.22">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 splitsec2andMichael Ngo
|
fcdc2dfb69 |
perf(docker): stop shipping build-only content in the runtime image (#1404)
While checking why each build took so much disk on my server, I looked at what's actually in the runtime image. A good share of it is there for the build and never used after. **The C toolchain.** The base stage installs `gcc`, `g++`, `libffi-dev` and `python3-dev` for building C extensions, and they stay in both the full and lite images, which is 290 MB installed. Nothing gets compiled any more. Every compiled dependency in `uv.lock` (cffi, gevent, greenlet, zope-interface) ships a cp314 manylinux wheel for both amd64 and arm64, and the packages that only have an sdist are pure Python. `python3-dev` was also pulling Debian's `libpython3.13` into a 3.14 image. **The build context.** `COPY . .` puts the whole context into `/app`, so `tests/`, `docs/` and the frontend source ship too. `.dockerignore` now leaves out the trees nothing reads at runtime. `src/` can't go in `.dockerignore` because the frontend-builder stage needs it, so both final stages remove it after the built dist is copied. The venv's own `pip` goes as well, since uv seeds one and nothing installs at runtime. This part is @DrNgo's work from his fork, and the commit carries his name. Measured by building both targets on native amd64 and arm64 runners: | | amd64 full | amd64 lite | arm64 full | arm64 lite | |---|---|---|---|---| | before | 1,532 MB | 589 MB | 1,528 MB | 619 MB | | after | 1,238 MB | 295 MB | 1,251 MB | 342 MB | Compressed, the full image goes from 617 MB to 504 MB on amd64. On both architectures the image builds, reaches healthy, and Chromium starts the same way the bypasser starts it (xvfb, `_get_browser_args()`). The Python suite passes too. It's also running on my own install now. If a dependency ever needs compiling again, the clean fix is a builder stage that builds the wheel and copies it in, rather than putting the toolchain back in the runtime image. Happy to add that now if you'd rather have it in place. --------- Co-authored-by: Michael Ngo <michaeln56@gmail.com> |
||
|
dependabot[bot]andCaliBrain
|
efb1f66bc3 |
build(deps): bump astral-sh/uv from 0.12.16 to 0.12.19 in the docker-base-image-digests group across 1 directory (#1392)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 1 update in the / directory: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.12.16 to 0.12.19 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.19</h2> <h2>Release Notes</h2> <p>Released on 2026-09-24.</p> <h3>Python</h3> <ul> <li>Add PyPy 3.11.16 and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> <li>Update GraalPy 3.13.0 to build 25.4.4 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Format upload URLs with backticks in <code>uv publish</code> errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21934">#21934</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Run build-backend hooks with lazy imports on CPython 3.15 and later using the <code>build-lazy-imports</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21967">#21967</a>)</li> <li>Omit unused resolution settings from <code>uv.lock</code> and ignore changes to them when checking lockfile freshness with the <code>resolution-inputs</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21913">#21913</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (<a href="https://redirect.github.com/astral-sh/uv/pull/21971">#21971</a>)</li> <li>Recognize <code>1.0.0</code> as satisfying <code>===1</code> during installed-package checks, matching resolution (<a href="https://redirect.github.com/astral-sh/uv/pull/21931">#21931</a>)</li> <li>Avoid collisions between Git checkout readiness markers and <code>.ok</code> files in dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21891">#21891</a>)</li> <li>Preserve always-false <code>python_version</code> markers when parsing their serialized form (<a href="https://redirect.github.com/astral-sh/uv/pull/21939">#21939</a>)</li> </ul> <h3>Rust API</h3> <ul> <li>Restore the public <code>FlatDistributions</code> export and its <code>BTreeMap</code> conversion for downstream resolvers (<a href="https://redirect.github.com/astral-sh/uv/pull/21965">#21965</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Make individual preview-feature reference entries linkable by name (<a href="https://redirect.github.com/astral-sh/uv/pull/21950">#21950</a>)</li> </ul> <h2>Install uv 0.12.19</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.19/uv-installer.ps1 | iex" </code></pre> <h2>Download uv 0.12.19</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.19</h2> <p>Released on 2026-09-24.</p> <h3>Python</h3> <ul> <li>Add PyPy 3.11.16 and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> <li>Update GraalPy 3.13.0 to build 25.4.4 (<a href="https://redirect.github.com/astral-sh/uv/pull/21847">#21847</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Format upload URLs with backticks in <code>uv publish</code> errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21934">#21934</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Run build-backend hooks with lazy imports on CPython 3.15 and later using the <code>build-lazy-imports</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21967">#21967</a>)</li> <li>Omit unused resolution settings from <code>uv.lock</code> and ignore changes to them when checking lockfile freshness with the <code>resolution-inputs</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21913">#21913</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Preserve signed and encoded query parameters in direct-URL metadata to avoid reinstalling unchanged packages (<a href="https://redirect.github.com/astral-sh/uv/pull/21971">#21971</a>)</li> <li>Recognize <code>1.0.0</code> as satisfying <code>===1</code> during installed-package checks, matching resolution (<a href="https://redirect.github.com/astral-sh/uv/pull/21931">#21931</a>)</li> <li>Avoid collisions between Git checkout readiness markers and <code>.ok</code> files in dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21891">#21891</a>)</li> <li>Preserve always-false <code>python_version</code> markers when parsing their serialized form (<a href="https://redirect.github.com/astral-sh/uv/pull/21939">#21939</a>)</li> </ul> <h3>Rust API</h3> <ul> <li>Restore the public <code>FlatDistributions</code> export and its <code>BTreeMap</code> conversion for downstream resolvers (<a href="https://redirect.github.com/astral-sh/uv/pull/21965">#21965</a>)</li> </ul> <h3>Documentation</h3> <ul> <li>Make individual preview-feature reference entries linkable by name (<a href="https://redirect.github.com/astral-sh/uv/pull/21950">#21950</a>)</li> </ul> <h2>0.12.18</h2> <p>Released on 2026-09-22.</p> <p>This release addresses <a href="https://github.com/astral-sh/uv/security/advisories/GHSA-2cv4-cqwr-gwf7">GHSA-2cv4-cqwr-gwf7</a>, which is a path traversal weakness during wheel installation on Windows. No other platforms are affected by this advisory.</p> <h3>Enhancements</h3> <ul> <li>Add <code>--output-format json</code> to <code>uv pip install</code> and <code>uv pip sync</code>, including for <code>--dry-run</code> and <code>--check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21893">#21893</a>)</li> <li>Add <code>--check</code> to <code>uv pip install</code> and <code>uv pip sync</code> to report planned changes without modifying the environment (<a href="https://redirect.github.com/astral-sh/uv/pull/21844">#21844</a>)</li> <li>Identify failures from <code>get_requires_for_build_*</code> hooks correctly in build errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21881">#21881</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Validate build requirements for <code>uv build --no-build-isolation</code> with <code>--preview-features build-dependency-check</code>; use <code>--skip-dependency-check</code> to opt out (<a href="https://redirect.github.com/astral-sh/uv/pull/21880">#21880</a>)</li> </ul> <h3>Performance</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/bea138450f0e620a4ce5765b0e38cff7b9f0799f"><code>bea1384</code></a> Bump version to 0.12.19 (<a href="https://redirect.github.com/astral-sh/uv/issues/21975">#21975</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/299a93de4b94e754f260c673d2de456afbdd4fb7"><code>299a93d</code></a> Sync