starred/shelfmark
1
0 Fork 0
mirror of https://github.com/calibrain/shelfmark.git synced 2026-11-15 23:08:13 +00:00
Code Issues Packages Projects Releases 10 Wiki Activity
721 Commits 5 Branches 52 Tags
ef40a38546cb7932f002267f04d5a2be5b5e1fee
Commit Graph
721 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
splitsec2 ef40a38546 fix: report a stopped download coordinator in /api/health (#1568) 
If the download coordinator thread dies, every task sits at "Queued" and
nothing says why. The rest of the app keeps answering, `/api/health`
stays green and the container looks fine. #823 and #1166 were both that,
and the loop's `except Exception` cannot catch everything that can end a
thread.

`/api/health` now reports it. The response gets a `coordinator` field,
`running` or `stopped`, and when it is stopped the status is `error` and
the HTTP code is 503. The Docker healthcheck in the Dockerfile and the
one in the readme both use `curl -f`, so the container shows as
unhealthy and anything watching health (Uptime Kuma, autoheal) can act
on it. It needs no login, same as before, and shows no queue contents.

That 503 is the one decision here. Keeping the 200 and only adding a
`degraded` entry would not trip a status-code health check, which is the
whole point, so I went with 503. Easy to flip if you would rather not.

The orchestrator gets a small `coordinator_running()` that asks whether
the thread is alive. `start()` already knows how to restart a dead
thread, so restarting it automatically would be the true fix, but I
would rather the failure be visible first and decide on that separately.

Tests: three for the route (ok, 503, no login needed) and three for
`coordinator_running` (never started, alive, dead). They fail without
the change. One existing test hits `/api/health` through an app that
never starts the coordinator, so it now patches that. The readme's
health section has a sentence about the 503. Full suite passes, ruff and
basedpyright are clean.
 2026-10-24 17:12:58 -06:00
splitsec2 973cf472a2 test(image-cache): flush window test no longer depends on float rounding (#1580) 
`test_cache_hit_flushes_the_index_once_the_window_has_passed` (from
#1544) failed on the first attempt of two of my PRs' Python Tests runs
today (#1576, #1579) and passed on rerun, with nothing in either PR
touching the image cache.

The test sets the clock to exactly `last_saved + ACCESS_FLUSH_SECONDS`
and expects a flush. `(now + 30) - now` isn't always 30.0 in floating
point. For example `105.65207077218265 + 30 - 105.65207077218265` is
`29.999999999999986`, so the `>=` check is false and the flush never
happens. That only shows up when the monotonic value is small, which
fits a freshly booted runner (on this box the uptime is in the millions
of seconds and it never fails). I haven't been able to see the runner's
actual uptime in the CI logs, so that part is an inference, but pinning
`_last_saved` to that value reproduces the exact failure (`assert [] ==
[1]`) locally.

The test now puts the clock one second past the window. The production
check is fine, real elapsed time doesn't have this edge, so only the
test changes.
 2026-10-24 17:10:08 -06:00
splitsec2 b248bcd536 fix(clients): import a qBittorrent torrent only when every listed file is on disk (#1577) 
Fixes #1561, with thanks to @tmussche for the write-up, which had the
cause and the fix. When the files reach Shelfmark through a sync
(Resilio in the report), the wait for the completed path accepts the
folder once two samples a few seconds apart look the same. A sync that
copies in batches can pause longer than that, so 10 of 23 files were
imported and some of those were still partial copies.

For qBittorrent the client can say what the finished download holds, so
the wait now checks that. `DownloadClient` gets an optional
`get_expected_files()` that returns `ExpectedFile(name, size)` entries,
or None when the client cannot say, which is the default and keeps every
other client as it was. qBittorrent answers it from
`/api/v2/torrents/files`, leaving out files the torrent does not
download (priority 0), zero-byte entries and BEP 47 padding files.
`_wait_for_completed_path` asks once, and while any of those files is
missing or smaller than its final size it keeps waiting, using the same
timeout as before. When the wait runs out the error now says how far it
got, for example "Completed download is not fully on disk yet (10 of 23
files)." Once everything is there the existing stability check still
runs, so nothing is accepted that was accepted before.

Names from the client start with the torrent's top-level folder, so each
file is looked up with and without it, which also covers a torrent saved
without a subfolder. A single-file torrent is checked by size too, since
a file that is still syncing exists at a smaller size.

Two things I would like a second look at: the comparison is on exact
size, so a setup where something rewrites the files after the torrent
finishes would never match and would run into the timeout; and the file
list is read once per wait, not on every poll. If the client does not
answer, nothing changes.

I also moved the nested authenticated GET in the path derivation into a
`_get_with_auth` method so both calls share it, and added a sentence
about this to `docs/configuration.md`. Tests: eight for the wait
(partial folder, truncated file, files arriving during the wait,
complete folder, no top-level folder, single file both ways, and a
client without a list), and six for the qBittorrent file list. The wait
tests that depend on the new behaviour fail on current main. Full suite
passes.
 2026-10-24 17:08:04 -06:00
splitsec2 9011319ade refactor: one lookup for the supported formats, public names for two shared helpers (#1576) 
Six places read the Supported Book Formats and Supported Audiobook
Formats settings on their own: post-processing, the post-process scan,
IRC, slskd, Prowlarr and direct download. For ebooks they already
agreed, since they all fall back to `DEFAULT_EBOOK_FORMATS`. For
audiobooks they did not. The settings registry and slskd fall back to
every audio format plus zip and rar, while post-processing and IRC fell
back to m4b and mp3 only.

They now share `shelfmark/core/formats.py`, with
`get_supported_formats`, `get_supported_audiobook_formats` and a
content-type aware `get_supported_formats_for`, and a shared
`DEFAULT_AUDIOBOOK_FORMATS` in `core/utils.py` next to the ebook one.
`policy.py` re-exports the same functions, so nothing that imports them
from there changes. It is not in `policy.py` itself because importing
the `postprocess` package pulls in the router, which imports the release
sources, so a source could not import from it without a cycle.

One behaviour difference, and only in the fallback: with the audiobook
setting unset, or emptied, post-processing and IRC used to accept m4b
and mp3 and now accept the full default list like slskd and the settings
page already did. A configured list is read exactly as before. Direct
download's own helper used the raw configured list and now reads the
same normalized one, which is identical for any list the settings page
can save.

Also public now: `parse_size` in the Prowlarr source (slskd and Newznab
imported it with the underscore) and
`coerce_completed_path_timeout_seconds` in the client base handler
(slskd imported that too).

Not changed on purpose: slskd's `_coerce_int` looks like a copy of
`coerce_int` but is not. It reads `"12.0"` as 12 and `True` as 0, where
`coerce_int` gives 0 and 1. And the `_parse_size` in the IRC source is a
different function, string to bytes.

Tests: a new set checks that post-processing, IRC and slskd all fall
back to the shared defaults and that the settings default is the shared
one, and the scan-archive and IRC tests now patch the shared config
instead of the per-module copies. Full suite passes.
 2026-10-24 16:31:07 -06:00
splitsec2 606e94fde2 fix(settings): offer the seed settings for qBittorrent only (#1574) 
The two seed settings, Give Up With No Seeders and Minimum Seeders, show
up for every torrent client, but only qBittorrent reports a seed count.
With Transmission, Deluge or rTorrent you can set both and nothing
happens. The first one says "Only qBittorrent reports seed counts" at
the end of its description, the second says nothing about it.

Both are now shown only when qBittorrent is the selected client, the
same `show_when` the other qBittorrent fields use, and Minimum Seeders
gets the same sentence. A value someone already saved for another client
stays in their config, it just is not shown, and it had no effect before
either.

`docs/environment-variables.md` is regenerated for the changed
description, which is two lines. One test checks that both fields are
tied to qBittorrent and say so, and it fails without the change.
 2026-10-24 09:15:55 -06:00
splitsec2 70fe4b8c89 fix(hardcover): keep the scheduler alive on an unreadable interval, share one history connection per sync (#1569) 
These are the follow-ups from the review notes on #1516 and #1534 that I
said I would do once the series had merged.

The scheduler waits for the next cycle outside the try that guards the
cycle itself, so an interval setting that raised would end the thread
and nothing would sync again until a restart. It now logs the error and
tries again after six hours. `docs/hardcover-sync.md` says so.

The history check in the sync opened a new SQLite connection for every
book on the shelf. It opens one per sync now and shares it, which adds
up on a slow disk or a small board.

The two test nits from #1534 are in as well: a `parametrize` with a
single case, and an unused argument on a helper.

The thread surviving a failed wait and the shared connection each have a
test that fails without the change. Ruff, basedpyright and the backend
suite pass (5297 passed).
 2026-10-24 09:11:47 -06:00
splitsec2 a63d9e3e21 docs: regenerate the environment variable reference (#1565) 
Sorry about this one. The environment variable references had also
fallen well behind, and again I was a big part of that. A bunch of the
gaps come from my own PRs (Hardcover sync, auto-download, the
Audiobookshelf library check) where I charged ahead with the
functionality and skipped the boring documentation part (did I mention
that documentation is boring?).

I again had Claude compare the docs to the code and generate the
updates, so it would be good to have another human look this over before
it merges. The doc diff is just the generator's output. The part worth a
real read is the handful of new entries in
`scripts/generate_env_docs.py`, since I wrote those descriptions from
`entrypoint.sh` and `tor.sh` and not from a settings definition.

What changed:

- Regenerated `docs/environment-variables.md`. It had 287 variables and
the generator now produces 311. The 21 that were missing are the
Hardcover Sync tab (6), auto-download (11) and the Audiobookshelf
library check (4). Nothing was removed and no existing default, type or
option changed.
- `SHELFMARK_API_KEY_READONLY` was only ever hand-edited into the doc,
so the generator did not know it and a plain regeneration would have
dropped the row. It is in the generator now.
- Added `UMASK`, `TOR_CHECK_INTERVAL` and `TOR_MAX_FAILURES`. The code
reads all three and no doc mentioned them.
- The table of contents built its anchors by lowercasing and swapping
spaces, so the Webshare.cz and Moly.hu links were already broken (GitHub
drops the dots) and Soulseek (slskd) would have broken with the
parentheses. They now follow GitHub's rule.

Two tests cover the new entries and the anchors, and both fail without
the generator change. To regenerate: `python
scripts/generate_env_docs.py` on Python 3.14.

A test that fails when the committed file differs from the generator
output would have caught this drift, but then every PR that adds a
setting has to regenerate the doc. I left that out, your call if you
want it.
 2026-10-23 22:02:37 -06:00
splitsec2 e273e7b0ed docs(dev): bring the plugin guides in line with the current code (#1566) 
This is the biggest of the docs batch, and this time I don't think it
was my PRs that caused it. The plugin guides fell behind as the plugin
API changed over several releases, and nobody updated them along the
way.

Same arrangement as the others: Claude compared the guides to the code
and wrote the changes, so another human look before this merges would be
good. Someone who knows the plugin API well would catch things I would
not. These are the parts I would read first: the search plan table, the
`SourceUnavailableError` advice in the error handling section, and the
`locating` status row.

What was wrong and is now fixed, all checked against the code:

Release sources guide
- `search` takes `(book, plan, *, expand_search, content_type)`. Every
sample had the old one-argument signature, so a source written from the
guide raised a TypeError on its first search. There is now a short table
of the search plan fields.
- A source is registered by adding its module to
`_BUILTIN_SOURCE_MODULES`. The guide said to add an import at the bottom
of `__init__.py`.
- `get_column_config` is an instance method, not a classmethod, and
`ColumnRenderType.SEEDERS` does not exist (the real members are listed).
- `download` can return a `HandoffResult`. `list_available_sources`
lists every source with an `enabled` flag, it does not filter.
- `group="sources"` is gone, since only `direct_download` and
`metadata_providers` exist.
- Field lists for `Release`, `DownloadTask`, `BookMetadata`,
`ColumnSchema` and `ReleaseColumnConfig` are brought up to date, with
the protocol enum and the `locating` status.
- The optional hooks that were not mentioned (`post_process_cleanup`,
`build_retry_resolution_fields`, `list_authors`, `seed_complaints`,
`get_record`, `get_destination_override`, `search_results_are_releases`)
are documented.

Plugin settings guide
- The examples imported from `shelfmark.metadata_providers.base` and
`shelfmark.release_sources.base`, which do not exist. The metadata
example also skipped the abstract `search_by_isbn` and the kwargs
factory.
- Value priority now starts with the environment variable, and
`search_mode` is listed next to `general` as using `settings.json`. The
`metadata_providers` group order is 12, not 50.
- Documented `TagListField`, `OrderableListField`, `TableField`,
`env_var`, `env_supported`, `user_overridable`, `universal_only`,
`filter_by_field`, `register_on_save` and the `current_values` argument
for action callbacks.

Also in here: `docs/dev/index.md` was a TODO stub and is now a short
index linked from `docs/index.md`, a dead link in the metadata providers
README is fixed, and the README table gains Databáze knih and Moly.hu.

To check the samples were not just plausible, I ran the quick start and
the full BookNet example against the real registry. Both register,
instantiate and return their column config. The old BookNet example
failed on import with a NameError, because the Test Connection callback
was defined below the settings function that references it. The
decorator calls that function straight away, so both settings snippets
now define the callback first.
 2026-10-23 22:02:18 -06:00
splitsec2 20848a8774 docs: small fixes from a check of the docs against the code (#1567) 
These are the leftovers from the docs check, the fixes that did not
belong in the other three.

Claude did the comparison and wrote the changes here too, so I would
still like a human look before it merges. The one new piece of prose
worth a read is `troubleshooting.md`. It was a TODO page that two other
pages link to, so I filled it with only what I could confirm in the
code: where the logs go, `LOG_LEVEL`, the `DEBUG=true` bundle from the
bug report template, and reporting an issue. Happy to drop it back to a
stub if you would rather write that one yourself.

- `configuration.md`, `custom-scripts.md`, `users-and-requests.md`:
Booklore is Grimmory in the UI now. The stored mode value is still
`booklore`, and the custom script doc says so. The hardlink heading now
matches the "Hardlink Book Torrents" and "Hardlink Audiobook Torrents"
checkboxes.
- `custom-scripts.md`: the email output runs scripts too
(`phase=post_email`, `output.mode=email`, details under
`output.details.email`). It was missing from the phase list.
- `users-and-requests.md`: a delivery that fails with no retry available
goes back to pending on its own, and the admin reopen action is for
rejected requests. The page said an admin reopens a failed delivery.
Also noted that rules cannot use Request Book.
- `hardcover-sync.md`: added the missing
`AUTO_DOWNLOAD_AUDIOBOOK_MIN_SIZE_PERCENT` row and a sentence in the
ranking paragraph.
- `api-access.md`: an admin session also reads `/api/stats`, and what
the 403 says.
- `installation.md`: points at the Lite, Tor and WireGuard variants.

Docs only, no code touched.
 2026-10-23 22:01:54 -06:00
splitsec2 6b775cd9e8 refactor: move /api/stats into core/stats_routes.py (#1563) 
The sample extraction from Discussion #1536: `/api/stats` moves out of
`main.py` into `shelfmark/core/stats_routes.py`, registered with
`register_stats_routes(app, ...)` like the other route modules. The
route logic is the same, and no test changed.

`main.py` passes two callables instead of values, one for the user
database and one for the auth mode. They are called per request, so the
tests that patch `main.user_db` and `main.get_auth_mode` after import
still work. The read-only key allowlist in the middleware now uses the
path constant from the new module, so the path lives in one place.

This is only the shape. If it looks right I'll move the route groups
from the 1.5.0 PRs the same way, one PR each. If you'd rather leave
`main.py` as it is, close this and no harm done.
 2026-10-23 21:51:58 -06:00
splitsec2 61419451e4 docs(readme): bring the feature lists and project scope up to date (#1564) 
Sorry, this one is overdue. The readme still describes Shelfmark as it
was a few releases ago. Part of that is on me: Hardcover Sync, Library
Check and a few other things I added came in through PRs where I charged
ahead with the functionality and skipped the boring documentation part.
The rest are features other people added (Jackett, Webshare.cz, DNB and
so on) that never made it into the readme either.

I had Claude compare the readme to the code and generate the updates, so
it would be good to have another human look this over before it merges.
The scope section in particular is your call, since it states what
Shelfmark is for.