latest Python releases (<a href="https://redirect.github.com/astral-sh/uv/issues/21970">#21970</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/30de9e2cc92018c7c16a1ab66bb9b8341fbf0eff"><code>30de9e2</code></a> Preserve query parameters in direct URL metadata (<a href="https://redirect.github.com/astral-sh/uv/issues/21971">#21971</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/0e7433eee906fe81709c95c5bde556263367f21f"><code>0e7433e</code></a> Filter distribution hashes in tests (<a href="https://redirect.github.com/astral-sh/uv/issues/21941">#21941</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/c73db78f0b00580b3c67279b59b85153a9d0264d"><code>c73db78</code></a> Omit unused runtime settings from lockfiles (<a href="https://redirect.github.com/astral-sh/uv/issues/21913">#21913</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/ad123420aaa75b3bdbccf81496aaece8b9045b30"><code>ad12342</code></a> Add a preview feature for lazy build backend imports (<a href="https://redirect.github.com/astral-sh/uv/issues/21967">#21967</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/dd965a276182e2d46d80439feecd03216cc6643a"><code>dd965a2</code></a> Restore <code>FlatDistributions</code> for downstream resolvers (<a href="https://redirect.github.com/astral-sh/uv/issues/21965">#21965</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/214d7f677585fbb0bb46fadef890335e388641c0"><code>214d7f6</code></a> Use Astra for PR security reviews (<a href="https://redirect.github.com/astral-sh/uv/issues/21959">#21959</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3db665232544183edcb80dd7077b8051b365e236"><code>3db6652</code></a> Disable incremental compilation when publishing docs (<a href="https://redirect.github.com/astral-sh/uv/issues/21955">#21955</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e18f413b23bfe5f33bcc1a3a3de330e4716aedcf"><code>e18f413</code></a> Reproduce editable project relocation failure (<a href="https://redirect.github.com/astral-sh/uv/issues/21948">#21948</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.16...0.12.19">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
splitsec2
|
ca25448529 |
perf(docker): keep the heavy build layers cacheable across builds - save 11minutes per build (#1379)
With the amount of changes and testing I've been doing lately I noticed how long the builds were taking and how much each one pulled, so I went and looked at the Dockerfile. I think this balances cache and efficiency. Three changes needed to be stacked to make it happen. **The version stamp sits above everything expensive.** `ARG BUILD_VERSION` and `ENV BUILD_VERSION` are at the top of the `base` stage and the value carries the commit sha, so it changes on every commit. This invalidates the layer and everything below it, which means the apt install, the dependency sync and the Chromium install. Nothing in the build reads either variable. They're only used at runtime by entrypoint.sh, tor.sh, wireguard.sh and genDebug.sh, so they can move to the end of the final stages. **`COPY . .` sits above the Chromium install.** It's in `base`, and the `shelfmark` stage installs Chromium and the seleniumbase drivers after it, so any source change rebuilds those too. Moving the source copy and the runtime-paths block to the end of each final stage solves that. **There's no cross-run cache.** Runners are ephemeral, so without `cache-from` and `cache-to` every layer is rebuilt on every run whatever the ordering, and a rebuilt layer gets a new digest even when the content is identical. That's why reordering on its own doesn't change the load. Measured with a source-only change between two builds: | | Build | Pull | |---|---|---| | before | 13m 20s | 526.5 MB | | after | 2m 25s | 3.7 MB | 15 of 18 layers get reused where it was 5. The cache sits at 0.86 GB, which leaves room under the 10 GB repo budget for the uv caches in ci.yml and e2e-platform.yml. I tried `mode=max` first and it built a bit quicker at 1m 43s, but it used 5.15 GB of cache and the potential to impact other workflows so it didn't seem worth 40 seconds, but that is a single line fix if you want to. This means the runtime-paths block is now duplicated, once per final stage, and that's most of the diff. It has to sit below each stage's heavy layers to do its job and I couldn't find a way around that short of another shared stage, which looked like more complexity for complexity's sake. Happy to take another run at it if you'd rather have it 'DRY'. I checked the built image against the current one. Same size, it boots, /api/health returns 200, and BUILD_VERSION and RELEASE_VERSION are still stamped correctly. Also, I'll slow down on the PRs. Promise. |
||
|
dependabot[bot]
|
83f86242b4 |
build(deps): bump the docker-base-image-digests group with 2 updates (#1348)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `50c8e8c` to `ebfe2f9` Updates `astral-sh/uv` from 0.12.13 to 0.12.16 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.16</h2> <h2>Release Notes</h2> <p>Released on 2026-09-17.</p> <h3>Python</h3> <ul> <li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify downloaded wheels and source distributions against hashes supplied by package indexes (<a href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li> <li>Allow <code>build-constraint-dependencies</code> entries to include hashes for verifying downloaded build dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li> <li>Honor Darwin <code>platform_release</code> markers in <code>required-environments</code> using macOS wheel deployment targets (<a href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li> <li>Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (<a href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Support <code>lock-without-metadata</code> across all dependency types while retaining <code>package.metadata</code> for remote URL dependencies to enable offline validation (<a href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li> <li>Honor configured and command-line index settings, including credentials, in <code>uv upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li> <li>Allow <code>uv check</code> to run in projects that are not managed by uv and outside workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li> <li>Respect <code>--python</code> and <code>UV_PYTHON</code> when selecting the Python version for <code>uv check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Redact Azure shared access signatures from displayed and logged URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li> <li>Check archive sizes from <code>pylock.toml</code> before reusing cached distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li> <li>Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (<a href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li> <li>Use the bundled <code>uv_build</code> backend only when its version matches active version pins (<a href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li> <li>Handle malformed index URLs without panicking when credentials are configured (<a href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li> <li>Report a configuration error instead of panicking for proxy URLs without a host (<a href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li> <li>Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (<a href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li> </ul> <h2>Install uv 0.12.16</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.16/uv-installer.ps1 | iex" </code></pre> <h2>Download uv 0.12.16</h2> <p>| File | Platform | Checksum |</p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.16</h2> <p>Released on 2026-09-17.</p> <h3>Python</h3> <ul> <li>Add Pyodide 314.0.7, 0.29.5, and 0.27.8 (<a href="https://redirect.github.com/astral-sh/uv/pull/21741">#21741</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify downloaded wheels and source distributions against hashes supplied by package indexes (<a href="https://redirect.github.com/astral-sh/uv/pull/21562">#21562</a>)</li> <li>Allow <code>build-constraint-dependencies</code> entries to include hashes for verifying downloaded build dependencies (<a href="https://redirect.github.com/astral-sh/uv/pull/21467">#21467</a>)</li> <li>Honor Darwin <code>platform_release</code> markers in <code>required-environments</code> using macOS wheel deployment targets (<a href="https://redirect.github.com/astral-sh/uv/pull/21766">#21766</a>)</li> <li>Reject unsupported Git URL schemes while parsing lockfiles instead of panicking during frozen exports (<a href="https://redirect.github.com/astral-sh/uv/pull/21779">#21779</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Support <code>lock-without-metadata</code> across all dependency types while retaining <code>package.metadata</code> for remote URL dependencies to enable offline validation (<a href="https://redirect.github.com/astral-sh/uv/pull/21163">#21163</a>)</li> <li>Honor configured and command-line index settings, including credentials, in <code>uv upgrade</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21776">#21776</a>)</li> <li>Allow <code>uv check</code> to run in projects that are not managed by uv and outside workspaces (<a href="https://redirect.github.com/astral-sh/uv/pull/21777">#21777</a>)</li> <li>Respect <code>--python</code> and <code>UV_PYTHON</code> when selecting the Python version for <code>uv check</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21744">#21744</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Redact Azure shared access signatures from displayed and logged URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21755">#21755</a>)</li> <li>Check archive sizes from <code>pylock.toml</code> before reusing cached distributions (<a href="https://redirect.github.com/astral-sh/uv/pull/21609">#21609</a>)</li> <li>Keep user-authored local dependency paths relative in lockfiles when backend metadata reports absolute paths (<a href="https://redirect.github.com/astral-sh/uv/pull/20631">#20631</a>)</li> <li>Use the bundled <code>uv_build</code> backend only when its version matches active version pins (<a href="https://redirect.github.com/astral-sh/uv/pull/21742">#21742</a>)</li> <li>Handle malformed index URLs without panicking when credentials are configured (<a href="https://redirect.github.com/astral-sh/uv/pull/21784">#21784</a>)</li> <li>Report a configuration error instead of panicking for proxy URLs without a host (<a href="https://redirect.github.com/astral-sh/uv/pull/21781">#21781</a>)</li> <li>Return a credential-redacted error instead of panicking when a URL cannot be converted to a path (<a href="https://redirect.github.com/astral-sh/uv/pull/21783">#21783</a>)</li> </ul> <h2>0.12.15</h2> <p>Released on 2026-09-15.</p> <h3>Performance</h3> <ul> <li>Speed up cold-cache resolution and HTTP cache revalidation by batching cache writes (<a href="https://redirect.github.com/astral-sh/uv/pull/21675">#21675</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Fix regressions in <code>0.12.14</code> when installing to symlinked destinations or using <code>uv pip install --target .</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21699">#21699</a>)</li> </ul> <h2>0.12.14</h2> <p>Released on 2026-09-15.</p> <h3>Enhancements</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/761ff1379b3b79f61fc8d421dfe4fe064834e084"><code>761ff13</code></a> Bump version to 0.12.16 (<a href="https://redirect.github.com/astral-sh/uv/issues/21809">#21809</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a2f820ad0cebb7118f7686be3619d48df5121f6e"><code>a2f820a</code></a> Assign release pull requests to the workflow initiator (<a href="https://redirect.github.com/astral-sh/uv/issues/21808">#21808</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6dffe7e03898409c04e2f46436bffa60abbae465"><code>6dffe7e</code></a> Ignore <code>UV_NATIVE_TLS</code> when <code>UV_SYSTEM_CERTS</code> is set (<a href="https://redirect.github.com/astral-sh/uv/issues/21805">#21805</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/7bc36767ae3ea0d45e3cc6f219765fdec2992a33"><code>7bc3676</code></a> Avoid warning when both <code>native-tls</code> and <code>system-certs</code> are configured (<a href="https://redirect.github.com/astral-sh/uv/issues/21806">#21806</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/07b838a33179967b87d513825b02504a75b21b3a"><code>07b838a</code></a> Avoid warning when both <code>UV_NATIVE_TLS</code> and <code>UV_SYSTEM_CERTS</code> are set (<a href="https://redirect.github.com/astral-sh/uv/issues/21788">#21788</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/5d64ede21e9e835e59ecd85329ebefd43faa8211"><code>5d64ede</code></a> Remove Hash API (<a href="https://redirect.github.com/astral-sh/uv/issues/21786">#21786</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9ddc4308551335e9c2ab6571ea0cf529eccf3e76"><code>9ddc430</code></a> Move shared thread initialization into uv-threads (<a href="https://redirect.github.com/astral-sh/uv/issues/21746">#21746</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/ef1e0689b4612796d7781ebeae7866028c6c9e82"><code>ef1e068</code></a> Make Git stamping opt-in for development builds (<a href="https://redirect.github.com/astral-sh/uv/issues/21750">#21750</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6ce09770cec30b30cdc66c3595517dce2b112562"><code>6ce0977</code></a> Avoid panics for non-base index URLs (<a href="https://redirect.github.com/astral-sh/uv/issues/21784">#21784</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/47f19ec154f325ade7d6045c4e785531c24635f7"><code>47f19ec</code></a> Return an error for failed VerbatimUrl path conversions (<a href="https://redirect.github.com/astral-sh/uv/issues/21783">#21783</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.13...0.12.16">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
9eb47989ec |
build(deps): bump the docker-base-image-digests group with 2 updates (#1328)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `e67514e` to `50c8e8c` Updates `astral-sh/uv` from 0.12.9 to 0.12.13 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.13</h2> <h2>Release Notes</h2> <p>Released on 2026-09-10.</p> <h3>Python</h3> <ul> <li>Add GraalPy 3.13.0 (<a href="https://redirect.github.com/astral-sh/uv/pull/21431">#21431</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify hashes when downloading PEP 658 metadata sidecars (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Respect <code>ty</code> exclusions when <code>uv check</code> automatically selects members of a virtual workspace (<a href="https://redirect.github.com/astral-sh/uv/pull/21555">#21555</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (<a href="https://redirect.github.com/astral-sh/uv/pull/21279">#21279</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (<a href="https://redirect.github.com/astral-sh/uv/pull/18713">#18713</a>)</li> <li>Prefer <code>core-metadata</code> over legacy aliases in JSON index responses (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h2>Install uv 0.12.13</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-installer.ps1 | iex" </code></pre> <h2>Download uv 0.12.13</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.13/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.13</h2> <p>Released on 2026-09-10.</p> <h3>Python</h3> <ul> <li>Add GraalPy 3.13.0 (<a href="https://redirect.github.com/astral-sh/uv/pull/21431">#21431</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Verify hashes when downloading PEP 658 metadata sidecars (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Respect <code>ty</code> exclusions when <code>uv check</code> automatically selects members of a virtual workspace (<a href="https://redirect.github.com/astral-sh/uv/pull/21555">#21555</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Avoid full wheel downloads during resolution by reusing supported hashes from direct URL fragments when metadata is available separately (<a href="https://redirect.github.com/astral-sh/uv/pull/21279">#21279</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Edit Windows entry-point launcher resources in memory to support Nano Server and reduce antivirus contention (<a href="https://redirect.github.com/astral-sh/uv/pull/18713">#18713</a>)</li> <li>Prefer <code>core-metadata</code> over legacy aliases in JSON index responses (<a href="https://redirect.github.com/astral-sh/uv/pull/21563">#21563</a>)</li> </ul> <h2>0.12.12</h2> <p>Released on 2026-09-09.</p> <p>The executables in our macOS and Windows release archives and <code>uv</code> and <code>uv_build</code> wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.