What changed:

- **Project Scope** said Shelfmark doesn't know what you own, doesn't
integrate with library software and has no background automation.
Library Check and Hardcover Sync ship exactly those things, so the list
now says what is still true (it never edits your library, and Hardcover
Sync is the one optional background job) and links both docs. I kept the
four bullets and the "not missing features" line.
- **Sources and providers** now include Jackett, Webshare.cz and
OceanofPDF, and DNB, Databáze knih and Moly.hu.
- **Features** gain Library Check and Hardcover Sync, both linking to
their existing docs pages.
- **Settings list** gets the download clients (including the four debrid
services), Jackett and Webshare.cz, and the Library Link bullet mentions
the audiobook library URL.

Docs only, no code touched. Every name and link was checked against the
code and the docs folder.
 2026-10-23 21:51:32 -06:00
splitsec2 d7a4b6b859 fix: keep exception text out of the status, config and release search responses (#1562) 
Same idea as #1558, for three more places that hand `str(e)` to whoever
is logged in. These are code scanning alerts 106, 142 and 143.

`/api/status` and `/api/config` returned the raw exception text of an
OSError, RuntimeError and so on with the 500. They now return "Could not
read the download status" and "Could not load the configuration". The
full error is still logged with its trace.

For `/api/releases`, a source failing with an unexpected error put
`source: <exception text>` into the error list that goes back to the
caller. `search_source_releases` takes a new `include_error_detail`
flag. The route passes True for admins (and when auth is off, where
everyone is treated as an admin) and False for everyone else, who get
`source: search failed`. The message of a `SourceUnavailableError` is
written for the user, so it is kept either way, and the background
auto-download caller keeps the default and sees the full text as before.

Left alone on purpose: the `reason` in the release inspect response,
since a test covers that it carries the error text and it looks
intentional.

Tests: two for the routes and two for the helper. All four fail without
the change. Full suite passes (5295), ruff and basedpyright are clean.
 2026-10-23 21:06:26 -06:00
amura11Claude Sonnet 5.5CaliBrain
 		23b3b3a9d8 feat: add Jackett release source (#1521) 
## Summary
Adds Jackett as a separate release source (`jackett`), as requested in
#1443.

- New `shelfmark/release_sources/jackett/` package: API client, settings
tab, source and handler.
- Searches Jackett's Torznab endpoints: the `all` aggregate by default,
or each selected indexer individually. Failed or timed-out searches
raise `SourceUnavailableError` instead of reporting "no releases found".
- Reuses Prowlarr code rather than duplicating it: the Torznab parser
(now also reads `<jackettindexer>`), `_prowlarr_result_to_release` (new
optional `source`/`source_id` args), the release cache, URL/protocol
helpers, the timeout clamp and size-limit helper (new optional
config-key args), and the handler's `list_files` / retry-restore logic.
- Downloads use the existing shared torrent client settings.
- `JACKETT_URL` is a trusted origin for `.torrent` fetching (it is
usually on the LAN). Prowlarr's `X-Api-Key` is not sent to it.
- Added a Jackett section to `docs/environment-variables.md`.

## Screenshots

<img width="1117" height="936" alt="Screenshot 2026-10-21 at 13-45-34
Shelfmark"
src="https://github.com/user-attachments/assets/00339999-72c7-4226-bd9a-df8b325a7e22"
/>

<img width="1117" height="938" alt="Screenshot 2026-10-21 at 13-50-38
Shelfmark"
src="https://github.com/user-attachments/assets/3c9cd2b4-932a-4b5c-9e10-6ec22b5f987d"
/>

<img width="1117" height="937" alt="Screenshot 2026-10-21 at 13-50-57
Shelfmark"
src="https://github.com/user-attachments/assets/9c4d0ed9-da2f-4323-b188-341b45066efd"
/>

## Not included
- First-run onboarding does not offer Jackett yet.
- No Jackett-specific category settings; it uses the standard 7000 /
3030 categories.

## Testing
- New unit tests in `tests/jackett/` (client, source, handler) using
mocked responses.
- Full suite passes except 11 `tests/e2e` tests that also fail on a
clean tree here (cannot write `/var/log/shelfmark`).
- Tested against a live Jackett instance.

Closes #1443

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-23 17:46:41 -04:00
dependabot[bot] b8e466cc64 build(deps-dev): bump prek from 0.5.5 to 0.5.6 in the python-deps group (#1548) 
Bumps the python-deps group with 1 update:
[prek](https://github.com/j178/prek).

Updates `prek` from 0.5.5 to 0.5.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/j178/prek/releases">prek's
releases</a>.</em></p>
<blockquote>
<h2>0.5.6</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-19.</p>
<h3>Enhancements</h3>
<ul>
<li>Add builtin hook <code>check-commit-trailers</code> (<a
href="https://redirect.github.com/j178/prek/pull/2885">#2885</a>)</li>
<li>Add builtin hook <code>check-signed-commit</code> (<a
href="https://redirect.github.com/j178/prek/pull/2725">#2725</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Enable PGO for native release builds (<a
href="https://redirect.github.com/j178/prek/pull/2890">#2890</a>)</li>
<li>Reduce hook process launches with balanced batches (<a
href="https://redirect.github.com/j178/prek/pull/2907">#2907</a>)</li>
<li>Resolve hook commands before batching (<a
href="https://redirect.github.com/j178/prek/pull/2840">#2840</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Accept UTF-8 BOM in <code>check-json</code> (<a
href="https://redirect.github.com/j178/prek/pull/2879">#2879</a>)</li>
<li>Preserve unquoted dotted revisions in <code>prek update</code> (<a
href="https://redirect.github.com/j178/prek/pull/2853">#2853</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document standalone installer options (<a
href="https://redirect.github.com/j178/prek/pull/2859">#2859</a>)</li>
<li>Update benchmarks for prek 0.5.5 (<a
href="https://redirect.github.com/j178/prek/pull/2786">#2786</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Enable ICF for release builds (<a
href="https://redirect.github.com/j178/prek/pull/2891">#2891</a>)</li>
<li>Update uv to 0.13.0 (<a
href="https://redirect.github.com/j178/prek/pull/2856">#2856</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/ebuildy"><code>@​ebuildy</code></a></li>
<li><a href="https://github.com/j178"><code>@​j178</code></a></li>
<li><a
href="https://github.com/shaanmajid"><code>@​shaanmajid</code></a></li>
</ul>
<h2>Install prek 0.5.6</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>powershell -ExecutionPolicy Bypass -c &quot;irm
https://github.com/j178/prek/releases/download/v0.5.6/prek-installer.ps1
| iex&quot;
</code></pre>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/j178/prek/blob/main/CHANGELOG.md">prek's
changelog</a>.</em></p>
<blockquote>
<h2>0.5.6</h2>
<p>Released on 2026-10-19.</p>
<h3>Enhancements</h3>
<ul>
<li>Add builtin hook <code>check-commit-trailers</code> (<a
href="https://redirect.github.com/j178/prek/pull/2885">#2885</a>)</li>
<li>Add builtin hook <code>check-signed-commit</code> (<a
href="https://redirect.github.com/j178/prek/pull/2725">#2725</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Enable PGO for native release builds (<a
href="https://redirect.github.com/j178/prek/pull/2890">#2890</a>)</li>
<li>Reduce hook process launches with balanced batches (<a
href="https://redirect.github.com/j178/prek/pull/2907">#2907</a>)</li>
<li>Resolve hook commands before batching (<a
href="https://redirect.github.com/j178/prek/pull/2840">#2840</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Accept UTF-8 BOM in <code>check-json</code> (<a
href="https://redirect.github.com/j178/prek/pull/2879">#2879</a>)</li>
<li>Preserve unquoted dotted revisions in <code>prek update</code> (<a
href="https://redirect.github.com/j178/prek/pull/2853">#2853</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Document standalone installer options (<a
href="https://redirect.github.com/j178/prek/pull/2859">#2859</a>)</li>
<li>Update benchmarks for prek 0.5.5 (<a
href="https://redirect.github.com/j178/prek/pull/2786">#2786</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Enable ICF for release builds (<a
href="https://redirect.github.com/j178/prek/pull/2891">#2891</a>)</li>
<li>Update uv to 0.13.0 (<a
href="https://redirect.github.com/j178/prek/pull/2856">#2856</a>)</li>
</ul>
<h3>Contributors</h3>
<ul>
<li><a href="https://github.com/ebuildy"><code>@​ebuildy</code></a></li>
<li><a href="https://github.com/j178"><code>@​j178</code></a></li>
<li><a
href="https://github.com/shaanmajid"><code>@​shaanmajid</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/j178/prek/commit/ee8a6cce37fe70d21281910e673bceddc003cb40"><code>ee8a6cc</code></a>
Bump version to 0.5.6 (<a
href="https://redirect.github.com/j178/prek/issues/2909">#2909</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/36116817569560119b2891e4dcf061dbdcc8f16a"><code>3611681</code></a>
Reduce hook process launches with balanced batches (<a
href="https://redirect.github.com/j178/prek/issues/2907">#2907</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/1af6b80acdee193effce67850897560530663008"><code>1af6b80</code></a>
Use PR head commits for CI change detection</li>
<li><a
href="https://github.com/j178/prek/commit/29455ef294ce0abf416da951e1249b03e18c4460"><code>29455ef</code></a>
Update dependency zensical to &gt;=0.0.69 (<a
href="https://redirect.github.com/j178/prek/issues/2896">#2896</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/1fd9308df9d9fec874e1aad556ddd2dfa3e97e0d"><code>1fd9308</code></a>
Update dependency prefix-dev/pixi to v0.81.0 (<a
href="https://redirect.github.com/j178/prek/issues/2905">#2905</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/140ab6b9654f938b3c496a580a6a859a7616df06"><code>140ab6b</code></a>
Update docker.io/astral/uv Docker tag to v0.13.0 (<a
href="https://redirect.github.com/j178/prek/issues/2906">#2906</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/3574ba305692928d223e0154f44853fb0bedd196"><code>3574ba3</code></a>
Update dependency cargo-zigbuild to &gt;=0.23.4 (<a
href="https://redirect.github.com/j178/prek/issues/2895">#2895</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/7c23eaeabcbdfdae0b56d37eaddc2061a51a7d8f"><code>7c23eae</code></a>
Update Rust crate async_zip to 0.0.22 (<a
href="https://redirect.github.com/j178/prek/issues/2898">#2898</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/09f486de46bd02c94d928e434fed8cdb45b64198"><code>09f486d</code></a>
Update Rust crate indoc to v2.0.8 (<a
href="https://redirect.github.com/j178/prek/issues/2899">#2899</a>)</li>
<li><a
href="https://github.com/j178/prek/commit/4d677216f0bb073883b8ab45384df517d3197e49"><code>4d67721</code></a>
Update Rust crate tokio-util to v0.7.20 (<a
href="https://redirect.github.com/j178/prek/issues/2901">#2901</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/j178/prek/compare/v0.5.5...v0.5.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=prek&package-manager=uv&previous-version=0.5.5&new-version=0.5.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
v1.5.1 		2026-10-23 14:40:10 -04:00
dependabot[bot] aa72850eab build(deps): bump the npm-deps group in /src/frontend with 6 updates (#1551) 
Bumps the npm-deps group in /src/frontend with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [react](https://github.com/react/react/tree/HEAD/packages/react) |
`19.3.0` | `19.3.1` |
|
[react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom)
| `19.3.0` | `19.3.1` |
| [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) |
`6.41.0` | `6.42.1` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) |
`0.72.0` | `0.74.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) |
`1.87.0` | `1.89.0` |
|
[vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest)
| `5.0.4` | `5.0.5` |

Updates `react` from 19.3.0 to 19.3.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/releases">react's
releases</a>.</em></p>
<blockquote>
<h2>19.3.1 (October 14th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Improve transport protocol (<a
href="https://redirect.github.com/facebook/react/pull/37845">#37845</a>
by <a
href="https://github.com/unstubbable"><code>@​unstubbable</code></a> and
<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/react/react/commit/61aa00df822d0eb76d0362eb8b6fdd3527693efe"><code>61aa00d</code></a>
[19.3.x][Flight] Improve transport protocol (<a
href="https://github.com/react/react/tree/HEAD/packages/react/issues/37845">#37845</a>)</li>
<li>See full diff in <a
href="https://github.com/react/react/commits/v19.3.1/packages/react">compare
view</a></li>
</ul>
</details>
<br />

Updates `react-dom` from 19.3.0 to 19.3.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/react/react/releases">react-dom's
releases</a>.</em></p>
<blockquote>
<h2>19.3.1 (October 14th, 2026)</h2>
<h2>React Server Components</h2>
<ul>
<li>Improve transport protocol (<a
href="https://redirect.github.com/facebook/react/pull/37845">#37845</a>
by <a
href="https://github.com/unstubbable"><code>@​unstubbable</code></a> and
<a href="https://github.com/eps1lon"><code>@​eps1lon</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/react/react/commit/61aa00df822d0eb76d0362eb8b6fdd3527693efe"><code>61aa00d</code></a>
[19.3.x][Flight] Improve transport protocol (<a
href="https://github.com/react/react/tree/HEAD/packages/react-dom/issues/37845">#37845</a>)</li>
<li>See full diff in <a
href="https://github.com/react/react/commits/v19.3.1/packages/react-dom">compare
view</a></li>
</ul>
</details>
<br />