</p> <h3>Bug fixes</h3> <ul> <li>Exclude distributions uploaded after the <code>exclude-newer</code> cutoff from lockfiles and generated requirement hashes (<a href="https://redirect.github.com/astral-sh/uv/pull/21539">#21539</a>)</li> </ul> <h2>0.12.11</h2> <p>Released on 2026-09-08.</p> <h3>Preview features</h3> <ul> <li>Generate missing artifact hashes when exporting <code>pylock.toml</code> files to ensure they conform to PEP 751 (<a href="https://redirect.github.com/astral-sh/uv/pull/20146">#20146</a>)</li> <li>Warn when <code>pylock.toml</code> artifact hash tables are empty, which will be rejected in a future uv release (<a href="https://redirect.github.com/astral-sh/uv/pull/21462">#21462</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up installs that overwrite existing files by eliminating per-file temporary directories for atomic hard-link, symlink, and reflink replacements (<a href="https://redirect.github.com/astral-sh/uv/pull/21478">#21478</a>)</li> <li>Speed up installs that merge copied wheels into existing environments by replacing per-file temporary directories with adjacent temporary files (<a href="https://redirect.github.com/astral-sh/uv/pull/21468">#21468</a>)</li> <li>Speed up local wheel installs by replacing the shared ZIP cursor lock with positioned reads (<a href="https://redirect.github.com/astral-sh/uv/pull/21500">#21500</a>)</li> <li>Speed up local wheel installs by reusing ZIP readers and buffers across extracted files (<a href="https://redirect.github.com/astral-sh/uv/pull/21499">#21499</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/0ebbd9274a55a8a53a13970be3b97e4209598e17"><code>0ebbd92</code></a> Bump version to 0.12.13 (<a href="https://redirect.github.com/astral-sh/uv/issues/21594">#21594</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/17ccae34815e249c66e53abe21916c3c0b6413e5"><code>17ccae3</code></a> Use separate Depot projects for Docker development builds (<a href="https://redirect.github.com/astral-sh/uv/issues/21591">#21591</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/8c18e15bd36dff0e17509cc68c3721798ae1ec2b"><code>8c18e15</code></a> Use the workflow revision for PR security review configuration (<a href="https://redirect.github.com/astral-sh/uv/issues/21592">#21592</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/9ebb1f6a72db257a689049ee060b7cf93638aada"><code>9ebb1f6</code></a> Clarify release pipeline job names (<a href="https://redirect.github.com/astral-sh/uv/issues/21561">#21561</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/d87450d82b3941507e48ac8b57f72a9d00709289"><code>d87450d</code></a> Omit unused <code>exclude-newer-package</code> entries from script locks (<a href="https://redirect.github.com/astral-sh/uv/issues/21589">#21589</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/911f3a208c104b07b2f4da3a2283564d9a95c403"><code>911f3a2</code></a> Refactor release artifact handling (<a href="https://redirect.github.com/astral-sh/uv/issues/21556">#21556</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a712e811024933ec441667659d6df73c04f5b678"><code>a712e81</code></a> Separate Docker release builds from publishing (<a href="https://redirect.github.com/astral-sh/uv/issues/21586">#21586</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/4196dae60a0cc542bd43c0188f8b4c6dbfa0df98"><code>4196dae</code></a> Use xhigh effort for PR security review (<a href="https://redirect.github.com/astral-sh/uv/issues/21530">#21530</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a51624b4791456260f72068ae878796233f72809"><code>a51624b</code></a> Reduce PR security review reporting work (<a href="https://redirect.github.com/astral-sh/uv/issues/21528">#21528</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/63e28b69821b4b55b90287d799cbf97ff6ba0f74"><code>63e28b6</code></a> Use <code>editpe</code> for trampoline resource edits (<a href="https://redirect.github.com/astral-sh/uv/issues/18713">#18713</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.9...0.12.13">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
22aa59e567 |
build(deps): bump the docker-base-image-digests group with 2 updates (#1306)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps the docker-base-image-digests group with 2 updates: node and [astral-sh/uv](https://github.com/astral-sh/uv). Updates `node` from `d32cdf6` to `e67514e` Updates `astral-sh/uv` from 0.12.5 to 0.12.9 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.9</h2> <h2>Release Notes</h2> <p>Released on 2026-09-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.15.0rc2 (<a href="https://redirect.github.com/astral-sh/uv/pull/21413">#21413</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21415">#21415</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Add <code>--no-locked</code> and <code>--no-frozen</code> to disable lock modes enabled by <code>UV_LOCKED</code> and <code>UV_FROZEN</code> for a single invocation (<a href="https://redirect.github.com/astral-sh/uv/pull/21408">#21408</a>)</li> <li>Report the exact command-line lock-mode flag in warnings and errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21402">#21402</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (<a href="https://redirect.github.com/astral-sh/uv/pull/21372">#21372</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Update <code>async_http_range_reader</code> to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (<a href="https://redirect.github.com/astral-sh/uv/pull/21401">#21401</a>)</li> <li>Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (<a href="https://redirect.github.com/astral-sh/uv/pull/21382">#21382</a>)</li> <li>Redact secrets in signed URLs from retry diagnostics, including nested request errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21381">#21381</a>)</li> <li>Give <code>--locked</code>, <code>--frozen</code>, <code>--check</code>, and <code>--check-exists</code> precedence over conflicting <code>UV_LOCKED</code> and <code>UV_FROZEN</code> values (<a href="https://redirect.github.com/astral-sh/uv/pull/21396">#21396</a>)</li> <li>Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (<a href="https://redirect.github.com/astral-sh/uv/pull/21400">#21400</a>)</li> </ul> <h2>Install uv 0.12.9</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-installer.ps1 | iex" </code></pre> <h2>Download uv 0.12.9</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.9/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.9</h2> <p>Released on 2026-09-01.</p> <h3>Python</h3> <ul> <li>Add CPython 3.15.0rc2 (<a href="https://redirect.github.com/astral-sh/uv/pull/21413">#21413</a>, <a href="https://redirect.github.com/astral-sh/uv/pull/21415">#21415</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Add <code>--no-locked</code> and <code>--no-frozen</code> to disable lock modes enabled by <code>UV_LOCKED</code> and <code>UV_FROZEN</code> for a single invocation (<a href="https://redirect.github.com/astral-sh/uv/pull/21408">#21408</a>)</li> <li>Report the exact command-line lock-mode flag in warnings and errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21402">#21402</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up cold wheel installs by extracting each streaming ZIP archive in a single blocking task and reusing buffers across files (<a href="https://redirect.github.com/astral-sh/uv/pull/21372">#21372</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Update <code>async_http_range_reader</code> to 0.11.1 to address a potential memory-safety issue when reading metadata ranges from untrusted wheels (<a href="https://redirect.github.com/astral-sh/uv/pull/21401">#21401</a>)</li> <li>Remove sensitive headers when redirects cross authentication realms, including same-host redirects that change URL schemes (<a href="https://redirect.github.com/astral-sh/uv/pull/21382">#21382</a>)</li> <li>Redact secrets in signed URLs from retry diagnostics, including nested request errors (<a href="https://redirect.github.com/astral-sh/uv/pull/21381">#21381</a>)</li> <li>Give <code>--locked</code>, <code>--frozen</code>, <code>--check</code>, and <code>--check-exists</code> precedence over conflicting <code>UV_LOCKED</code> and <code>UV_FROZEN</code> values (<a href="https://redirect.github.com/astral-sh/uv/pull/21396">#21396</a>)</li> <li>Prevent concurrent uv processes from redundantly extracting the same local or source-built wheel (<a href="https://redirect.github.com/astral-sh/uv/pull/21400">#21400</a>)</li> </ul> <h2>0.12.8</h2> <p>Released on 2026-08-31.