Updates `knip` from 6.41.0 to 6.42.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/webpro-nl/knip/releases">knip's
releases</a>.</em></p>
<blockquote>
<h2>Release 6.42.1</h2>
<ul>
<li>fix(semantic-release): resolve shareable configs from extends (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2159">#2159</a>)
(4c4a5ece9148cf621f3a6e091fd3550b18f6e19a) - thanks <a
href="https://github.com/giaBaoJS"><code>@​giaBaoJS</code></a>!</li>
<li>fix(jest): load projects entries as Jest configs (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2167">#2167</a>)
(4c22593724460890e4492ba86119d0188127f2ba) - thanks <a
href="https://github.com/Cayan"><code>@​Cayan</code></a>!</li>
<li>Update npmx.dev snapshot
(4b19797b77a559f7190e9119b3a156e1ac6aef9f)</li>
<li>fix(tailwind): track packages referenced from CSS url() (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2166">#2166</a>)
(949da00abf419c1eeabdab1541ce7e5c312371b9) - thanks <a
href="https://github.com/agustincastaing"><code>@​agustincastaing</code></a>!</li>
<li>Add .otf to foreign file extensions
(fcff4db0b88d6282569743cd779aec5a5df99862)</li>
<li>Match quoted SCSS url() values within a single line
(2c5c2a2efab8f08be538bfe1f40982cb6f0fca3c)</li>
<li>fix(bun): treat bun test arguments as path filters (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2165">#2165</a>)
(5f3a7fb526d3eca7561aacfc9d0ac60056525206) - thanks <a
href="https://github.com/jakeleventhal"><code>@​jakeleventhal</code></a>!</li>
<li>fix(vitest): use default test entries when config has no test key
(<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2170">#2170</a>)
(7ee576ccd461f719b533e3783a5b58391ce89e91) - thanks <a
href="https://github.com/fixfon"><code>@​fixfon</code></a>!</li>
</ul>
<h2>Release 6.42.0</h2>
<ul>
<li>fix: add bun 1.4.3 check subcommand (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2131">#2131</a>)
(09129b8aaa554ffae2ff8f42a5ff4d6994eb7759) - thanks <a
href="https://github.com/NimmLor"><code>@​NimmLor</code></a>!</li>
<li>Detect pnpm workspaces correctly around <code>packages:</code>
(resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2133">#2133</a>,
close <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2134">#2134</a>)
(d1cc0928be54e6cac9668460d9f6a21e3a94f818)</li>
<li>fix(github-actions): resolve working-directory nested under checkout
path (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2136">#2136</a>)
(87e051e45f12c107cc25ed08bba962b95bb23b51) - thanks <a
href="https://github.com/kenny-ish"><code>@​kenny-ish</code></a>!</li>
<li>fix(nx): track local generator and executor entry points (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2117">#2117</a>)
(<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2121">#2121</a>)
(558407f51b5fdf4460275b69950676e7bace35d5) - thanks <a
href="https://github.com/DreamLongYT"><code>@​DreamLongYT</code></a>!</li>
<li>Update dependency bun to v1.4.3 (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2137">#2137</a>)
(71f90bf6d5fb2675430f60416e403851f9cb2cfe) - thanks <a
href="https://github.com/renovate"><code>@​renovate</code></a>[bot]!</li>
<li>docs(react-router): note to run react-router typegen before Knip (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2140">#2140</a>)
(f21ce9a9f1e3264cad1b763cf31ec2c177fb8656) - thanks <a
href="https://github.com/MannXo"><code>@​MannXo</code></a>!</li>
<li>fix: normalize scoped binary names (close <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2143">#2143</a>)
(c8509c4e45e1c343da707c26877a0a6584f6bc11)</li>
<li>Clarify plugin implementation boundaries
(c5a67f59d351e8d26dc6ecbbd3c3193e313772a4)</li>
<li>fix(jest): treat mocked and required dependencies as used (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2141">#2141</a>)
(3eaf1ba16045a3ac22f0717c4f1252312298bb76) - thanks <a
href="https://github.com/TkDodo"><code>@​TkDodo</code></a>!</li>
<li>fix: preserve root-only plugins for trailing-slash cwd (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2139">#2139</a>)
(7f0db0e7670bfd18fab081b522a104f787829f7d) - thanks <a
href="https://github.com/sean0407"><code>@​sean0407</code></a>!</li>
<li>fix(nx): resolve run-commands script paths from the target cwd (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2151">#2151</a>)
(516bd9a324303653978528f582287c857846fcc8) - thanks <a
href="https://github.com/JeanBeaurepaire"><code>@​JeanBeaurepaire</code></a>!</li>
<li>Resolve Nx run-commands loader paths from the target cwd
(fa8ca13e1345115d30122900ab68db7339487502)</li>
<li>Add <code>@​solidjs/vite-plugin</code> plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2144">#2144</a>)
(579a88d306429694be43590efb50cb72067551ba) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>feat: add filesystem-routing plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2145">#2145</a>)
(1abd9e1875bae36b0baf77f5864aab849d1528a8) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>Support tags in line comments (resolve <a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/1924">#1924</a>)
(5abef4846e20f09fd4d0ee8dc2513ce50b616cdb)</li>
<li>Keep resolveFromAST to static values in plugin guide
(4cd353fd9ecb780228a63069080586a46ba6a8f2)</li>
<li>fix(solidjs-vite-plugin): keep entry overrides in production (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2155">#2155</a>)
(e4b5f890787da07824cc174cb624396f2133ff06) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>feat(angular): resolve styleUrl and styleUrls of <a
href="https://github.com/Component"><code>@​Component</code></a> (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2157">#2157</a>)
(c20d4d720c586c9c5dc6e3d1a6ea60c557688bfa) - thanks <a
href="https://github.com/Cayan"><code>@​Cayan</code></a>!</li>
<li>Update npmx.dev snapshot
(59eb873f3beecf40b7aed9579bd29e1ab8b631f0)</li>
<li>fix(next): recognize Turbopack alias targets (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2156">#2156</a>)
(1d44f6a1a39c5557c1e215c7cf9db17937967344) - thanks <a
href="https://github.com/jakeleventhal"><code>@​jakeleventhal</code></a>!</li>
<li>fix: preserve re-exports from framework entries (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2154">#2154</a>)
(263ce20408a77b2473c555f304ad3b55c696b6a6) - thanks <a
href="https://github.com/jakeleventhal"><code>@​jakeleventhal</code></a>!</li>
<li>feat(solidjs-vite-plugin): follow Solid's SSR and client mode entry
rules (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2148">#2148</a>)
(d711231eae14d8ecac562d73078125f3b30dc8fd) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>feat(filesystem-routing): read route options from Vite configs (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2149">#2149</a>)
(585f206ca52d54e30f2068c818e1b33b50085459) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>feat(filesystem-routing): resolve routes from the Vite root (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2150">#2150</a>)
(8cc0cb0c9ff09463cad30817c8cf78cbc48b7ed6) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>fix: track namespace members in Promise.all imports (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2162">#2162</a>)
(3f17cdfce7a0f90e2599a7074291c4c875fe8244) - thanks <a
href="https://github.com/everton-dgn"><code>@​everton-dgn</code></a>!</li>
<li>Update a few dependencies
(161dbed3ccffa574e3a9493ddb20842eefa26af8)</li>
<li>Fix Solid setup fixture coverage
(ebe4180785667f6ff85c1e6ce2a11226713b2d5a)</li>
<li>Migrate shell script parsing to unbash v6
(f86044c6760ac4f27e564f15feeae907cba3d297)</li>
<li>Add sponsors: <a
href="https://github.com/pennylane-hq"><code>@​pennylane-hq</code></a>,
<a href="https://github.com/agentscore"><code>@​agentscore</code></a>,
<a
href="https://github.com/oblique-security"><code>@​oblique-security</code></a>
(thank you!) (57ff23eb430aaece73e02574923cabc6016a920b)</li>
<li>Stop pairing Promise.all imports and bindings after a spread
(5bd2c64eaf92f82a316d8fa6551acdb1d6c48c32)</li>
<li>Update some stats (dd02ddeb235dd516cf93db99dda2180b0eb09a97)</li>
<li>fix(nx): read karmaConfig from target options (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2164">#2164</a>)
(4e1e4bc18f6d2f2705d729c375a20bd1679b8c0f) - thanks <a
href="https://github.com/Cayan"><code>@​Cayan</code></a>!</li>
<li>Add tsrs plugin (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2163">#2163</a>)
(ba09126c023a2c408de8d7dae3bf6ab97e420966) - thanks <a
href="https://github.com/jakeleventhal"><code>@​jakeleventhal</code></a>!</li>
<li>Drop redundant containingFilePath from plugin config inputs
(ffb6caf02891d29eee41c7a0ecf147312dbe7205)</li>
<li>Resolve Nx target option configs from the workspace root
(52c5233aa905124c5b30c0bb7f9b0b25cd4260c6)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/webpro-nl/knip/commit/ee32ee6ca4c8826ca45f306041d9f8c5ffdaa335"><code>ee32ee6</code></a>
Release knip@6.42.1</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/7ee576ccd461f719b533e3783a5b58391ce89e91"><code>7ee576c</code></a>
fix(vitest): use default test entries when config has no test key (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2170">#2170</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/5f3a7fb526d3eca7561aacfc9d0ac60056525206"><code>5f3a7fb</code></a>
fix(bun): treat bun test arguments as path filters (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2165">#2165</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/2c5c2a2efab8f08be538bfe1f40982cb6f0fca3c"><code>2c5c2a2</code></a>
Match quoted SCSS url() values within a single line</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/fcff4db0b88d6282569743cd779aec5a5df99862"><code>fcff4db</code></a>
Add .otf to foreign file extensions</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/949da00abf419c1eeabdab1541ce7e5c312371b9"><code>949da00</code></a>
fix(tailwind): track packages referenced from CSS url() (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2166">#2166</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/4c22593724460890e4492ba86119d0188127f2ba"><code>4c22593</code></a>
fix(jest): load projects entries as Jest configs (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2167">#2167</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/4c4a5ece9148cf621f3a6e091fd3550b18f6e19a"><code>4c4a5ec</code></a>
fix(semantic-release): resolve shareable configs from extends (<a
href="https://github.com/webpro-nl/knip/tree/HEAD/packages/knip/issues/2159">#2159</a>)</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/8aa7d0e281ecba684c35acf4effd072e90a8862d"><code>8aa7d0e</code></a>
Release knip@6.42.0</li>
<li><a
href="https://github.com/webpro-nl/knip/commit/52c5233aa905124c5b30c0bb7f9b0b25cd4260c6"><code>52c5233</code></a>
Resolve Nx target option configs from the workspace root</li>
<li>Additional commits viewable in <a
href="https://github.com/webpro-nl/knip/commits/knip@6.42.1/packages/knip">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxfmt` from 0.72.0 to 0.74.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxfmt's
releases</a>.</em></p>
<blockquote>
<h2>oxfmt v0.74.0</h2>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>e236de0 formatter_tests: Skip conformance spec calls with
non-literal options (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27957">#27957</a>)
(leaysgur)</li>
<li>782ab6e linter: Search string values without UTF-8 conversion (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/26716">#26716</a>)
(Dunqing)</li>
<li>a5d8184 jsdoc: Parse code spans after quotes in descriptions (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27955">#27955</a>)
(leaysgur)</li>
<li>2645d2c formatter_markdown: Treat link destinations and footnote
references as opaque to code span fences (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27948">#27948</a>)
(leaysgur)</li>
<li>4d8195c formatter_yaml: Keep a root plain scalar starting with a
document marker verbatim (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27947">#27947</a>)
(leaysgur)</li>
<li>529b057 formatter_core: Keep front matter verbatim when body starts
with indented delimiter (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27946">#27946</a>)
(leaysgur)</li>
<li>c22a9b2 formatter: Treat static block with only empty statements as
empty (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27945">#27945</a>)
(leaysgur)</li>
<li>d3ff3f6 formatter/jsdoc: Write descriptions as written to not close
the comment (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27823">#27823</a>)
(leaysgur)</li>
<li>c4c1727 formatter/sort_imports: Keep comments after the last import
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27822">#27822</a>)
(leaysgur)</li>
<li>a64677e formatter: Print JSDoc embedded snippets with LF (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27821">#27821</a>)
(leaysgur)</li>
<li>2c1cc20 formatter: Keep comment only Vue bindings as-is (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27820">#27820</a>)
(leaysgur)</li>
<li>1bf236d formatter/sort_imports: Do not use comments as import source
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27819">#27819</a>)
(leaysgur)</li>
<li>52ee29d formatter_yaml: Never start col-0 line with document marker
or BOM (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27818">#27818</a>)
(leaysgur)</li>
<li>81c75e7 formatter/css: Keep glued css-in-js statement placeholders
glued (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27814">#27814</a>)
(leaysgur)</li>
<li>a1ef7f4 formatter: Keep typecast parens in same-operator binary and
arrow chain (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27812">#27812</a>)
(leaysgur)</li>
<li>de110ce formatter: Keep more parens around
<code>TSInstantiationExpression</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27811">#27811</a>)
(leaysgur)</li>
<li>8b02e90 formatter_json: Reject invalid JSON instead of dropping them
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27785">#27785</a>)
(leaysgur)</li>
<li>6fe4c1b formatter: Treat lone CR in JSX text and argument blank
lines (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27780">#27780</a>)
(leaysgur)</li>
<li>5605362 oxfmt: Validate editorconfig as like oxfmtrc (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27778">#27778</a>)
(leaysgur)</li>
<li>5b2acb0 formatter_core: Report error position releative to CRLF
source (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27777">#27777</a>)
(leaysgur)</li>
<li>c78e80e formatter_core: Report parse error positions relative to the
BOM-headed source (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27776">#27776</a>)
(leaysgur)</li>
<li>3a980c9 formatter_toml: Handle BOM like other languages (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27775">#27775</a>)
(leaysgur)</li>
<li>97c9fc4 oxfmt: Handle BOM in config JSON (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27774">#27774</a>)
(leaysgur)</li>
<li>28eb4a7 oxfmt: Print trailing newline for
<code>--list-different</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27773">#27773</a>)
(leaysgur)</li>
<li>d2bea21 formatter: Glue comments to an opener in empty for-head
slots and array holes (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27737">#27737</a>)
(leaysgur)</li>
<li>6a95ec1 formatter: Keep comment position on holey array (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27730">#27730</a>)
(leaysgur)</li>
<li>54769da formatter: Break after dangling line comment in holey array
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27729">#27729</a>)
(leaysgur)</li>
<li>99077ef formatter_json: Reject unary expressions other than signed
numbers (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27728">#27728</a>)
(leaysgur)</li>
<li>22cd4cd formatter_json: Handle holey array and comments (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27727">#27727</a>)
(leaysgur)</li>
<li>644ca1c formatter: Do not indent logical chains whose right sides
all inline (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27667">#27667</a>)
(leaysgur)</li>
<li>a07a0fb formatter: Wrap comment-only JSX expression container in a
group (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27666">#27666</a>)
(leaysgur)</li>
</ul>
<h3>⚡ Performance</h3>
<ul>
<li>e220293 formatter: Check only the operator suppression mark in
<code>is_quiet</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27952">#27952</a>)
(leaysgur)</li>
<li>e5fdc9c formatter_core: Write into one element stack through a
concrete <code>Formatter</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27559">#27559</a>)
(leaysgur)</li>
<li>a342f7e formatter: Skip comment handling for nodes with no comment
near them (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27557">#27557</a>)
(leaysgur)</li>
<li>d8ce750 formatter: Write string literals with swapped quotes into
the arena (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27558">#27558</a>)
(Yuji Sugiura)</li>
<li>1c393c0 formatter_core: Skip scanning texts with nothing to rewrite
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27561">#27561</a>)
(leaysgur)</li>
<li>1d3ef10 formatter_core: Keep the embedded IR when nothing in it is
rewritten (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27673">#27673</a>)
(leaysgur)</li>
</ul>
<h3>📚 Documentation</h3>
<ul>
<li>1325225 oxfmt: Update useless comment prefix (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27956">#27956</a>)
(leaysgur)</li>
<li>d0dd140 formatter: Note lossy cooked round-trip in template embeds
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27944">#27944</a>)
(leaysgur)</li>
<li>8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel
and fixture origins (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27824">#27824</a>)
(leaysgur)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/07ed78f4abde4020ca7919381ffea4da8616b78a"><code>07ed78f</code></a>
release(apps): oxlint v1.89.0 &amp;&amp; oxfmt v0.74.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27961">#27961</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/6941b4ed45ead21c45bc2164cb80a180eed85b43"><code>6941b4e</code></a>
release(apps): oxlint v1.88.0 &amp;&amp; oxfmt v0.73.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27643">#27643</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/a495e8241e4927a65f77c5e97b9f4dee4dbff5aa"><code>a495e82</code></a>
feat(oxfmt): support <code>associations</code> config to specify
language over filepath ...</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/408d87f62893d5dc3eb3e0aa8a0b5e7e2eca32f3"><code>408d87f</code></a>
docs(oxfmt): simplify oxfmtrc docs (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27432">#27432</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/5db28facf7bfe71d36829381b176f1c611e816f0"><code>5db28fa</code></a>
feat(oxfmt): support Astro via <code>prettier-plugin-astro@1.x</code>
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27386">#27386</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/902e188b3518afede5fc2b9823e36d8a48af6fda"><code>902e188</code></a>
docs(oxfmt): update how <code>embeddedLanguageFormatting</code> option
works (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt/issues/27362">#27362</a>)</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxfmt_v0.74.0/npm/oxfmt">compare
view</a></li>
</ul>
</details>
<br />

Updates `oxlint` from 1.87.0 to 1.89.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/releases">oxlint's
releases</a>.</em></p>
<blockquote>
<h2>oxlint v1.89.0</h2>
<h3>💥 BREAKING CHANGES</h3>
<ul>
<li>e3c1b11 ast: [<strong>BREAKING</strong>] Preserve lone surrogates in
static property names (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27095">#27095</a>)
(Dunqing)</li>
<li>a0a987c ast: [<strong>BREAKING</strong>] Preserve lone surrogates in
static member names (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26677">#26677</a>)
(Dunqing)</li>
</ul>
<h3>🚀 Features</h3>
<ul>
<li>770ada4 linter: Mark vue 3 rules as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27717">#27717</a>)
(Cam McHenry)</li>
<li>ba38c1d linter: Mark react/react-hooks rules as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27701">#27701</a>)
(Cam McHenry)</li>
<li>d85a3ba linter: Mark promise rules as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27693">#27693</a>)
(Cam McHenry)</li>
<li>e71c88a linter: Mark node rule as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27692">#27692</a>)
(Cam McHenry)</li>
<li>7213f61 linter: Mark nextjs rules as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27691">#27691</a>)
(Cam McHenry)</li>
<li>d7c6b26 linter: Mark jsx-a11y rules as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27690">#27690</a>)
(Cam McHenry)</li>
<li>199dfdc linter: Mark jsdoc rules as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27689">#27689</a>)
(Cam McHenry)</li>
<li>780bff3 linter: Mark jest/vitest rules as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27672">#27672</a>)
(Cam McHenry)</li>
<li>6ae6859 linter: Mark import rules as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27671">#27671</a>)
(Cam McHenry)</li>
<li>b7a1df3 linter: Mark unicorn rules as recommended (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27670">#27670</a>)
(Cam McHenry)</li>
<li>c44a355 linter: Mark typescript rules as recommended from upstream
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27634">#27634</a>)
(Cam McHenry)</li>
<li>6b49dba linter: Mark eslint rules as recommended from upstream (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27632">#27632</a>)
(Cam McHenry)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>7c47246 linter: Check module specifiers and string values that
contain lone surrogates (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26717">#26717</a>)
(Dunqing)</li>
<li>782ab6e linter: Search string values without UTF-8 conversion (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26716">#26716</a>)
(Dunqing)</li>
<li>326904f linter/unicorn/no-useless-undefined: Allow
<code>undefined</code> in <code>React.useRef</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25027">#25027</a>)
(Chris Dokurno)</li>
<li>f9cf165 linter/unicorn/prefer-spread: Ignore super method calls (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27868">#27868</a>)
(camc314)</li>
<li>00484e1 linter/eslint/prefer-const: Report destructuring assignments
inside blocks (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27856">#27856</a>)
(camc314)</li>
<li>9c35461 linter/eslint/sort-vars: Report every out-of-order
declaration (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27767">#27767</a>)
(camc314)</li>
<li>01e1c5e linter/unicorn/prefer-string-replace-all: Resolve regex
variables (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27769">#27769</a>)
(camc314)</li>
<li>7f474d5 linter/eslint/no-loop-func: Detect writes after the loop (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27754">#27754</a>)
(camc314)</li>
<li>4b7fea6 linter/eslint/block-scoped-var: Ignore declarations without
writes (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27760">#27760</a>)
(camc314)</li>
<li>2947917 linter/eslint/no-lonely-if: Check final else blocks in
else-if chains (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27759">#27759</a>)
(camc314)</li>
<li>fc039b5 linter/eslint/sort-imports: Check imports after other
statements (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27749">#27749</a>)
(camc314)</li>
<li>1acba97 linter/unicorn/prefer-at: Report slice index reads once (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27762">#27762</a>)
(camc314)</li>
<li>6190e26 linter/eslint/prefer-arrow-callback: Ignore functions used
as conditional tests (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27533">#27533</a>)
(Anzal Husain Abidi)</li>
<li>b3cdaaf linter/eslint/sort-keys: Check computed identifier names (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27748">#27748</a>)
(camc314)</li>
<li>170e608 linter/unicorn/prefer-native-coercion-functions: Check
object methods and function properties (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27750">#27750</a>)
(camc314)</li>
<li>9261df7 linter/unicorn/prefer-string-raw: Check object property
values (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27758">#27758</a>)
(camc314)</li>
<li>ddea86b linter/eslint/prefer-template: Report separate nested
concatenations (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27764">#27764</a>)
(camc314)</li>
<li>2c67197 linter/eslint/no-unused-vars: Count conditional calls in
sequences as uses (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27755">#27755</a>)
(camc314)</li>
<li>7f22fa0 linter/unicorn/prefer-regexp-test: Check logical operands in
boolean contexts (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27761">#27761</a>)
(camc314)</li>
<li>3c44398 linter/eslint/class-methods-use-this: Count this in
parameter defaults (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27756">#27756</a>)
(camc314)</li>
<li>d85923f linter/eslint/no-param-reassign: Report rest parameter
writes (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27765">#27765</a>)
(camc314)</li>
<li>8ea47bb linter/unicorn/prefer-type-error: Handle parenthesized type
checks (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27766">#27766</a>)
(camc314)</li>
<li>e96856c linter/unicorn/catch-error-name: Check unused
underscore-prefixed names (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27751">#27751</a>)
(camc314)</li>
<li>d8ca399 linter/unicorn/no-array-callback-reference: Ignore callback
factory calls (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27763">#27763</a>)
(camc314)</li>
<li>1267ab8 linter/eslint/max-params: Count rest parameters (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27757">#27757</a>)
(camc314)</li>
<li>9ff25c3 linter/eslint/no-useless-assignment: Report dead stores to
function parameters (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27735">#27735</a>)
(camc314)</li>
<li>ee5e730 linter/eslint/no-setter-return: Check setters in property
descriptors (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27731">#27731</a>)
(camc314)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md">oxlint's
changelog</a>.</em></p>
<blockquote>
<h2>[1.89.0] - 2026-10-19</h2>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27699">#27699</a>)
(camc314)</li>
</ul>
<h2>[1.88.0] - 2026-10-13</h2>
<h3>🚀 Features</h3>
<ul>
<li>3c361a7 linter/unicorn/prefer-query-selector: Add
<code>allowWithVariables</code> option (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27346">#27346</a>)
(Mikhail Baev)</li>
</ul>
<h2>[1.86.0] - 2026-09-28</h2>
<h3>🚀 Features</h3>
<ul>
<li>9d80eed linter/react/only-export-components: Support
<code>allowCompoundComponents</code> (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27117">#27117</a>)
(Kuroda Kayn)</li>
<li>e05b155 linter: Add typescript/no-generated-empty-object-type (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26958">#26958</a>)
(camc314)</li>
</ul>
<h2>[1.82.0] - 2026-09-07</h2>
<h3>🚀 Features</h3>
<ul>
<li>6a0e19c linter/eslint/no-unmodified-loop-condition: Support
<code>checkConditionalExpressions</code> option (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26249">#26249</a>)
(camc314)</li>
</ul>
<h2>[1.81.0] - 2026-08-31</h2>
<h3>📚 Documentation</h3>
<ul>
<li>d5be037 linter/typescript/switch-exhaustiveness-check: Clarify
default case comment pattern (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/26100">#26100</a>)
(camc314)</li>
</ul>
<h2>[1.79.0] - 2026-08-18</h2>
<h3>💥 BREAKING CHANGES</h3>
<ul>
<li>8c4552d linter: [<strong>BREAKING</strong>] Split
react/react-compiler into per-category rules (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25500">#25500</a>)
(Boshen)</li>
</ul>
<h3>🐛 Bug Fixes</h3>
<ul>
<li>228e8e0 linter: Resolve inactive React compiler rules (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25830">#25830</a>)
(Boshen)</li>
<li>aa49d86 linter: Allow spread rule options in config types (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25675">#25675</a>)
(ch3rry)</li>
<li>36f8451 linter/eslint/no-eval: Align indirect default with ESLint
(<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25656">#25656</a>)
(camc314)</li>
<li>beb724d linter/eslint/no-unused-vars: Report bare underscore
parameters (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25663">#25663</a>)
(camc314)</li>
<li>4004c10 linter/eslint/no-irregular-whitespace: Check comments by
default (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25660">#25660</a>)
(camc314)</li>
<li>285820e linter/no-large-snapshots: Precompile and document allowed
snapshot matchers (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25611">#25611</a>)
(Mikhail Baev)</li>
<li>4df5835 linter: Allow capitalized built-in calls (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/25516">#25516</a>)
(Boshen)</li>
</ul>
<h2>[1.78.0] - 2026-08-10</h2>
<h3>🚀 Features</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oxc-project/oxc/commit/07ed78f4abde4020ca7919381ffea4da8616b78a"><code>07ed78f</code></a>
release(apps): oxlint v1.89.0 &amp;&amp; oxfmt v0.74.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27961">#27961</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/9a424c209ea0df16becbf3141d63bcc293ede237"><code>9a424c2</code></a>
fix(oxlint,oxfmt): correct Node.js TypeScript support range (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27699">#27699</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/6941b4ed45ead21c45bc2164cb80a180eed85b43"><code>6941b4e</code></a>
release(apps): oxlint v1.88.0 &amp;&amp; oxfmt v0.73.0 (<a
href="https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint/issues/27643">#27643</a>)</li>
<li><a
href="https://github.com/oxc-project/oxc/commit/3c361a7fb5c9fbbe940e489f2e315a187a19b565"><code>3c361a7</code></a>
feat(linter/unicorn/prefer-query-selector): add
<code>allowWithVariables</code> option (...</li>
<li>See full diff in <a
href="https://github.com/oxc-project/oxc/commits/oxlint_v1.89.0/npm/oxlint">compare
view</a></li>
</ul>
</details>
<br />

Updates `vitest` from 5.0.4 to 5.0.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitest-dev/vitest/releases">vitest's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.5</h2>
<h3>   🐞 Bug Fixes</h3>
<ul>
<li>Keep vite default <code>fs.deny</code> with api token file  -  by <a
href="https://github.com/hi-ogawa"><code>@​hi-ogawa</code></a>,
<strong>Hiroshi Ogawa</strong> and <strong>Claude Opus 5.5</strong> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11578">vitest-dev/vitest#11578</a>
<a href="https://github.com/vitest-dev/vitest/commit/28dc1edfb"><!-- raw
HTML omitted -->(28dc1)<!-- raw HTML omitted --></a></li>
<li>Handle quoted file names in <code>--changed</code>  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11583">vitest-dev/vitest#11583</a>
<a href="https://github.com/vitest-dev/vitest/commit/14921e962"><!-- raw
HTML omitted -->(14921)<!-- raw HTML omitted --></a></li>
<li>Add <code>data</code> to the <code>import.meta.hot</code> stub  - 
by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11590">vitest-dev/vitest#11590</a>
<a href="https://github.com/vitest-dev/vitest/commit/3a8289ac3"><!-- raw
HTML omitted -->(3a828)<!-- raw HTML omitted --></a></li>
<li>Set <code>skip</code> in <code>skipIf</code>, ignore
<code>undefined</code> options  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11591">vitest-dev/vitest#11591</a>
<a href="https://github.com/vitest-dev/vitest/commit/d523a15f2"><!-- raw
HTML omitted -->(d523a)<!-- raw HTML omitted --></a></li>
<li>Skip builtin loading in async leak detector  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11598">vitest-dev/vitest#11598</a>
<a href="https://github.com/vitest-dev/vitest/commit/fe86a64c6"><!-- raw
HTML omitted -->(fe86a)<!-- raw HTML omitted --></a></li>
<li>Keep the import frame in native loader errors  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11599">vitest-dev/vitest#11599</a>
<a href="https://github.com/vitest-dev/vitest/commit/9697b3894"><!-- raw
HTML omitted -->(9697b)<!-- raw HTML omitted --></a></li>
<li>Run hook cleanups when a later hook fails  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11605">vitest-dev/vitest#11605</a>
<a href="https://github.com/vitest-dev/vitest/commit/6c5a44720"><!-- raw
HTML omitted -->(6c5a4)<!-- raw HTML omitted --></a></li>
<li>Release mocks of finished test files  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11607">vitest-dev/vitest#11607</a>
<a href="https://github.com/vitest-dev/vitest/commit/e9c3d72f0"><!-- raw
HTML omitted -->(e9c3d)<!-- raw HTML omitted --></a></li>
<li>Abort all running tests on cancel  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11606">vitest-dev/vitest#11606</a>
<a href="https://github.com/vitest-dev/vitest/commit/6621a72d6"><!-- raw
HTML omitted -->(6621a)<!-- raw HTML omitted --></a></li>
<li><strong>browser</strong>:
<ul>
<li>Ignore synthetic pagehide events  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11582">vitest-dev/vitest#11582</a>
<a href="https://github.com/vitest-dev/vitest/commit/ca0813584"><!-- raw
HTML omitted -->(ca081)<!-- raw HTML omitted --></a></li>
<li>Run plugin buildStart on server creation  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11593">vitest-dev/vitest#11593</a>
<a href="https://github.com/vitest-dev/vitest/commit/ea611e44c"><!-- raw
HTML omitted -->(ea611)<!-- raw HTML omitted --></a></li>
<li>Drop late connections of closed sessions  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11600">vitest-dev/vitest#11600</a>
<a href="https://github.com/vitest-dev/vitest/commit/f161e6df2"><!-- raw
HTML omitted -->(f161e)<!-- raw HTML omitted --></a></li>
<li>Wait 30s for the browser to close  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11601">vitest-dev/vitest#11601</a>
<a href="https://github.com/vitest-dev/vitest/commit/6498b666a"><!-- raw
HTML omitted -->(6498b)<!-- raw HTML omitted --></a></li>
<li>Run global setup once with instances  -  by <a
href="https://github.com/sheremet-va"><code>@​sheremet-va</code></a> in
<a
href="https://redirect.github.com/vitest-dev/vitest/issues/11596">vitest-dev/vitest#11596</a>
<a href="https://github.com/vitest-dev/vitest/commit/8dd67c262"><!-- raw
HTML omitted -->(8dd67)<!-- raw HTML omitted --></a></li>
</ul>
</li>
<li><strong>reporter</strong>:
<ul>
<li>End reason
<code>&amp;[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&amp;[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);</code>
on worker crash  -  by <a
href="https://github.com/AriPerkkio"><code>@​AriPerkkio</code></a> in <a
href="https://redirect.github.com/vitest-dev/vitest/issues/11568">vitest-dev/vitest#11568</a>
<a href="https://github.com/vitest-dev/vitest/commit/6ae8e89ff"><!-- raw
HTML omitted -->(6ae8e)<!-- raw HTML omitted --></a></li>
</ul>
</li>
</ul>
<h5>    <a
href="https://github.com/vitest-dev/vitest/compare/v5.0.4...v5.0.5">View
changes on GitHub</a></h5>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitest-dev/vitest/commit/7a825db43e2beca0b219d2eadaec334cb81af0c7"><code>7a825db</code></a>
chore: release v5.0.5 (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11609">#11609</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/6621a72d6ed371e43f80ff327f5063693bd6b1ad"><code>6621a72</code></a>
fix: abort all running tests on cancel (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11606">#11606</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/e9c3d72f0c8d6867de06a3df43ea28a05eeec444"><code>e9c3d72</code></a>
fix: release mocks of finished test files (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11607">#11607</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/8dd67c2625943d824e257b87ae57a14094e90eed"><code>8dd67c2</code></a>
fix(browser): run global setup once with instances (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11596">#11596</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/6c5a447203a29a0708fbc5de4fb91ea501bdc395"><code>6c5a447</code></a>
fix: run hook cleanups when a later hook fails (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11605">#11605</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/9697b3894f456b85db91f3824ebe833449305c04"><code>9697b38</code></a>
fix: keep the import frame in native loader errors (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11599">#11599</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/6498b666a3ae8961f6f2a8abdc89015b6fd0b3aa"><code>6498b66</code></a>
fix(browser): wait 30s for the browser to close (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11601">#11601</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/f161e6df2b3c0bc84982d374094379139e380791"><code>f161e6d</code></a>
fix(browser): drop late connections of closed sessions (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11600">#11600</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/fe86a64c6c6aa75481bffe5880b5c4e35ea67927"><code>fe86a64</code></a>
fix: skip builtin loading in async leak detector (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11598">#11598</a>)</li>
<li><a
href="https://github.com/vitest-dev/vitest/commit/6ae8e89ff0734cf476e30186a83aebe6771aa330"><code>6ae8e89</code></a>
fix(reporter): end reason <code>'failed'</code> on worker crash (<a
href="https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/11568">#11568</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 14:39:54 -04:00
dependabot[bot] 1c2eb4efec build(deps): bump the gh-actions group with 3 updates (#1552) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps the gh-actions group with 3 updates:
[github/codeql-action/init](https://github.com/github/codeql-action),
[github/codeql-action/autobuild](https://github.com/github/codeql-action)
and
[github/codeql-action/analyze](https://github.com/github/codeql-action).