</p> <h3>Enhancements</h3> <ul> <li>Warn about invalid tool directories and continue upgrading valid tools with <code>uv tool upgrade --all</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21368">#21368</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Deduplicate identical files within and across cached wheels with the <code>content-addressed-cache</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/21327">#21327</a>)</li> <li>Reduce allocations while extracting content-addressed wheels by reusing the hashing buffer across files (<a href="https://redirect.github.com/astral-sh/uv/pull/21340">#21340</a>)</li> <li>Speed up content-addressed cache cleanup on macOS by reading hard-link counts in bulk (<a href="https://redirect.github.com/astral-sh/uv/pull/21344">#21344</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Prevent concurrent uv processes from downloading and extracting the same remote wheel more than once (<a href="https://redirect.github.com/astral-sh/uv/pull/21379">#21379</a>)</li> <li>Speed up dependency graph construction from large lockfiles by indexing packages during traversal (<a href="https://redirect.github.com/astral-sh/uv/pull/21373">#21373</a>)</li> <li>Extend indexed lockfile traversal to exports, dependency trees, audits, and freshness checks (<a href="https://redirect.github.com/astral-sh/uv/pull/21377">#21377</a>)</li> <li>Speed up warm resolutions by reducing repeated marker interner work (<a href="https://redirect.github.com/astral-sh/uv/pull/21300">#21300</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Do not trust hashes from direct URLs discovered only in wheel metadata when installing with <code>--require-hashes</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21348">#21348</a>)</li> <li>Use a compatible Azure Storage API version for anonymous and authenticated requests, allowing credential retries when public access is disabled (<a href="https://redirect.github.com/astral-sh/uv/pull/21366">#21366</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/9f928602938ac5cf1cd6b294a725833c16f5720e"><code>9f92860</code></a> Bump version to 0.12.9 (<a href="https://redirect.github.com/astral-sh/uv/issues/21422">#21422</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/29c546228ed6ba8970bb063960c9a767fae19236"><code>29c5462</code></a> Skip invalid scripts in <code>uv workspace list --scripts</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/21416">#21416</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/bf1d7e8049017a363565185a7df7e86f33041452"><code>bf1d7e8</code></a> Encapsulate wheel extraction directory ownership (<a href="https://redirect.github.com/astral-sh/uv/issues/21419">#21419</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6dacee042f58cea9184267ffb70c6960582bb210"><code>6dacee0</code></a> Run streaming ZIP extraction in a blocking task (<a href="https://redirect.github.com/astral-sh/uv/issues/21372">#21372</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/91d1ebf1b4ea1fc00928b412a9da23639aacb086"><code>91d1ebf</code></a> Sync latest Python releases (<a href="https://redirect.github.com/astral-sh/uv/issues/21415">#21415</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/6a61ddb2c094ab44e55a2cc5bb4a88b7c08d733a"><code>6a61ddb</code></a> Revert "Limit CI planner checkout depth" (<a href="https://redirect.github.com/astral-sh/uv/issues/21414">#21414</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e9d1816b538468e7deb8f267f28775007706b866"><code>e9d1816</code></a> Add CPython 3.15.0rc2 (<a href="https://redirect.github.com/astral-sh/uv/issues/21413">#21413</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/e888329afc22fa3e34f93d5ae5e23fbc87328952"><code>e888329</code></a> Remove unreachable lock configuration sources (<a href="https://redirect.github.com/astral-sh/uv/issues/21409">#21409</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/bf041f9245952ba7c9e3c29aebe0a8acc2bc983d"><code>bf041f9</code></a> Allow negating locked and frozen modes (<a href="https://redirect.github.com/astral-sh/uv/issues/21408">#21408</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/feffc0b5bbf8aeca1dff4a6f042a58e44a5daf09"><code>feffc0b</code></a> Bump async_http_range_reader to 0.11.1 (<a href="https://redirect.github.com/astral-sh/uv/issues/21401">#21401</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.12.5...0.12.9">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
b317dd1110 |
build(deps): bump python from cae66f2 to cad9a2c (#1307)
> [!WARNING] > Cooldown could not be applied because no publication date was available from the registry. > Bumps python from `cae66f2` to `cad9a2c`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
faaa119884 |
build(deps): bump python from ce40764 to cae66f2 (#1278)
Bumps python from `ce40764` to `cae66f2`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
cb3f6fee82 |
build(deps): bump astral-sh/uv from 0.11.3 to 0.12.5 in the docker-base-image-digests group (#1247)
Bumps the docker-base-image-digests group with 1 update: [astral-sh/uv](https://github.com/astral-sh/uv). Updates `astral-sh/uv` from 0.11.3 to 0.12.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/releases">astral-sh/uv's releases</a>.</em></p> <blockquote> <h2>0.12.5</h2> <h2>Release Notes</h2> <p>Released on 2026-08-14.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.21, 3.11.16, and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21138">#21138</a>)</li> <li>Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (<a href="https://redirect.github.com/astral-sh/uv/pull/21134">#21134</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21130">#21130</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Allow <code>--index</code> and <code>--default-index</code> to select configured package indexes by name with the <code>index-by-name</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/17455">#17455</a>)</li> <li>Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (<a href="https://redirect.github.com/astral-sh/uv/pull/21131">#21131</a>)</li> <li>Fall back to logical file sizes when using <code>cache-physical-space</code> on filesystems that do not support physical-space accounting (<a href="https://redirect.github.com/astral-sh/uv/pull/21133">#21133</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Resolve relative package index paths in PEP 723 scripts against the script directory (<a href="https://redirect.github.com/astral-sh/uv/pull/21097">#21097</a>)</li> </ul> <h2>Install uv 0.12.5</h2> <h3>Install prebuilt binaries via shell script</h3> <pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.sh | sh </code></pre> <h3>Install prebuilt binaries via powershell script</h3> <pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-installer.ps1 | iex" </code></pre> <h2>Download uv 0.12.5</h2> <table> <thead> <tr> <th>File</th> <th>Platform</th> <th>Checksum</th> </tr> </thead> <tbody> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz">uv-aarch64-apple-darwin.tar.gz</a></td> <td>Apple Silicon macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz">uv-x86_64-apple-darwin.tar.gz</a></td> <td>Intel macOS</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-apple-darwin.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-pc-windows-msvc.zip">uv-aarch64-pc-windows-msvc.zip</a></td> <td>ARM64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-pc-windows-msvc.zip">uv-i686-pc-windows-msvc.zip</a></td> <td>x86 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip">uv-x86_64-pc-windows-msvc.zip</a></td> <td>x64 Windows</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-x86_64-pc-windows-msvc.zip.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-gnu.tar.gz">uv-aarch64-unknown-linux-gnu.tar.gz</a></td> <td>ARM64 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-aarch64-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-unknown-linux-gnu.tar.gz">uv-i686-unknown-linux-gnu.tar.gz</a></td> <td>x86 Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-i686-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> <tr> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-powerpc64le-unknown-linux-gnu.tar.gz">uv-powerpc64le-unknown-linux-gnu.tar.gz</a></td> <td>PPC64LE Linux</td> <td><a href="https://releases.astral.sh/github/uv/releases/download/0.12.5/uv-powerpc64le-unknown-linux-gnu.tar.gz.sha256">checksum</a></td> </tr> </tbody> </table> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's changelog</a>.</em></p> <blockquote> <h2>0.12.5</h2> <p>Released on 2026-08-14.</p> <h3>Python</h3> <ul> <li>Add CPython 3.10.21, 3.11.16, and 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/pull/21138">#21138</a>)</li> <li>Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (<a href="https://redirect.github.com/astral-sh/uv/pull/21134">#21134</a>)</li> </ul> <h3>Enhancements</h3> <ul> <li>Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (<a href="https://redirect.github.com/astral-sh/uv/pull/21130">#21130</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Allow <code>--index</code> and <code>--default-index</code> to select configured package indexes by name with the <code>index-by-name</code> preview feature (<a href="https://redirect.github.com/astral-sh/uv/pull/17455">#17455</a>)</li> <li>Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (<a href="https://redirect.github.com/astral-sh/uv/pull/21131">#21131</a>)</li> <li>Fall back to logical file sizes when using <code>cache-physical-space</code> on filesystems that do not support physical-space accounting (<a href="https://redirect.github.com/astral-sh/uv/pull/21133">#21133</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Resolve relative package index paths in PEP 723 scripts against the script directory (<a href="https://redirect.github.com/astral-sh/uv/pull/21097">#21097</a>)</li> </ul> <h2>0.12.4</h2> <p>Released on 2026-08-13.</p> <h3>Enhancements</h3> <ul> <li>Prefer post-quantum key exchange and enable opt-in TLS diagnostics (<a href="https://redirect.github.com/astral-sh/uv/pull/21054">#21054</a>)</li> <li>Accept whitespace before versions in noncompliant wildcard comparisons such as <code>Requires-Python: >= 3.5.*</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21012">#21012</a>)</li> <li>Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (<a href="https://redirect.github.com/astral-sh/uv/pull/20944">#20944</a>)</li> <li>Omit source-span carets from diagnostics for empty PEP 508 requirements (<a href="https://redirect.github.com/astral-sh/uv/pull/21094">#21094</a>)</li> </ul> <h3>Preview features</h3> <ul> <li>Add <code>uv check --no-install-project</code> and respect <code>UV_NO_INSTALL_PROJECT</code> to install dependencies without building or installing the project (<a href="https://redirect.github.com/astral-sh/uv/pull/21085">#21085</a>)</li> <li>Make the ty subprocess invoked by <code>uv check</code> honor uv's color and progress settings, including quiet mode (<a href="https://redirect.github.com/astral-sh/uv/pull/21086">#21086</a>)</li> </ul> <h3>Performance</h3> <ul> <li>Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (<a href="https://redirect.github.com/astral-sh/uv/pull/20804">#20804</a>)</li> <li>Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (<a href="https://redirect.github.com/astral-sh/uv/pull/21041">#21041</a>)</li> </ul> <h3>Bug fixes</h3> <ul> <li>Use windowed <code>pythonw.exe</code> launchers for virtual environments created from managed Python minor-version links (<a href="https://redirect.github.com/astral-sh/uv/pull/19235">#19235</a>)</li> <li>Allow <code>uv lock</code> to proceed when <code>.venv</code> is an unusable project environment (<a href="https://redirect.github.com/astral-sh/uv/pull/21068">#21068</a>)</li> <li>Respect <code>fork-strategy</code> when ordering forks created from <code>environments</code> or existing lockfile <code>resolution-markers</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21000">#21000</a>)</li> <li>Preserve consecutive wildcard Python minor-version exclusions such as <code>!=3.11.*, !=3.12.*</code> in <code>uv.lock</code> (<a href="https://redirect.github.com/astral-sh/uv/pull/21045">#21045</a>)</li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/astral-sh/uv/commit/210d1f6785e95a8c8c0d53e284408c9be1134700"><code>210d1f6</code></a> Bump version to 0.12.5 (<a href="https://redirect.github.com/astral-sh/uv/issues/21140">#21140</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/802a9162a1153ddee799a0080c80a38d96009d91"><code>802a916</code></a> Sync latest Python releases: 3.10.21, 3.11.16, 3.12.14 (<a href="https://redirect.github.com/astral-sh/uv/issues/21138">#21138</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/a6904bbdabd3c6ac42b1051896ff597c8bd1895a"><code>a6904bb</code></a> Order equal-priority Python installations by key (<a href="https://redirect.github.com/astral-sh/uv/issues/21134">#21134</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/728a70d25c0889d9aaa53776256c3a843eea67a6"><code>728a70d</code></a> Improve automated fixes for related bug manifestations (<a href="https://redirect.github.com/astral-sh/uv/issues/21102">#21102</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/b82b0383fc3471227aa864f18d2c1c8efac8b9f1"><code>b82b038</code></a> Include hashes in cyclonedx exports (<a href="https://redirect.github.com/astral-sh/uv/issues/21131">#21131</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/8011778d41f2c96fb0b856fb3cbcb4ec8d28cb63"><code>8011778</code></a> Simplify editable requirement errors and hints (<a href="https://redirect.github.com/astral-sh/uv/issues/21130">#21130</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/dca33f5e6799f2aefee52729732a839a3b358740"><code>dca33f5</code></a> Fall back to logical cache accounting on unsupported filesystems (<a href="https://redirect.github.com/astral-sh/uv/issues/21133">#21133</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/3a76e496e36783371a6d91a8f4834478964d36ca"><code>3a76e49</code></a> Get rid of <code>Lock::with_manifest</code>, make <code>Lock::from_resolution</code> take the manif...</li> <li><a href="https://github.com/astral-sh/uv/commit/7e6caa45f62a0506fea1b8ecfa0558e5d62d520c"><code>7e6caa4</code></a> Support referencing indexes by name via <code>--index</code> and <code>--default-index</code> (<a href="https://redirect.github.com/astral-sh/uv/issues/17455">#17455</a>)</li> <li><a href="https://github.com/astral-sh/uv/commit/298dda41bff49bbd0a2f397e1662ab09b9cd148e"><code>298dda4</code></a> Fix relative indexes in PEP 723 scripts (<a href="https://redirect.github.com/astral-sh/uv/issues/21097">#21097</a>)</li> <li>Additional commits viewable in <a href="https://github.com/astral-sh/uv/compare/0.11.3...0.12.5">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
7d56624ab6 |
fix: group multi-file audiobooks that arrive as an archive (#1254)
Follow-up to #1237. \`rename_and_group\` only grouped when the source root was a directory, so a multi-file audiobook delivered as a single archive fell through to the flat path: a \`Book.zip\` of twelve chapters landed loose in the destination root with its original chapter names — the layout #1181 is about. The \`is_dir()\` guard was there to keep \`Book.zip/\` from becoming the folder name, but skipping the file case gives up the grouping instead of naming it. A non-directory source can only produce several book files by having been extracted (\`collect_staged_files\` returns a single-element list for every other file shape), so the archive stem is the release name and the suffix is packaging: group under \`Book/\`. Also regenerates the env docs for the new option and gives it the same \"do not use with ingest folders\" caveat Rename and Organize carries, since both now create directories in the destination. Tested: reverting only the source fix makes both new tests fail and the \`rename\` control case pass, so grouping stays opt-in. Full non-e2e suite green (2653 passed). |
||
 Sujeito OperatorandCaliBrain
|
52c1702419 |
docker: mount uv at build time instead of copying it into every image (#1200)
### What this PR does
`uv` stops being copied into the image and starts being mounted into the
three `RUN`s that
actually use it. The digest pin stays in exactly one place — it moves
from the `COPY` to a
stage declaration:
```dockerfile
FROM ghcr.io/astral-sh/uv:0.11.3@sha256:90bbb3c... AS uv
```
```dockerfile
RUN --mount=type=cache,target=/root/.cache/uv \
--mount=from=uv,source=/uv,target=/usr/local/bin/uv \
uv sync --locked --no-default-groups
```
A stage consumed only through `--mount=from=` contributes no layer to
anything published, so
`uv` never lands in `base`. The two `RUN rm -f /usr/bin/uv /usr/bin/uvx`
lines then have nothing
left to delete and go with it.