Updates `github/codeql-action/init` from 4.38.3 to 4.39.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/init's
releases</a>.</em></p>
<blockquote>
<h2>v4.39.0</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.1 - 21 Oct 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a>
from github/update-v4.39.0-d63383a73</li>
<li><a
href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a>
Trigger workflows</li>
<li><a
href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a>
Update changelog for v4.39.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a>
from github/mbg/start-proxy/report-version</li>
<li><a
href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a>
Rename <code>path</code> to <code>result</code> in tests</li>
<li><a
href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/start-proxy/report-version</li>
<li><a
href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a>
from github/mario-campos/automate-changenotes-assemble</li>
<li><a
href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a>
from github/mbg/add-missing-changenotes</li>
<li><a
href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a>
Add change note for <a
href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a>
Add change note for <a
href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/autobuild` from 4.38.3 to 4.39.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/autobuild's
releases</a>.</em></p>
<blockquote>
<h2>v4.39.0</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/autobuild's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.1 - 21 Oct 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a>
from github/update-v4.39.0-d63383a73</li>
<li><a
href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a>
Trigger workflows</li>
<li><a
href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a>
Update changelog for v4.39.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a>
from github/mbg/start-proxy/report-version</li>
<li><a
href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a>
Rename <code>path</code> to <code>result</code> in tests</li>
<li><a
href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/start-proxy/report-version</li>
<li><a
href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a>
from github/mario-campos/automate-changenotes-assemble</li>
<li><a
href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a>
from github/mbg/add-missing-changenotes</li>
<li><a
href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a>
Add change note for <a
href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a>
Add change note for <a
href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's
releases</a>.</em></p>
<blockquote>
<h2>v4.39.0</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.39.1 - 21 Oct 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.3">2.27.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4256">#4256</a></li>
</ul>
<h2>4.39.0 - 15 Oct 2026</h2>
<ul>
<li><em>Breaking change</em>: Bump the minimum required CodeQL bundle
version to 2.20.7. <a
href="https://redirect.github.com/github/codeql-action/pull/4205">#4205</a></li>
<li>The <code>codeql-action/analyze</code> step now validates that a
correct argument for the <code>checkout_path</code> input has been
provided. The <code>checkout_path</code> input must be set to the path
where the repository that is being analyzed is checked out at on the
runner, if that path is something other than the workspace root. If the
path does not point to a repository checkout or is different from the
path that was used by <code>codeql-action/init</code>, then the CodeQL
Action now produces a warning. <a
href="https://redirect.github.com/github/codeql-action/pull/4148">#4148</a></li>
<li>Resolved an issue with third-party caching implementations that
prevented caches from being restored correctly. <a
href="https://redirect.github.com/github/codeql-action/pull/4206">#4206</a></li>
<li>The <code>codeql-action/start-proxy</code> step that is used in Code
Scanning Default Setup now finds CodeQL releases using the same logic as
<code>codeql-action/init</code>. This primarily benefits customers who
are using GitHub instances other than <code>github.com</code> where the
<code>codeql-action/start-proxy</code> step may previously have been
unable to locate recent releases and ended up using outdated versions of
the private registry authentication proxy as a result. <a
href="https://redirect.github.com/github/codeql-action/pull/4198">#4198</a></li>
</ul>
<h2>4.38.3 - 08 Oct 2026</h2>
<ul>
<li><em>Upcoming breaking change</em>: CodeQL version 2.21.2 and earlier
were discontinued on 24 September 2026 alongside GitHub Enterprise
Server 3.17, and will be unsupported by the next minor release of the
CodeQL Action. Added a deprecation warning for customers using these
versions of CodeQL. <a
href="https://redirect.github.com/github/codeql-action/pull/4188">#4188</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.2">2.27.2</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4203">#4203</a></li>
<li>Fixed a bug where the decision of whether to use a per-language
bundle did not account for custom configurations that reference queries
outside of compiled CodeQL packs. This issue was caught during internal
testing and did not affect any customer repositories. We will resume the
roll out of per-language bundles in the coming weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4184">#4184</a></li>
</ul>
<h2>4.38.2 - 24 Sept 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.1">2.27.1</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4160">#4160</a></li>
</ul>
<h2>4.38.1 - 18 Sept 2026</h2>
<ul>
<li>The CodeQL Action now has experimental support for CodeQL releases
for which per-language bundles are available. Per-language bundles
support analysis for a single language and are therefore smaller than
the combined bundles that allow analysis for all supported languages. As
a result, per-language bundles take up less space on disk and are faster
to download. We expect to roll this change out to everyone in the coming
weeks. <a
href="https://redirect.github.com/github/codeql-action/pull/4146">#4146</a></li>
</ul>
<h2>4.38.0 - 09 Sept 2026</h2>
<ul>
<li>On GitHub-hosted runners, the CodeQL Action now deletes unused
CodeQL bundles from the toolcache before downloading a different bundle,
which frees up disk space for the analysis. We expect to roll this
change out to everyone in September. <a
href="https://redirect.github.com/github/codeql-action/pull/4124">#4124</a></li>
<li>The CodeQL Action now supports CodeQL releases that are compatible
with Linux Arm64 and downloads the native <code>linux-arm64</code>
CodeQL bundle when available. <a
href="https://redirect.github.com/github/codeql-action/pull/4072">#4072</a></li>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.27.0">2.27.0</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4129">#4129</a></li>
</ul>
<h2>4.37.9 - 26 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.4">2.26.4</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4106">#4106</a></li>
</ul>
<h2>4.37.8 - 21 Aug 2026</h2>
<p>No user facing changes.</p>
<h2>4.37.7 - 13 Aug 2026</h2>
<ul>
<li>Update default CodeQL bundle version to <a
href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.3">2.26.3</a>.
<a
href="https://redirect.github.com/github/codeql-action/pull/4085">#4085</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee"><code>6f2ac81</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4239">#4239</a>
from github/update-v4.39.0-d63383a73</li>
<li><a
href="https://github.com/github/codeql-action/commit/eb1c428e6e3725d2b527aec0ee5db4303c8f669d"><code>eb1c428</code></a>
Trigger workflows</li>
<li><a
href="https://github.com/github/codeql-action/commit/444333376e064d207fe1dc74e881528bf11649c1"><code>4443333</code></a>
Update changelog for v4.39.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/d63383a7318b5332e86725adf62ac19528a9786a"><code>d63383a</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4233">#4233</a>
from github/mbg/start-proxy/report-version</li>
<li><a
href="https://github.com/github/codeql-action/commit/8dec0b9f88b61a76f5fc97056ee8e7dc8a1a8022"><code>8dec0b9</code></a>
Rename <code>path</code> to <code>result</code> in tests</li>
<li><a
href="https://github.com/github/codeql-action/commit/4eabea6b5e5123ae16fffacf06e86d9d3864c350"><code>4eabea6</code></a>
Merge remote-tracking branch 'origin/main' into
mbg/start-proxy/report-version</li>
<li><a
href="https://github.com/github/codeql-action/commit/57938b85687300731b9b53559017c143d849481d"><code>57938b8</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4201">#4201</a>
from github/mario-campos/automate-changenotes-assemble</li>
<li><a
href="https://github.com/github/codeql-action/commit/ee07b503f465bcf3338b6e4807a36789e3106f4b"><code>ee07b50</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/4236">#4236</a>
from github/mbg/add-missing-changenotes</li>
<li><a
href="https://github.com/github/codeql-action/commit/a897ed5c2eeeb4862bf224c65f62a8b2478eb581"><code>a897ed5</code></a>
Add change note for <a
href="https://redirect.github.com/github/codeql-action/issues/4206">#4206</a></li>
<li><a
href="https://github.com/github/codeql-action/commit/c8bd0195fb2ec9584b1bd6faf9ff5e2983c63d82"><code>c8bd019</code></a>
Add change note for <a
href="https://redirect.github.com/github/codeql-action/issues/4198">#4198</a></li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/24c54180a607b1449ed407dd24f251e4e9147c8d...6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 14:39:36 -04:00
dependabot[bot] 3ff6d88681 build(deps): bump astral-sh/uv from 0.12.24 to 0.13.5 in the docker-base-image-digests group (#1550) 
> [!WARNING]
> Cooldown could not be applied because no publication date was
available from the registry.
>

Bumps the docker-base-image-digests group with 1 update:
[astral-sh/uv](https://github.com/astral-sh/uv).

Updates `astral-sh/uv` from 0.12.24 to 0.13.5
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/releases">astral-sh/uv's
releases</a>.</em></p>
<blockquote>
<h2>0.13.5</h2>
<h2>Release Notes</h2>
<p>Released on 2026-10-21.</p>
<p>Following <a
href="https://github.com/astral-sh/uv/releases/tag/0.13.4">uv
0.13.4</a>, which removed the affected eMudhra/emSign root from uv's own
certificate store, this release updates the latest managed CPython
builds for 3.11 and newer to <a
href="https://github.com/astral-sh/python-build-standalone/releases/tag/20261021">python-build-standalone
20261021</a>, including the CPython <a
href="https://www.python.org/downloads/release/python-3151/">3.15.1</a>,
<a
href="https://www.python.org/downloads/release/python-3149/">3.14.9</a>,
and <a
href="https://www.python.org/downloads/release/python-31317/">3.13.17</a>
security patch releases. These builds include <a
href="https://pip.pypa.io/en/stable/news/#v26-2-2">pip 26.2.2</a> both
preinstalled in the managed interpreter and bundled with
<code>ensurepip</code>, which installs pip by default when you run
<code>python -m venv</code>. Both copies use certifi 2026.10.19, which
removes the same affected root. After upgrading uv, run <code>uv python
upgrade</code> to install the updated builds. Virtual environments
pinned to an older Python patch version do not switch to the updated
interpreter automatically. Upgrade pip separately in existing virtual
environments.</p>
<p>Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.</p>
<h3>Enhancements</h3>
<ul>
<li>Report incompatible self-dependencies directly in resolution errors
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21845">#21845</a>)</li>
</ul>
<h3>Python</h3>
<ul>
<li>Add CPython 3.15.1, 3.14.9, and 3.13.17 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22802">#22802</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with <code>wheel-variants</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22535">#22535</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22536">#22536</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22687">#22687</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22688">#22688</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Reduce peak memory use when resolving dependencies across multiple
environments (<a
href="https://redirect.github.com/astral-sh/uv/pull/22769">#22769</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22770">#22770</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22784">#22784</a>)</li>
<li>Speed up exports with complex transitive extras by resolving
activation across the dependency graph (<a
href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li>
<li>Reduce uv's binary size by keeping additional error formatters out
of line (<a
href="https://redirect.github.com/astral-sh/uv/pull/22775">#22775</a>)</li>
<li>Reduce overhead when parsing custom build cache keys (<a
href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Lock packages distributed only as Android wheels without a source
distribution (<a
href="https://redirect.github.com/astral-sh/uv/pull/22806">#22806</a>)</li>
<li>Export optional dependencies correctly when transitive extras are
activated through different or incompatible environment paths (<a
href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li>
<li>Reject invalid custom build cache keys instead of silently falling
back to the defaults (<a
href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li>
</ul>
<h3>Security</h3>
<ul>
<li>Reject certificate chains containing compromised eMudhra
intermediate keys via <code>rustls-webpki</code> 0.103.16 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22777">#22777</a>)</li>
<li>Stop publishing uv Docker images based on Python 3.9 and 3.10 images
that no longer receive upstream updates (<a
href="https://redirect.github.com/astral-sh/uv/pull/22773">#22773</a>)</li>
</ul>
<h2>Install uv 0.13.5</h2>
<h3>Install prebuilt binaries via shell script</h3>
<pre lang="sh"><code>curl --proto '=https' --tlsv1.2 -LsSf
https://releases.astral.sh/github/uv/releases/download/0.13.5/uv-installer.sh
| sh
</code></pre>
<h3>Install prebuilt binaries via powershell script</h3>
<pre lang="sh"><code>&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/astral-sh/uv/blob/main/CHANGELOG.md">astral-sh/uv's
changelog</a>.</em></p>
<blockquote>
<h2>0.13.5</h2>
<p>Released on 2026-10-21.</p>
<p>Following <a
href="https://github.com/astral-sh/uv/releases/tag/0.13.4">uv
0.13.4</a>, which removed the affected eMudhra/emSign root from uv's own
certificate store, this release updates the latest managed CPython
builds for 3.11 and newer to <a
href="https://github.com/astral-sh/python-build-standalone/releases/tag/20261021">python-build-standalone
20261021</a>, including the CPython <a
href="https://www.python.org/downloads/release/python-3151/">3.15.1</a>,
<a
href="https://www.python.org/downloads/release/python-3149/">3.14.9</a>,
and <a
href="https://www.python.org/downloads/release/python-31317/">3.13.17</a>
security patch releases. These builds include <a
href="https://pip.pypa.io/en/stable/news/#v26-2-2">pip 26.2.2</a> both
preinstalled in the managed interpreter and bundled with
<code>ensurepip</code>, which installs pip by default when you run
<code>python -m venv</code>. Both copies use certifi 2026.10.19, which
removes the same affected root. After upgrading uv, run <code>uv python
upgrade</code> to install the updated builds. Virtual environments
pinned to an older Python patch version do not switch to the updated
interpreter automatically. Upgrade pip separately in existing virtual
environments.</p>
<p>Please note upstream CPython 3.9 and 3.10 still bundle pip releases
whose certificate bundles trust the affected eMudhra/emSign root. We
recommend migrating off of those versions and will no longer be
releasing Docker images with uv installed for EOL Python versions.</p>
<h3>Enhancements</h3>
<ul>
<li>Report incompatible self-dependencies directly in resolution errors
(<a
href="https://redirect.github.com/astral-sh/uv/pull/21845">#21845</a>)</li>
</ul>
<h3>Python</h3>
<ul>
<li>Add CPython 3.15.1, 3.14.9, and 3.13.17 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22802">#22802</a>)</li>
</ul>
<h3>Preview features</h3>
<ul>
<li>Select and rank wheel variants with no required properties or
properties from PEP 850 static providers in platform-specific
resolutions with <code>wheel-variants</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22535">#22535</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22536">#22536</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22687">#22687</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22688">#22688</a>)</li>
</ul>
<h3>Performance</h3>
<ul>
<li>Reduce peak memory use when resolving dependencies across multiple
environments (<a
href="https://redirect.github.com/astral-sh/uv/pull/22769">#22769</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22770">#22770</a>,
<a
href="https://redirect.github.com/astral-sh/uv/pull/22784">#22784</a>)</li>
<li>Speed up exports with complex transitive extras by resolving
activation across the dependency graph (<a
href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li>
<li>Reduce uv's binary size by keeping additional error formatters out
of line (<a
href="https://redirect.github.com/astral-sh/uv/pull/22775">#22775</a>)</li>
<li>Reduce overhead when parsing custom build cache keys (<a
href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>Lock packages distributed only as Android wheels without a source
distribution (<a
href="https://redirect.github.com/astral-sh/uv/pull/22806">#22806</a>)</li>
<li>Export optional dependencies correctly when transitive extras are
activated through different or incompatible environment paths (<a
href="https://redirect.github.com/astral-sh/uv/pull/22751">#22751</a>)</li>
<li>Reject invalid custom build cache keys instead of silently falling
back to the defaults (<a
href="https://redirect.github.com/astral-sh/uv/pull/22749">#22749</a>)</li>
</ul>
<h3>Security</h3>
<ul>
<li>Reject certificate chains containing compromised eMudhra
intermediate keys via <code>rustls-webpki</code> 0.103.16 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22777">#22777</a>)</li>
<li>Stop publishing uv Docker images based on Python 3.9 and 3.10 images
that no longer receive upstream updates (<a
href="https://redirect.github.com/astral-sh/uv/pull/22773">#22773</a>)</li>
</ul>
<h2>0.13.4</h2>
<p>Released on 2026-10-20.</p>
<h3>Preview features</h3>
<ul>
<li>Validate PEP 825 variant metadata and treat package versions with
invalid metadata as unavailable under <code>wheel-variants</code> (<a
href="https://redirect.github.com/astral-sh/uv/pull/22512">#22512</a>)</li>
</ul>
<h3>Other changes</h3>
<ul>
<li>Update the bundled Mozilla root certificates via
<code>webpki-root-certs</code> 1.0.10 (<a
href="https://redirect.github.com/astral-sh/uv/pull/22760">#22760</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/astral-sh/uv/commit/46776a95d6686ac0160c10611327ce491e6b202f"><code>46776a9</code></a>
Use checked-in Python metadata for trampoline checks (<a
href="https://redirect.github.com/astral-sh/uv/issues/22811">#22811</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/5babfa90b420ea12a611554f8cbbb41d433534be"><code>5babfa9</code></a>
Use checked-in Python download metadata for releases (<a
href="https://redirect.github.com/astral-sh/uv/issues/22810">#22810</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/06fbc976b1462d56bc83609e1c26250740e9c656"><code>06fbc97</code></a>
Reject Cargo.lock changes from forks (<a
href="https://redirect.github.com/astral-sh/uv/issues/22381">#22381</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/b3c01fd5745ab459863b83380dbd79621073a797"><code>b3c01fd</code></a>
Prepare 0.13.5 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22809">#22809</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/a02d446bcddd8a00c98084709b6bdccbc9a8208f"><code>a02d446</code></a>
Update to include Python 3.15.1, 3.14.9, 3.13.17 (<a
href="https://redirect.github.com/astral-sh/uv/issues/22802">#22802</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/0ee565f1d755dfa5d7ba78db287ed342ec3e4d4b"><code>0ee565f</code></a>
Reproduce local-version marker rendering panic (<a
href="https://redirect.github.com/astral-sh/uv/issues/22807">#22807</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/e3810e1e6daf06095ac58a27dd422eb095ea4ed6"><code>e3810e1</code></a>
Infer platform markers from Android wheel tags (<a
href="https://redirect.github.com/astral-sh/uv/issues/22806">#22806</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/75698b1ed23dd410421de4656304077351641fa7"><code>75698b1</code></a>
Update rustup in Docker builders (<a
href="https://redirect.github.com/astral-sh/uv/issues/22803">#22803</a>)</li>
<li><a
href="https://github.com/astral-sh/uv/commit/1765e51d67f43299d8fbd37b302b773a80c8499d"><code>1765e51</code></a>
Replace actions/attest-build-provenance action with actions/attest
v4.2.2 (<a
href="https://redirect.github.com/astral-sh/uv/issues/2">#2</a>...</li>
<li><a
href="https://github.com/astral-sh/uv/commit/0abe802a1a07417f5163e57549c93c132cd7db3f"><code>0abe802</code></a>
Update Rust crate test-log to v0.2.21 (<a
href="https://redirect.github.com/astral-sh/uv/issues/19721">#19721</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/astral-sh/uv/compare/0.12.24...0.13.5">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=astral-sh/uv&package-manager=docker&previous-version=0.12.24&new-version=0.13.5)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 14:39:23 -04:00
dependabot[bot] eb84426890 build(deps): bump werkzeug from 3.1.8 to 3.1.9 (#1553) 
Bumps [werkzeug](https://github.com/pallets/werkzeug) from 3.1.8 to
3.1.9.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/werkzeug/releases">werkzeug's
releases</a>.</em></p>
<blockquote>
<h2>3.1.9</h2>
<p>This is the Werkzeug 3.1.9 security fix release, which fixes security
issues and bugs but does not otherwise change behavior and should not
result in breaking changes compared to the latest feature release.</p>
<p>PyPI: <a
href="https://pypi.org/project/Werkzeug/3.1.9/">https://pypi.org/project/Werkzeug/3.1.9/</a>
Changes: <a
href="https://werkzeug.palletsprojects.com/page/changes/#version-3-1-9">https://werkzeug.palletsprojects.com/page/changes/#version-3-1-9</a>
Milestone: <a
href="https://github.com/pallets/werkzeug/milestone/46?closed=1">https://github.com/pallets/werkzeug/milestone/46?closed=1</a></p>
<ul>
<li><code>safe_join</code> on Windows does not allow special devices
names with empty ADS markers on NTFS. <a
href="https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m">https://github.com/pallets/werkzeug/security/advisories/GHSA-g6x2-hccm-hh4m</a></li>
<li><code>ProfilerMiddleware</code> uses <code>profiling.tracing</code>
on Python 3.15. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3207">#3207</a></li>
<li><code>uri_to_iri</code> and <code>iri_to_uri</code> preserve empty
username, password, and port 0. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3189">#3189</a></li>
<li>Improve performance of <code>parse_options_header</code>. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3231">#3231</a></li>
<li>Improve performance of <code>parse_etags</code>. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3231">#3231</a></li>
<li>Improve performance of <code>parse_cookie</code>. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3231">#3231</a></li>
<li><code>get_host</code> also checks that the port is in the valid
range. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3236">#3236</a></li>
<li>The <code>int</code> URL converter returns a 404 instead of 500
error when the value is longer than
<code>sys.get_int_max_str_digits()</code>. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3237">#3237</a></li>
<li>Improve debugger PIN generation from cgroup data inside Podman. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3245">#3245</a></li>
<li><code>Authorization</code> parsing <code>basic</code> auth disallows
non-base64 characters. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3248">#3248</a></li>
<li><code>application/x-www-form-urlencoded</code> form data is no
longer limited to <code>max_form_memory_size</code>, only
<code>max_content_length</code>. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3251">#3251</a></li>
<li><code>LimitedStream.readinto</code> does not resize the buffer when
it reads less than the remaining size. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3253">#3253</a></li>
<li>Rules with 10 or more converters in a single part assign matched
values correctly. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3254">#3254</a></li>
<li>The invalid <code>Range</code> suffix length <code>-0</code> is no
longer accepted. <a
href="https://redirect.github.com/pallets/werkzeug/issues/3255">#3255</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pallets/werkzeug/blob/main/CHANGES.rst">werkzeug's
changelog</a>.</em></p>
<blockquote>
<h2>Version 3.1.9</h2>
<p>Released 2026-09-27</p>
<ul>
<li><code>safe_join</code> on Windows does not allow special devices
names with empty ADS
markers on NTFS. :ghsa:<code>g6x2-hccm-hh4m</code></li>
<li><code>ProfilerMiddleware</code> uses <code>profiling.tracing</code>
on Python 3.15.
:issue:<code>3207</code></li>
<li><code>uri_to_iri</code> and <code>iri_to_uri</code> preserve empty
username, password, and
port 0. :issue:<code>3189</code></li>
<li>Improve performance of <code>parse_options_header</code>.
:pr:<code>3231</code></li>
<li>Improve performance of <code>parse_etags</code>.
:pr:<code>3231</code></li>
<li>Improve performance of <code>parse_cookie</code>.
:pr:<code>3231</code></li>
<li><code>get_host</code> also checks that the port is in the valid
range. :pr:<code>3236</code></li>
<li>The <code>int</code> URL converter returns a 404 instead of 500
error when the value
is longer than <code>sys.get_int_max_str_digits()</code>.
:issue:<code>3237</code></li>
<li>Improve debugger PIN generation from cgroup data inside Podman.
:issue:<code>3245</code></li>
<li><code>Authorization</code> parsing <code>basic</code> auth disallows
non-base64 characters.
:pr:<code>3248</code></li>
<li><code>application/x-www-form-urlencoded</code> form data is no
longer limited to
<code>max_form_memory_size</code>, only <code>max_content_length</code>.
:pr:<code>3251</code></li>
<li><code>LimitedStream.readinto</code> does not resize the buffer when
it reads less
than the remaining size. :pr:<code>3253</code></li>
<li>Rules with 10 or more converters in a single part assign matched
values
correctly. :pr:<code>3254</code></li>
<li>The invalid <code>Range</code> suffix length <code>-0</code> is no
longer accepted. :pr:<code>3255</code></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pallets/werkzeug/commit/6604c3b8784ecc7cf5ac0b7412d916989b4c7d45"><code>6604c3b</code></a>
release version 3.1.9</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/a78b30ac0cafe53a4f252ffbf827bf6da7591341"><code>a78b30a</code></a>
update dependencies</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/8d77320bcdf3a34941ec06dcf16b03c065cd21b6"><code>8d77320</code></a>
disallow special name with ads (<a
href="https://redirect.github.com/pallets/werkzeug/issues/3309">#3309</a>)</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/b2a2c09730086ab2d375f0b069c821d4edf526b7"><code>b2a2c09</code></a>
disallow special name with ads</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/4efac9df7ebabe13f82ab0823d5ca0109db20bc3"><code>4efac9d</code></a>
add links</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/400c23e01953311bb0959586f7194191732b18bc"><code>400c23e</code></a>
Allow flit_core 4.x (<a
href="https://redirect.github.com/pallets/werkzeug/issues/3261">#3261</a>)</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/7132a19c26320ae01076d2743df42b9913bbe1d7"><code>7132a19</code></a>
allow flit_core 4</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/6fba87c311e55b4afcef71393a1733498b16676f"><code>6fba87c</code></a>
only accept ASCII digits</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/263f5caf2e26ebd85e38f899628c22f6813c7a2f"><code>263f5ca</code></a>
disallow range -0 (<a
href="https://redirect.github.com/pallets/werkzeug/issues/3255">#3255</a>)</li>
<li><a
href="https://github.com/pallets/werkzeug/commit/0c419f951f3206c89e7c95155f0bd771b02a961f"><code>0c419f9</code></a>
disallow range -0</li>
<li>Additional commits viewable in <a
href="https://github.com/pallets/werkzeug/compare/3.1.8...3.1.9">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=werkzeug&package-manager=uv&previous-version=3.1.8&new-version=3.1.9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/calibrain/shelfmark/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 14:38:57 -04:00
splitsec2 67a969d953 ci(codeql): skip the tests directory (#1557) 
CodeQL scans `tests/`, which only runs in CI and the e2e docker stack.
That is where the open `py/full-ssrf` (critical) and the two
`py/reflective-xss` alerts come from, all in the e2e mock server, plus
four `py/incomplete-url-substring-sanitization` alerts on URL asserts.
None of them can reach a running instance.