### Why
The `base` stage copies uv in, and both final stages try to take it back
out:
```dockerfile
# uv is only needed while building the image.
RUN rm -f /usr/bin/uv /usr/bin/uvx
```
That intent is exactly right. **The mechanism can't carry it out**: a
`RUN` adds a layer, it
does not rewrite the layer underneath. The `COPY` layer is still pushed
and still pulled by
everyone. What the `rm` produces is a whiteout on top of it.
### Measured, not assumed
Read off the published images over the registry API — `linux/amd64`,
both built
`2026-08-13T17:53Z`, pinned by digest so these numbers stay reproducible
after tonight's
scheduled rebuild:
```
ghcr.io/calibrain/shelfmark@sha256:9b6041f797cbcc1e5c50ab42bd010a8f747dfaac926080cb6269ddfae99cf820
layer COPY /uv /uvx /bin/ 24.3 MB of 585 MB total 4.1% of the pull
layer RUN rm -f /usr/bin/uv /usr/bin/uvx 159 B
ghcr.io/calibrain/shelfmark-lite@sha256:2eae503d791cef685e10135aaaff77077cfb4a31d6911e31216704988ce28b02
layer COPY /uv /uvx /bin/ 24.3 MB of 221 MB total 11.0% of the pull
```
The `rm` layer unpacks to exactly four tar entries:
```
usr/
usr/bin/
usr/bin/.wh.uv 0 bytes
usr/bin/.wh.uvx 0 bytes
```
Two zero-length overlayfs whiteouts. That is the deletion behaving
exactly as specified — and
removing nothing at all from what anyone downloads.
Same thing without the registry API:
```
$ docker manifest inspect ghcr.io/calibrain/shelfmark-lite:latest
```
and look for the ~24 MB layer; or `docker history` on a local build.
### To be clear about what the `rm` does and doesn't do
**It is not useless and I'm not claiming it is.** It removes `uv` from
the flattened filesystem,
which is what the container sees at runtime and what Trivy/Grype scan by
default — so the
"don't ship a stale installer" half of the intent is already working
today, the same way the
`pip` removal above it does. This PR is about the other half: the bytes.
After it, `uv` is
absent from the filesystem *and* absent from the layers, so nothing
regresses.
This is image size, not a vulnerability, and I would not have opened it
as anything else.
### Why this is safe
- **Nothing at runtime can depend on `uv` or `uvx` today**, and that is
read off your own
artifact rather than argued: both are already whiteouted out of both
published images. `uvx`
is never invoked anywhere in the repo — `entrypoint.sh` has no `uv` in
it, and the Makefile's
`uv run` lines are the host-side dev workflow, outside the image.
- `/usr/local/bin` is already on `PATH` in `python:3.14.7-slim`, and
your `ENV PATH=/app/.venv/bin:$PATH`
prepends rather than replaces, so `uv` resolves the same way it does
now.
- The pin does not move. Same image, same `sha256`, same resolution per
target platform as
`COPY --from=<image>` does today, so the `linux/amd64` and `linux/arm64`
builds each keep
getting their own `uv`.
- `RUN --mount=` is already used three times in this file, so the
frontend in use supports
mounts; `from=` is part of the same feature.
- Your `docker-build-check` job builds `shelfmark-lite` on every PR, so
a build is the cheapest
possible review of this change. As a first-time contributor my workflow
runs sit at
`action_required` until someone approves them — approving is enough to
check the whole claim.
### Notes for reviewers
- I have **not** built these images locally. There is no Docker daemon
on the machine I run on.
Every figure above is read from the published images over the registry
API, and my own
selftest re-reads them live on each run rather than trusting a note.
- I left the `pip` removal in `base` alone. It has the same shape, but
its stated goal — keeping
a stale installer out of what scanners see — is genuinely achieved by
the flattened
filesystem, and `pip` arrives in the `python:slim` base layer where a
Dockerfile change can't
reach it anyway.
- Written by an automated agent; saying so plainly seemed better than
not.
Signed-off-by: Sujeito Operator <operator@sujeito.org>
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
|
||
|
dependabot[bot]
|
78e1f4daba |
Bump python from 83c1ceb to ce40764 (#1206)
Bumps python from `83c1ceb` to `ce40764`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
7f770f54fa |
Bump python from 3.14.6-slim to 3.14.7-slim (#1190)
Bumps python from 3.14.6-slim to 3.14.7-slim. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
CaliBrain
|
cc1a95f965 |
Fix protection bypass cancelled by stall detection at exactly 300s (#1184)
A download that hits Cloudflare hung on "Bypassing protection..." for five minutes and then died, regardless of which bypasser was configured. html_get_page() started a BypassHeartbeat thread to keep the download marked alive during a bypass, but the thread had no loop: it fired one status event and returned. Even with the loop restored it could not have worked, because update_download_status() dedupes identical (status, message) tuples and returns before refreshing _last_activity, and the heartbeat re-sent the byte-identical payload already emitted just above it. So _last_activity was frozen for the whole bypass, while both bypassers are allowed to run longer than STALL_TIMEOUT (external FlareSolverr ~394s at default settings, internal 420s per get() call). The watchdog always won. From a reporter's log: 403 at 07:04:33.390, cancelled at 07:09:33.987 - exactly 300.000s, and 41s before the bypasser would have finished and reported the real error, an HTTP 500 from FlareSolverr the user never saw. The regression is not one commit. |
||
|
CaliBrain
|
dfcd7c9b00 |
Fix silent Hardcover search failures on rejected sort values (#1183)
Hardcover forwards the `sort` argument to Typesense's `sort_by` and
rejects
the entire search if it dislikes the value -- an unknown field, a bare
field
name with no direction, or more than three sort keys. A rejected search
is
not a GraphQL error: it comes back as HTTP 200, no `errors` key, and a
null
`results` body.
_extract_typesense_hits() reads that null as `hits=[], found=0`, so a
failed
search was indistinguishable from one that matched nothing. Users saw
zero
results with a healthy container and no log line explaining why.
Add _execute_search_query(), used by the three sort-bearing call sites
(book
search, field typeahead, series resolution):
- Detect the rejection via the null `results` body. A search that
genuinely
matched nothing still returns a results object with `found: 0`, so empty
result sets are not mistaken for failures.
- Retry once with an empty sort, which Hardcover always accepts, so
searches
return results instead of nothing.
- Keep that fallback sticky for 15 minutes so every subsequent search
does
not pay for a request known to fail, and let it expire so sort order
comes
back on its own if the index is fixed upstream.
- Log rejections that no sort can explain, and retries that also fail,
at
ERROR instead of discarding them.
While the fallback is active, results fall back to Typesense's default
ordering regardless of the selected sort. Degraded ordering beats no
results,
and it is now logged rather than silent.
SORT_MAPPING itself is unchanged: all five of its values were verified
against
the live API and return results. The `sort: "relevance"` reported in
#1179 was
the raw SortOrder value sent by v1.3.5; the mapping already fixed that.
What
remained unfixed, and is fixed here, is that the failure was invisible.
Fixes #1179
|
||
|
dependabot[bot]
|
bd9a22bd6c |
Bump node from a0b9bf0 to d32cdf6 in the docker-base-image-digests group (#1168)
Bumps the docker-base-image-digests group with 1 update: node. Updates `node` from `a0b9bf0` to `d32cdf6` [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
8eb9bd5c21 |
Bump python from d3400aa to cea0e60 (#1131)
Bumps python from `d3400aa` to `cea0e60`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
2d949d4e7c |
Bump python from b877e50 to d3400aa (#1119)
Bumps python from `b877e50` to `d3400aa`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
 Alex SchittkoandCaliBrain
|
40d6a179b7 |
feat: native WireGuard VPN egress mode (USING_WIREGUARD) (#1097)
Add an opt-in WireGuard egress path alongside the existing Tor mode --------- Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
|
CaliBrain
|
02a45c1a12 | fix: pin chromium to 149.0.7827.196 — Debian's 150 breaks the CDP bypasser (#1105) | ||
|
Alex Schittko
|
8b4230ee9f |
fix(bypass): resolve Xlib namespace collision breaking CDP browser startup (#1099)
## Problem The full (browser) image ships two conflicting distributions that both own the top-level `Xlib/` namespace: - **`python-xlib` 0.33** (2022) — pulled by the `browser` extra - **`python3-xlib` 0.15** (2014) — pulled transitively via `pyautogui` → `mouseinfo` Both install into the same `Xlib/` directory, so install order decides which files survive. When the 2014 `python3-xlib` lands last, `Xlib.X` is missing the `FamilyServerInterpreted` attribute that the SeleniumBase Pure-CDP driver references during browser startup. Every bypass attempt then fails with: ``` Pure CDP browser startup failed: module 'Xlib.X' has no attribute 'FamilyServerInterpreted' Bypasser error: RuntimeError: Pure CDP browser startup failed: module 'Xlib.X' has no attribute 'FamilyServerInterpreted' ``` Result: **all Cloudflare / DDoS-Guard protected downloads fail** on affected builds. ## Fix After the browser stack is installed, uninstall the stale `python3-xlib` and force-reinstall `python-xlib==0.33` so it deterministically owns the namespace. A build-time assertion checks `Xlib.X.FamilyServerInterpreted` exists so the image fails fast if the collision ever returns. `pyautogui` operates correctly against `python-xlib` 0.33 (superset API), so nothing else regresses. ## Testing - Reproduced live: a build where `python3-xlib` won produced the exact `FamilyServerInterpreted` error on every CDP browser start; removing it and reinstating `python-xlib==0.33` immediately restored `Chrome browser ready (Pure CDP)` and successful `_bypass_method_cdp_solve`. - The new build-time assertion prints `Xlib namespace OK: (0, 33)` and exits non-zero if the attribute is ever missing. |
||
|
dependabot[bot]
|
14bd50bfd1 |
Bump python from 63a4c7f to b877e50 (#1100)
Bumps python from `63a4c7f` to `b877e50`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
76c55a488c |
Bump node from 156b55f to a0b9bf0 in the docker-base-image-digests group (#1089)
Bumps the docker-base-image-digests group with 1 update: node. Updates `node` from `156b55f` to `a0b9bf0` [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
08d0a04cf2 |
Bump python from 44dd044 to 63a4c7f (#1090)
Bumps python from `44dd044` to `63a4c7f`. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
3c1b79989a |
Bump node from fb71d01 to 156b55f in the docker-base-image-digests group (#1075)
Bumps the docker-base-image-digests group with 1 update: node. Updates `node` from `fb71d01` to `156b55f` [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
e41c1d4e8e |
Bump python from 3.14.5-slim to 3.14.6-slim (#1076)
Bumps python from 3.14.5-slim to 3.14.6-slim. [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
b5acbc1209 |
Bump node from 2bdb65e to fb71d01 in the docker-base-image-digests group (#1061)
Bumps the docker-base-image-digests group with 1 update: node. Updates `node` from `2bdb65e` to `fb71d01` [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andCaliBrain
|
709d3828d9 |
Bump the docker-base-image-digests group across 1 directory with 2 updates (#1015)
Bumps the docker-base-image-digests group with 2 updates in the / directory: node and python. Updates `node` from `d1b3b4d` to `2bdb65e` Updates `python` from 3.14-slim to 3.14.5-slim Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: CaliBrain <calibrain@l4n.xyz> |
||
 Alex
|
b67df083e6 | Remove installer tooling from runtime images (#978) | ||
|
Alex
|
f4daf05d03 | Pin Docker base image digests (#969) | ||
|
Alex
|
41c4aa1d72 |
Updated permissions model and non-root support (#871)
- Adds a non-root startup path at user 1000:1000 - skips privilege escalation and ownership checks. Works e.g. for kubernetes deployments (user 1000:1000 and runAsNonRoot enabled). - Remove startup check/chown commands for user-owned folders. Checks can be done with a "Test destination" button in settings which performs a test write. Users are responsible for fixing their own permissions. - Update docs |
||
|
Alex
|
e3d5bd91fc | Bump node to 24 LTS (#853) | ||
|
Alex
|
3a3a3ce449 |
Add new python tooling + apply ruff linter cleanup (#845)
- Adds `uv`, `ruff`, `pyright`, `vulture` and `pytest-xdist` - Move project, lockfile, docker build etc to uv - Align python tooling on 3.14 - Huge bulk of ruff linter fixes applied. Still in progress but all the core types are now enforced - Update CI and test helpers |
||
|
Alexanddependabot[bot]
|
21a11b06b9 |
Dependency updates roll-up (#765)
Supersedes the dependabot PRs after testing: - `actions/attest-build-provenance` - `docker/build-push-action` - `actions/checkout` - `seleniumbase` - `docker/metadata-action` - `actions/setup-node` - `python:3.14-slim` - `@types/node` - `postcss` - `react-router-dom` Left out for now: - `node:25-alpine` - `vite@8` - `@vitejs/plugin-react@6` --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Alex
|
7d992c3918 |
User DB cleanup and refactor (#686)
- Refactored user and request code to avoid any database conflicts - Fix threading behavior with custom script execution - Harden the no_auth activity user filtering - Add a hint to add local admin if none is created - Added secret key to persist login states across updates / restarts |
||
 Alex
|
b10458a48b |
Patch: Migrate bypasser to pure CDP + Misc fixes (#575)
Bypasser: - Refactored internal bypasser logic to use SeleniumBase Pure CDP mode, removed chromedriver dependencies and UC code. - Added dedicated threading for internal bypasser functions, fixes any potential asyncio CPU spike behavior - Fixed WebGL issue with Chromium 144. Reverted 1.0.3 hotfix and updated to latest Chromium Misc: - Added M4A color mapping - Fix frontend language filtering with multi-language releases - Added "days" age for usenet/torrent releases - Improved entrypoint chown efficiency - Added `ONBOARDING` env variable, default true |
||
|
Alex
|
10bfaec793 | Fix: Broken bypasser dependencies (#540) |