This adds `.github/codeql/codeql-config.yml` with `paths-ignore: tests`
and points the init step at it. It closes those seven and hides nothing
in `shelfmark/` or the frontend. The rest of the open alerts are
unchanged.

@calibrain I know I have ability to merge this, but wanted you to be the
one for this. It clears the test alerts and leaves the rest, and
prevents you from having to clear them manually. Just a little QoL.
 2026-10-23 14:35:31 -04:00
dependabot[bot] 193351c5a0 build(deps): bump certifi from 2026.7.22 to 2026.10.19 (#1554) 
Bumps [certifi](https://github.com/certifi/python-certifi) from
2026.7.22 to 2026.10.19.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/certifi/python-certifi/commit/662df63d7906df66f1f07c0751a3dfe9da14d914"><code>662df63</code></a>
Restore unaffected emSign roots (<a
href="https://redirect.github.com/certifi/python-certifi/issues/439">#439</a>)
(<a
href="https://redirect.github.com/certifi/python-certifi/issues/440">#440</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/5cb238caeeb6c30ec1a7309ad3e16a5aa7b10ce8"><code>5cb238c</code></a>
Remove emsign (<a
href="https://redirect.github.com/certifi/python-certifi/issues/437">#437</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/69494a764d0a08f90838d53d4b0fefd3e84045d6"><code>69494a7</code></a>
Bump actions/download-artifact from 8.0.1 to 8.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/436">#436</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/029c7b0913d79e2efb73a216fc5c5e13ef958536"><code>029c7b0</code></a>
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/435">#435</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/9d0a8f1f3a0d6b2e38d5773db7afe1a37e4527b6"><code>9d0a8f1</code></a>
Add support for Python 3.15 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/432">#432</a>)</li>
<li><a
href="https://github.com/certifi/python-certifi/commit/db472abf0a37067cb4488f036f4c19adf6b6ec3c"><code>db472ab</code></a>
Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (<a
href="https://redirect.github.com/certifi/python-certifi/issues/431">#431</a>)</li>
<li>See full diff in <a
href="https://github.com/certifi/python-certifi/compare/2026.07.22...2026.10.19">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=certifi&package-manager=uv&previous-version=2026.7.22&new-version=2026.10.19)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/calibrain/shelfmark/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 02:02:35 -06:00
splitsec2 e33803cac2 build(deps): update socket.io-parser, ws and baseline-browser-mapping in the lockfiles (#1560) 
Dependabot has four open npm alerts and no PRs for them, since they are
all transitive. This updates the lockfiles only, no package.json change.

| Package | From | To | Alert |
|---|---|---|---|
| socket.io-parser | 4.2.6 | 4.2.7 | zero-attachment memory exhaustion
(high) |
| ws | 8.18.3 | 8.21.3 | memory exhaustion DoS (high) and uninitialized
memory disclosure (medium) |
| engine.io-client | 6.6.4 | 6.6.7 | needed to get ws past its `~8.18`
range |
| baseline-browser-mapping | 2.9.19 | 2.11.31 | process termination on
invalid input (medium, dev only) |

I think the practical risk was low to begin with, since ws is only used
by engine.io-client under Node and the built bundle doesn't include it.
Still, it clears the alerts and the bumps are small.

Done with npm 11 so the `libc` fields in the lockfile stay as they were.
A clean `npm ci` from the new lockfile gives 0 vulnerabilities, and
`tsc`, `vitest` (241 tests) and `vite build` all pass.
 2026-10-23 02:00:44 -06:00
dependabot[bot] 00c03e3058 build(deps): bump oauthlib from 3.3.1 to 4.0.0 (#1556) 
Bumps [oauthlib](https://github.com/oauthlib/oauthlib) from 3.3.1 to
4.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/oauthlib/oauthlib/releases">oauthlib's
releases</a>.</em></p>
<blockquote>
<h2>4.0.0</h2>
<h2>Introduction</h2>
<p>The release 4.0.0 defines the foundation that enables AI
contributions and will improve the maintenance of oauthlib by using AI
agents, skills, code for both contributors and maintainers. It includes
devcontainer, skills and cleanup of instructions.</p>
<h2>What's Changed</h2>
<p><strong>Important</strong>: this release contains 2 breaking changes.
See CHANGELOG.rst for details:</p>
<ul>
<li>Removed JSONP support from token revocation endpoint (<a
href="https://redirect.github.com/oauthlib/oauthlib/issues/951">#951</a>)</li>
<li>Client authentication validation reorganized across grants (<a
href="https://redirect.github.com/oauthlib/oauthlib/issues/919">#919</a>,
<a
href="https://redirect.github.com/oauthlib/oauthlib/issues/920">#920</a>):
the <code>grant_type</code> parameter is now validated before client
authentication.</li>
</ul>
<ul>
<li>Replace pyenv with uv in documentation and tooling by <a
href="https://github.com/JonathanHuot"><code>@​JonathanHuot</code></a>
in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/910">oauthlib/oauthlib#910</a></li>
<li>Improve github action to publish package by <a
href="https://github.com/JonathanHuot"><code>@​JonathanHuot</code></a>
in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/915">oauthlib/oauthlib#915</a></li>
<li>Add pre-commit to run linters, formatters, etc. on code changes by
<a href="https://github.com/cclauss"><code>@​cclauss</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/918">oauthlib/oauthlib#918</a></li>
<li>Fix client authentication for DeviceCodeGrant when getting a token
by <a href="https://github.com/hekhuisk"><code>@​hekhuisk</code></a> in
<a
href="https://redirect.github.com/oauthlib/oauthlib/pull/920">oauthlib/oauthlib#920</a></li>
<li>Add project URLs to this project's PyPI page by <a
href="https://github.com/Flimm"><code>@​Flimm</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/921">oauthlib/oauthlib#921</a></li>
<li>Fix a typo in ServiceApplicationClient docstring. by <a
href="https://github.com/rafalkrupinski"><code>@​rafalkrupinski</code></a>
in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/923">oauthlib/oauthlib#923</a></li>
<li>Correct grammar in function help by <a
href="https://github.com/verhovsky"><code>@​verhovsky</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/924">oauthlib/oauthlib#924</a></li>
<li>Add Python 3.14 to the testing by <a
href="https://github.com/cclauss"><code>@​cclauss</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/925">oauthlib/oauthlib#925</a></li>
<li>Initial python/uv/tox devcontainer by <a
href="https://github.com/JonathanHuot"><code>@​JonathanHuot</code></a>
in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/930">oauthlib/oauthlib#930</a></li>
<li>Fix ruff checks about unused variables by <a
href="https://github.com/JonathanHuot"><code>@​JonathanHuot</code></a>
in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/931">oauthlib/oauthlib#931</a></li>
<li>Drop EOL Python 3.8 from CI by <a
href="https://github.com/auvipy"><code>@​auvipy</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/932">oauthlib/oauthlib#932</a></li>
<li>Set Open Collective username to 'oauthlib' by <a
href="https://github.com/auvipy"><code>@​auvipy</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/933">oauthlib/oauthlib#933</a></li>
<li>pre-commit autoupdate 2026_02_21 by <a
href="https://github.com/cclauss"><code>@​cclauss</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/934">oauthlib/oauthlib#934</a></li>
<li>Remove a trailing whitespace fo fix failing pre-commit by <a
href="https://github.com/cclauss"><code>@​cclauss</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/935">oauthlib/oauthlib#935</a></li>
<li>Fix typos discovered by typos by <a
href="https://github.com/cclauss"><code>@​cclauss</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/938">oauthlib/oauthlib#938</a></li>
<li>Add <code>resource</code> to Request._params by <a
href="https://github.com/juannyG"><code>@​juannyG</code></a> in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/942">oauthlib/oauthlib#942</a></li>
<li>Release 3.4.0: Add OAuthLib Maintainer agent by <a
href="https://github.com/JonathanHuot"><code>@​JonathanHuot</code></a>
in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/950">oauthlib/oauthlib#950</a></li>
<li>Remove JSONP support from token revocation by <a
href="https://github.com/JonathanHuot"><code>@​JonathanHuot</code></a>
in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/951">oauthlib/oauthlib#951</a></li>
<li>Improve PKCE code comparison by <a
href="https://github.com/JonathanHuot"><code>@​JonathanHuot</code></a>
in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/963">oauthlib/oauthlib#963</a></li>
<li>Release 4.0.0: bump and update changelog by <a
href="https://github.com/JonathanHuot"><code>@​JonathanHuot</code></a>
in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/976">oauthlib/oauthlib#976</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/hekhuisk"><code>@​hekhuisk</code></a>
made their first contribution in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/920">oauthlib/oauthlib#920</a></li>
<li><a href="https://github.com/Flimm"><code>@​Flimm</code></a> made
their first contribution in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/921">oauthlib/oauthlib#921</a></li>
<li><a href="https://github.com/verhovsky"><code>@​verhovsky</code></a>
made their first contribution in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/924">oauthlib/oauthlib#924</a></li>
<li><a href="https://github.com/juannyG"><code>@​juannyG</code></a> made
their first contribution in <a
href="https://redirect.github.com/oauthlib/oauthlib/pull/942">oauthlib/oauthlib#942</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/oauthlib/oauthlib/compare/v3.3.1...v4.0.0">https://github.com/oauthlib/oauthlib/compare/v3.3.1...v4.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/oauthlib/oauthlib/blob/master/CHANGELOG.rst">oauthlib's
changelog</a>.</em></p>
<blockquote>
<h2>4.0.0 (2026-09-28):</h2>
<p>OAuth2.0 Provider:</p>
<ul>
<li><strong>Breaking</strong>: <a
href="https://redirect.github.com/oauthlib/oauthlib/issues/951">#951</a>:
Removed JSONP support from token revocation endpoint.
JSONP has been superseded by CORS for cross-origin requests.
The <code>enable_jsonp</code> parameter has been removed from
<code>RevocationEndpoint</code>
and the <code>callback</code> parameter has been removed from
<code>prepare_token_revocation_request</code>.</li>
<li><strong>Breaking</strong>: <a
href="https://redirect.github.com/oauthlib/oauthlib/issues/919">#919</a>,
<a
href="https://redirect.github.com/oauthlib/oauthlib/issues/920">#920</a>:
Fixed <code>DeviceCodeGrant.validate_token_request</code>
trying to authenticate public clients.
Client authentication validation has been reorganized and is now shared
across <code>AuthorizationCodeGrant</code>,
<code>DeviceCodeGrant</code>, <code>RefreshTokenGrant</code>
and <code>ResourceOwnerPasswordCredentialsGrant</code>: the
<code>grant_type</code> parameter
is validated before client authentication, so requests missing
<code>grant_type</code> now return <code>400 invalid_request</code>
instead of
<code>401 invalid_client</code>.</li>
<li><a
href="https://redirect.github.com/oauthlib/oauthlib/issues/963">#963</a>:
Improved PKCE code comparison</li>
</ul>
<p>Misc:</p>
<ul>
<li><a
href="https://redirect.github.com/oauthlib/oauthlib/issues/904">#904</a>:
Stop installing <code>examples</code> into
<code>site-packages</code>.</li>
<li><a
href="https://redirect.github.com/oauthlib/oauthlib/issues/930">#930</a>:
Add devcontainer, Add Python3.14, Python3.14t.</li>
<li><a
href="https://redirect.github.com/oauthlib/oauthlib/issues/931">#931</a>:
Fix ruff checks about unused variables.</li>
<li><a
href="https://redirect.github.com/oauthlib/oauthlib/issues/932">#932</a>:
Dropped EOL Python 3.8 from CI.</li>
<li><a
href="https://redirect.github.com/oauthlib/oauthlib/issues/934">#934</a>:
Pre-commit hooks autoupdate.</li>
<li><a
href="https://redirect.github.com/oauthlib/oauthlib/issues/938">#938</a>:
Fix typos discovered by typos.</li>
<li>Add OAuthLib Maintainer agent for automated issue/PR triage and
release
management.</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/145a9a4690cb4d9de30d15fcc2984e34c49df741"><code>145a9a4</code></a>
Release 4.0.0: clarify changelog breaking changes and reformat
entries</li>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/c8344d61492c7ae708cf378ecabab7ee6ab62812"><code>c8344d6</code></a>
Update CHANGELOG.rst</li>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/e172830efd66a2dc1bb34b3bbbf8ee53036a9dac"><code>e172830</code></a>
Release 4.0.0: bump version to 4.0.0 and update changelog</li>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950"><code>40b0ab5</code></a>
Merge pull request <a
href="https://redirect.github.com/oauthlib/oauthlib/issues/963">#963</a>
from oauthlib/ft/pkcecode</li>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/1b68ceaae02fe62aeaaa3468a8f8082c73830a3a"><code>1b68cea</code></a>
Merge pull request <a
href="https://redirect.github.com/oauthlib/oauthlib/issues/920">#920</a>
from hekhuisk/validate-client-authentication</li>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/c951a1d09f99f14e3240973fa83c4f4287d4753d"><code>c951a1d</code></a>
Organized validate_client functions for all grant to avoid mistake in
grnat i...</li>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/74664d3fe037a354e180e305135c6bab1747a6b0"><code>74664d3</code></a>
Improve PKCE code comparison</li>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/9859b057ecc5d1ad42711af7d58ee471d708ea36"><code>9859b05</code></a>
Merge pull request <a
href="https://redirect.github.com/oauthlib/oauthlib/issues/950">#950</a>
from oauthlib/feature/3.4.0-maintainer-agent</li>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/9bf9b974e0797d2d03cba05854f46e314c730ba6"><code>9bf9b97</code></a>
Merge branch 'master' into feature/3.4.0-maintainer-agent</li>
<li><a
href="https://github.com/oauthlib/oauthlib/commit/1ba7429ad79019289540fd7be27866d7e59f2564"><code>1ba7429</code></a>
Clarify agent instructions</li>
<li>Additional commits viewable in <a
href="https://github.com/oauthlib/oauthlib/compare/v3.3.1...v4.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=oauthlib&package-manager=uv&previous-version=3.3.1&new-version=4.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/calibrain/shelfmark/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 01:54:25 -06:00
splitsec2 3633dd3d97 fix: keep file links and API keys out of AllDebrid logs, fix Newznab debug log (#1559) 
Two log fixes in the same area, both found while going through the open
code scanning alerts.

AllDebrid: the unlock path logged the file link in full. The last-resort
fallback appends `apikey=` to the link and returns it, and the "Failed
to download from ..." error carries that same link into
`logger.exception`, so the key could land in the log and the traceback.
The links are now logged through `_safe_url` (scheme, host and path
only). The GET unlock fallback also logged the exception text at debug
level, and requests puts the request URL in that message, which includes
`apikey=`. That one now logs the exception type only. This covers code
scanning alert 124.

Newznab: `logger.debug("Newznab API: GET %s params=%s", url, *params)`
star-expands the dict keys into the log arguments, so with debug logging
on it raises `TypeError: not all arguments converted during string
formatting` and the line never prints. Logging `params` as is would
print the API key, so it now logs the sorted parameter names.

Tests: the Newznab one formats the logged line and checks the key is
absent. The AllDebrid ones check the fallback and failure paths log no
query string and that the fallback still returns the link with the key.
All three fail without the change. Ruff and basedpyright are clean,
`tests/newznab` and `tests/prowlarr` pass.
 2026-10-23 01:53:08 -06:00
splitsec2 4f97fc9bec fix: keep server paths and URLs out of an error response and a debug log (#1558) 
Two small leaks from going through the open CodeQL alerts (code scanning
alerts 100 and 123).

The local download route returned `str(e)` on an OSError, and for a
missing or unreadable file that text is the file's path on the server
(`[Errno 2] No such file or directory:
'/audiobooks/Author/Title.epub'`). #1422 cuts a non-admin's download
path down to the file name everywhere else, so this put it back. The
route now answers "Could not read the file" and the detail stays in the
log.

`should_bypass_proxy` logged the whole request URL at debug when it
could not be parsed. URLs can carry credentials, so it logs only the
exception now.

Each change has a test that fails without it. The full non-e2e suite,
ruff and basedpyright pass.
 2026-10-23 01:52:39 -06:00
dependabot[bot] 003df0b686 build(deps): bump cryptography from 46.0.7 to 50.0.0 (#1555) 
Bumps [cryptography](https://github.com/pyca/cryptography) from 46.0.7
to 50.0.0.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's
changelog</a>.</em></p>
<blockquote>
<p>50.0.0 - 2026-07-31</p>
<pre><code>
* **SECURITY ISSUE**:

:func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
and its PEM and S/MIME variants no longer expose distinguishable errors
or
timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which
could
act as a Bleichenbacher oracle for callers that decrypt untrusted
messages.
A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys
or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
:class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for
constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification &lt;cryptography.x509.verification&gt;`
APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
&lt;https://c2sp.org/chunked-encryption&gt;`_ for streaming
authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
carry trailing bytes after the list or after an individual SCT, instead
of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field
type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a
non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
``GeneralizedTime`` that carries fractional seconds or another non-DER
form,
matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
:func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a
request
or response whose ``version`` field is not ``v1``, the only version
defined
by RFC 6960, matching the version validation already performed when
loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now
supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported
when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now
supported
  when building against AWS-LC.
&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pyca/cryptography/commit/dcb7050b807b00392fa9fe2eac7cb362fcf355cc"><code>dcb7050</code></a>
Prepare for 50.0.0 release (<a
href="https://redirect.github.com/pyca/cryptography/issues/15372">#15372</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/53fccd93413a8d7f07d6d8999681f27b75cffa3f"><code>53fccd9</code></a>
Don't leak how PKCS#7 encryptedKey decryption failed (<a
href="https://redirect.github.com/pyca/cryptography/issues/15369">#15369</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/d472f978470fbefa521b86d98b2ecccbbb4d1dd8"><code>d472f97</code></a>
Add <code>from __future__ import annotations</code> to all src/ Python
files (<a
href="https://redirect.github.com/pyca/cryptography/issues/15371">#15371</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/908773d53829fb1466c6db364b31321c3cd8eb9a"><code>908773d</code></a>
Bump downstream dependencies in CI (<a
href="https://redirect.github.com/pyca/cryptography/issues/15368">#15368</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/2cc07cc948948211899bcb0cddd1fddf86e95812"><code>2cc07cc</code></a>
Bump BoringSSL, OpenSSL, AWS-LC in CI (<a
href="https://redirect.github.com/pyca/cryptography/issues/15367">#15367</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/c94ede9f040fa44942f7139772603419000acf66"><code>c94ede9</code></a>
chore(deps): bump ruff from 0.16.0 to 0.16.1 (<a
href="https://redirect.github.com/pyca/cryptography/issues/15366">#15366</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/67a8308dc9ea4cce6056e0f1438f903c208c3f35"><code>67a8308</code></a>
chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (<a
href="https://redirect.github.com/pyca/cryptography/issues/15365">#15365</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/95018ffcdbbc510fd92fc872e3a3e80aa6e58596"><code>95018ff</code></a>
Release the GIL in one-shot AEAD encrypt/decrypt (<a
href="https://redirect.github.com/pyca/cryptography/issues/15361">#15361</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/6954733eaf55a0074abf88f06f7242dfca3a5d02"><code>6954733</code></a>
Release the GIL during DH and DSA parameter generation (<a
href="https://redirect.github.com/pyca/cryptography/issues/15364">#15364</a>)</li>
<li><a
href="https://github.com/pyca/cryptography/commit/6893b94c33e948f6240082461424cfb5da2dacc6"><code>6893b94</code></a>
Import _serialization instead of serialization in x509/extensions (<a
href="https://redirect.github.com/pyca/cryptography/issues/15363">#15363</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/pyca/cryptography/compare/46.0.7...50.0.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cryptography&package-manager=uv&previous-version=46.0.7&new-version=50.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/calibrain/shelfmark/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-23 01:28:06 -06:00
splitsec2 86fff32297 feat(hardcover): owned books, simpler queries, dead sources and failed releases (#1535) 
A request whose book turns out to be in the library is closed with the note `[auto] Already in the library.` instead of sitting in Needs Review. A request an admin handled by hand while a pass was running is skipped. A series label in front of a Calibre title no longer hides an owned book, and a Calibre title marked as another edition (full cast, dramatized, GraphicAudio) is not the book.

When no source matches, up to three simpler forms of the title are tried on each source under the same strict match. Optionally (off by default), an unmatched audiobook request is looked up on Audible US and UK through Audiobookshelf's metadata search and the request says what the store answered. It never declines anything.

A Soulseek peer whose recent transfers all failed, and an AudiobookBay post whose comments say it has no seeders, are tried after the other matches and never excluded. A failed or stalled release is kept out for AUTO_DOWNLOAD_RETRY_FAILED_RELEASE_DAYS and then tried again, and a torrent that died for one request is not offered to another. A request stuck on queued or downloading is settled from the download history. Optionally (off by default) a failed download is retried with another release within minutes.
 2026-10-23 01:08:00 -06:00
splitsec2 9d5b47d17b feat(hardcover): retries, error counting and a back-off for requests nothing matches (#1534) 
A synced request whose download failed, was interrupted by a restart, or was cancelled by the stall timer goes back to pending after AUTO_DOWNLOAD_RETRY_DAYS (7 by default, 0 turns it off), a few per pass, oldest first. Only what never arrived is retried, the failed release is remembered, and a request is given up on after three failed retries. Downloads cancelled by a person and rejected requests are never retried.

Errors count as errors: a search that failed in one source no longer reads as no match, a throttled Hardcover lookup is an error and not a skip, and a request that blows up doesn't abort the pass. Both summaries carry the error count.

A request for the same Hardcover book and format is skipped when the history already has a finished or running download for it. A request that finds nothing is searched once a day after three no-match passes, then every two days, up to AUTO_DOWNLOAD_BACKOFF_MAX_DAYS (3 by default, 0 turns it off).
 2026-10-23 00:58:42 -06:00
splitsec2 4389548deb feat(hardcover): ebooks, audiobooks or both, and stricter matching for automatic downloads (#1533) 
A shelf book can be requested as an ebook, an audiobook or both (one request per format), and each request is checked against its own library, source priority list and format guard. Ranking within a source prefers the most downloaded copy, then size, and one m4b is preferred to a set of chapter files unless it is much smaller than the other copies. Soulseek peers are ranked by free slot, queue length and speed.

Automatic downloads refuse multi-book packs, sequels and other works named in the title, study guides, abridged or dramatised versions, two-in-one titles, releases in a language the requester didn't ask for, and an archive for an audiobook request.

Matching folds accents on both sides, drops an alternate title for the search and the match, and reads small numbers the same in any form. AudiobookBay releases with no author in the listing title are judged on the authors credited on the detail page.
 2026-10-23 00:41:13 -06:00
splitsec2 ea69db3f8e feat(library): Audiobookshelf library check, and the sync fails closed when a library cannot be read (#1519) 
Adds an Audiobookshelf provider for the library check, next to the Calibre one. It reads the server over its REST API (title, author, ISBN and ASIN per item), answers for audiobooks, and has its settings in General with a test button that uses the unsaved form values. Read only.

The Hardcover sync and automatic downloads now fail closed when an enabled library cannot be read: the sync skips its cycle and an automatic download holds the request. A library that listed items at the last index and now lists none counts as a failed read. Badges still fail open.
 2026-10-23 00:21:40 -06:00
ProcyonX1 99a6aa206b feat(metadata): add Deutsche Nationalbibliothek (DNB) metadata provider (#1547) 
## feat(metadata): add Deutsche Nationalbibliothek (DNB) metadata
provider

This adds the Deutsche Nationalbibliothek (DNB) as a metadata provider.
It covers German editions far better than the existing providers.
No API key, disabled by default, and the same pattern as the other
providers.

It uses DNB's public SRU interface and parses MARC21-XML. Thats one
reason why this needs more code than the Google Books or Open Library
providers. The others are the search (DNB has no relevance ranking) and
the language filter, see below.

### Notes
- **Search box.** Search-box text goes from precise to loose until a
stage has hits: the complete title, then the title as a phrase, then
every word in a title or a person's name, last without German articles.
- **"Only show editions in my book languages"** (optional, on by
default). DNB also catalogs a lot of translations. DNB filters by the
searching user's Default Book Languages, else the system default.
- **No covers.** DNB's cover service is behind Anubis bot protection, so
the provider returns no cover URLs.
- **Proxy support** already included like Open Library since #1526


### Changes outside the provider
- DNB is in the onboarding dropdown.
- Calibre's `dnb-idn` identifier is mapped, so DNB results show library
ownership
- In the env-var docs I added only the DNB section. Regenerating the
whole file on main currently also reorders unrelated sections and drops
`SHELFMARK_API_KEY_READONLY` (and the Databáze knih section sits inside
the Moly.hu block).

### Ideas
- **Deduplication.** DNB lists every edition. Kafka's "Die Verwandlung"
has around 200 German editions of the same text. Grouping them would
touch the API, the frontend and release search.
- **Language-aware metadata search** for all providers. The other
providers ignore Default Book Languages in metadata search. The
`user_id` added here could serve them too.
 2026-10-22 20:37:15 -04:00
misko903Claude Opus 5.5CaliBrain
 		2007384058 feat(sources): add Webshare.cz as a release source (#1543) 
## What

Adds [Webshare.cz](https://webshare.cz), the Czech file host, as a
release source for ebooks and audiobooks. It follows the Libgen source:
disabled by default, with a settings tab for credentials and a **Test
Login** button that reports whether the account is VIP.

## Why

Webshare is one of the main places Czech and Slovak ebooks and
audiobooks are shared, and none of the existing sources reach it.
Together with the Databáze knih metadata provider (#1479), this lets
Universal mode find Czech and Slovak titles end to end.

## How

- **API client** (`webshare/api.py`): Webshare's XML API (`POST
/api/<endpoint>/`). Login is the salted exchange the API documents:
fetch the salt, send `SHA1(MD5_CRYPT(password, salt))` plus an MD5
digest. Python dropped the `crypt` module in 3.13, so md5-crypt is a
small pure-Python port, checked against `openssl passwd -1`. The session
token is cached per account and refreshed once when an authenticated
call fails. File-level errors (`FILE_LINK_FATAL_*`) are not retried. XML
is parsed with `defusedxml`.
- **Search** (`webshare/source.py`): Webshare matches file names only,
so the file name becomes the release title and its extension the format.
Queries are title + author, then title only, or the manual query.
Results are filtered to the configured `SUPPORTED_FORMATS` /
`SUPPORTED_AUDIOBOOK_FORMATS`, plus `zip`/`rar` for audiobooks, since
they are usually uploaded as archives. Password-protected files are
skipped. The language is guessed from tags in the name (`CZ`, `SK`,
`ENG`, ...), and the vote balance is a sortable column. API failures
raise `SourceUnavailableError`.
- **Download** (`webshare/handler.py`): resolves a time-limited link per
attempt with `file_link`, then streams it into `TMP_DIR` with progress
and cancel support. Large audiobook archives are not buffered in memory.
- **Settings**: `WEBSHARE_ENABLED`, `WEBSHARE_USERNAME`,
`WEBSHARE_PASSWORD` (a `PasswordField`, already covered by the
`_PASSWORD` redaction in `genDebug.sh`), and `WEBSHARE_MAX_RESULTS`. The
`docs/environment-variables.md` section was added.

## Testing

- `tests/webshare/`: 31 offline tests. They cover md5-crypt vectors,
password hashing, XML parsing, token reuse and re-login, non-retried
file errors, availability gating, format filtering, query fallback,
release mapping, language guessing, and the handler's streaming,
small-file rejection, link errors and cancel.
- `ruff check` and `ruff format --check` are clean. The rest of the unit
suite fails the same way with and without this change: Windows-only
tests on my machine.
- Verified live against webshare.cz: search parsing and the salt
endpoint's error path.
- Still a draft: I haven't yet verified login and download with a real
account.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-22 20:30:01 -04:00
splitsec2InfiniteAvengerCaliBrain
 		48ae3dbef4 feat: optional Hardcover wishlist sync with automated downloading (1 of 5) (#1516) 
This replaces #1047, which @InfiniteAvenger opened and calibrain offered
to re-review. It is Caleb's feature commit with his authorship kept,
rebased onto current main, with small fixes, tests and a docs page on
top. Everything is opt-in and off by default, so nothing changes for
anyone who doesn't turn it on.

What it adds is a **Settings, Hardcover Sync** tab with three parts that
can be switched on separately:

- **Shelf sync**: a Hardcover shelf (Want to Read by default) is pulled
into requests on a schedule, or with a Sync now button. Requests carry
the Hardcover metadata and cover.
- **Automatic downloads**: synced requests are approved and a release is
picked from a source priority list. A strict title, author and format
match (plus a seeder minimum for torrents) decides, so anything without
a confident match stays pending for manual review.
- **Skip books you already own**: sync and automatic downloads ask
whichever libraries are enabled under Library Check (Calibre today) and
skip a book that is already there.

On top of Caleb's commit I made the request owner a lookup instead of
assuming user id 1, sent synced cover URLs through the proxy when the
request is created, got ruff and basedpyright clean, and added tests and
`docs/hardcover-sync.md`. His commit also had its own Audiobookshelf
settings and a Test library connection button, written before the
library check was split into providers. The button would have raised a
TypeError against the current `test_connection`, so those settings are
gone from this tab and an Audiobookshelf provider comes as a separate
PR, which is the part of #1047 that is missing here (for now
anyways...).

I've run this daily for about a couple of weeks. Ruff, basedpyright and
the backend suite pass (4426 passed).

This is 1 of 5. As calibrain suggested, the rest are stacked on this
one, each saying which number it is.

Closes
https://github.com/calibrain/shelfmark/pull/1047#issuecomment-6302071588

---------

Co-authored-by: InfiniteAvenger <calebewest02@gmail.com>
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-22 20:27:47 -04:00
splitsec2andCaliBrain 72b5d04939 perf: cut repeated work on the status and activity paths (#1545) 
Two small cuts to work that repeats on every poll or request.

The delivery-state sync behind /api/status and the activity snapshot
listed every fulfilled request (SELECT * plus a JSON parse of book_data
and release_data per row) before it looked at the queue. That history is
never purged, so an idle instance paid for it on every poll. It now
returns straight away when no queue bucket holds a task, since nothing
could map to a request then. Results and emitted updates are unchanged.
The activity snapshot gains less from this, because its status merges
download history rows, so it is usually not empty.

In proxy auth mode the before-request hook looked the user up by name
and by session id on every API call, cover images included, each on a
new SQLite connection. UserDB.get_user_cached answers repeat lookups
from memory for up to five seconds, bounded at 256 entries. create_user,
update_user and delete_user drop the cache as soon as they commit, and a
lookup that overlaps a write is not stored, so a role change or deletion
made in the app applies on the next request. Changes made outside that
UserDB instance (another process, or the separate instances some helpers
open) show within the five seconds. Only the middleware uses the cached
path; every other get_user caller is unchanged.

Each change has a test that failed before it: one counts list_requests
calls for an empty queue, the others count get_user calls across
repeated lookups and middleware runs, check expiry with a patched clock,
and check that writes and caller mutations do not leave a stale row
behind. The full suite passes (4432 passed, 48 skipped, e2e excluded),
as do ruff and basedpyright on the changed files.

I also looked at throttling the full status_update broadcast when only
the progress message changes during torrent and usenet polling, and left
it out. Those handlers poll every 2 seconds and
DOWNLOAD_PROGRESS_UPDATE_INTERVAL defaults to 1 second, so a throttle on
that interval would skip nothing at the default setting. A longer window
would slow the speed and ETA text in the UI, and without a trailing
flush it would hide the last message of a quick burst, such as "Waiting
for bot response" arriving just after "Requesting file from bot", for
the whole wait that follows.

---------

Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-22 20:27:07 -04:00
splitsec2andCaliBrain 237ddd53a2 fix(redaction): a non-admin's status message loses the links it quotes (#1541) 
#1422 hid `source_id` and the download path from non-admins but left the
status message alone. A failed add stores the client's exception text
there, for example `401 Client Error: Unauthorized for url: <full url>`,
and for a requests error that URL carries the path and query: an indexer
key, a tracker passkey, a peer name. It reached the owner through
`/api/status`, `/api/activity` and the `status_update` socket event.

`redact_download_payload` now replaces every link in `status_message`
with `(link removed)`. That covers the live queue, the socket push and
the history snapshot, since all three go through it. Messages without a
link are unchanged and admins still see the full text.

Tests cover the payload, a whole status snapshot, and messages that must
stay as they are. They fail on main and pass here.

Found in a Claude pass over 1.5.0.

---------

Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-22 20:26:47 -04:00
splitsec2 a430341a93 perf: cut repeated work on search and cover paths (#1544) 
I went through what Shelfmark does per search and per cover and measured
the pieces that showed up. Four of them are cheap to fix, so this is one
PR. Shelfmark runs on a single gevent worker, so any of these blocks
every other request while it runs, and I'm assuming a lot of people run
it on small hardware (a Pi, say).

Cover cache. Every cache hit rewrote the whole `cache_index.json` just
to bump the entry's last-access time. On my box that is 3.7 ms of CPU
per hit at 500 entries and about 100 ms at 15,000 (2.2 MB written each
time), and a results page asks for around 40 covers. The access time now
stays in memory and the index is written at most every 30 seconds, or
whenever something else saves it. A crash inside that window loses some
access times, which only changes eviction order.

Settings reload. `config.refresh()` rebuilt the cache by reading and
parsing a tab's JSON file once per field, so about 250 parses per
refresh, 100 ms of CPU, and the metadata search, providers and config
routes each trigger it. It now reads each file once per rebuild (several
tabs share `settings.json`, so the memo is keyed on the file path).

Library match. When the library check is on, each search result is
compared against every library entry, and the title was split into words
again for every entry. The words are now computed once per result. I
measured 33 ms per result at 5,000 library entries and 106 ms at 20,000,
which is a second or more per page of 40 results. The matching itself is
unchanged.

Cover URL probe. `is_covers_cache_enabled()` creates and deletes a file
in the config directory to check it is writable, and it runs for every
cover, queue task and history row. The answer is remembered for 60
seconds. The probe is 0.045 ms on its own, but it is called a few
hundred times per request in the worst case.

Each change has a test that fails without it (call counts on the index
saves, file opens during a refresh, tokenisation calls, and probe
calls). Ruff, basedpyright on the changed files and the non-e2e suite
pass. The timings are from a dev machine with an empty config, so the
real numbers depend on cache and library size.
 2026-10-22 20:24:57 -04:00
splitsec2 2668705bfa perf: reuse connections and cache Anna's Archive download counts (#1546) 
Two small changes that stop Shelfmark from opening a new HTTPS
connection for requests that go to the same host over and over.

Anna's Archive download counts. Every search result gets its count from
`/dyn/md5/inline_info/<md5>`, and each of those was a bare
`requests.get`, so a search with 50 results opened 50 TCP and TLS
connections to the mirror. `search_books` also runs once per title
variant, and the variants of one book mostly find the same files, so the
same md5 was looked up again for every variant that found it, and again
when the release list was reopened. The lookups now share one
`requests.Session`, and a successful count is kept for five minutes in a
bounded `CacheService` (the same class the metadata cache uses, as its
own instance, so it does not depend on the metadata cache toggle). A
lookup that fails or comes back without a count is not cached, so it is
retried on the next search just like today. The URL, headers and 5
second timeout are unchanged.

Debrid clients. Real-Debrid, AllDebrid, Debrid-Link and TorBox also used
the bare `requests` helpers. The download handler polls `get_status`
every two seconds for each active job, so every poll was a fresh TLS
handshake with the debrid API. Each of those modules now keeps one
`requests.Session` and sends its API calls through it, the way the
qBittorrent, Deluge, Prowlarr and Newznab clients already do. Headers,
timeouts, `verify` and error handling are still passed per call exactly
as before. The existing tests that patched
`<module>.requests.get/post/request` now patch
`<module>._session.<verb>` instead; nothing else in them changed.

How I checked it: each change has a test that fails on main and passes
here. They count the requests that reach `requests.Session.request` and
the sessions built while doing it, with no network. On main, three polls
of each debrid client build three sessions, and two overlapping batches
of AA results look `bbb` up twice. There are also tests for the count
cache expiring (with a faked clock) and for a failed lookup not being
cached. Full suite: 4432 passed, 48 skipped. ruff and basedpyright are
clean on the changed files.

I also looked at caching `/api/releases` on the server and left it out.
The release modal already caches each book's results per source and
content type in the browser for five minutes (longer for IRC and slskd
through `cache_ttl_seconds`), and that cache survives closing and
reopening the modal, so reopening it does not run a new search today. A
server cache would only help after a page reload, and it would quietly
undo the modal's "apply filters" and manual search refetches, which drop
the browser cache on purpose, unless the frontend also learned to send a
bypass. That did not seem worth it for this PR.
 2026-10-22 20:24:40 -04:00
splitsec2 08fdb7ea87 fix(startup): the reconcile guard catches the same errors the rest of main.py does (#1540) 
The start-up reconcile runs at import, before the coordinator starts,
inside a try that named five exception types and left out `TypeError`.
`main.py` already defines `_IMPORT_OPERATIONAL_ERRORS` for this shape
and the other module-level guards use it, so this switches to it. An
unexpected `TypeError` from the reconcile would otherwise fail the
import of `shelfmark.main`, and the worker would fail to boot on every
restart.

I didn't use `except Exception` because BLE001 is on and nothing in
main.py does.

The test reloads main with the reconcile raising `TypeError`, and with
`OSError` as the control (that one already passes on main). Full non-e2e
suite passes, ruff and basedpyright are clean.

Found in a Claude pass over 1.5.0.
 2026-10-22 20:22:21 -04:00
splitsec2 f560b31ee4 fix(db): wait up to 30 s for a busy writer instead of SQLite's 5 s default (#1539) 
The users, download history and activity view-state databases open their
connections with SQLite's default busy timeout of 5 seconds. A start-up
migration, the restart reconcile, or any statement that overlaps a
backup or a second process raised "database is locked" after 5 seconds,
and the reconcile finished only part of its work.

One shared `DB_BUSY_TIMEOUT_SECONDS` (30) in `core/utils.py`, used by
all three. The test reads SQLite's `busy_timeout` pragma back from each
connection, so it doesn't need a real lock fight.

I left `UserDB.initialize()` without a guard on purpose. With 30 seconds
the wait covers a backup, and swallowing a schema failure there would
hide a worker that can't run.

Found in a Claude pass over 1.5.0.
 2026-10-22 20:21:49 -04:00
splitsec2 2d9491e063 docs(settings): say that the per-source limit replaces Max Concurrent Downloads (#1542) 
With Max Concurrent Downloads Per Source above 0 the download pool is
sized per source and a task is admitted when its own source is below the
limit. Max Concurrent Downloads isn't read at all in that mode, so 3 per
source across 3 busy sources runs 9 at once. Neither description said
so.

The per-source text now says it replaces the global limit and what the
total can be, and the global one says it isn't used while the per-source
limit is set. Text only, no behaviour change.

I changed the two rows in `docs/environment-variables.md` by hand.
Running `scripts/generate_env_docs.py` on main today also drops the
`SHELFMARK_API_KEY_READONLY` entries and changes the slskd anchor, so
the file looks hand-edited since it was last generated, and I didn't
want to fold that into this. The two rows match what the generator
produces for them.

Found in a Claude pass over 1.5.0.
 2026-10-22 20:20:56 -04:00
splitsec2 e27fed1d40 fix(queue): a late progress update no longer reopens a finished task (#1538) 
#1429 made the first terminal status win, but the guard only refused
terminal to terminal changes. A worker's poll that reports DOWNLOADING
after a cancel still overwrote CANCELLED (the poll loop calls the status
callback before it waits on the cancel flag), and the COMPLETE or ERROR
that followed was then accepted as a first terminal status, so the
terminal hook ran a second time.

This refuses any status change away from a terminal status. `add()` and
`enqueue_existing()` reset the status themselves, so retries are
unaffected.

The new test cancels a downloading task, sends DOWNLOADING and then
COMPLETE, and expects CANCELLED and one hook call. It fails on main and
passes here. Full non-e2e suite passes, ruff and basedpyright are clean.

Found in a Claude pass over 1.5.0, same as my other small fixes from it.
 2026-10-22 20:19:16 -04:00
splitsec2 395c331b4a fix(search): give each provider its own slice of the search budget (#1537) 
Fixes #1531.

All Direct Download providers share the one search budget
(`RELEASE_SEARCH_TIMEOUT`, 300s). Anna's Archive runs first, and when
its bypass keeps failing the retries use up the whole budget. OceanofPDF
then sees an expired deadline, skips its queries, and the search raises
Anna's Archive's error even though OceanofPDF never got a turn.

I didn't split the budget evenly, since the deadline module itself says
a cold-start Anna's Archive solve can legitimately take 60 to 120s and a
150s or 37s slice would break setups that work today. Instead
`search_deadline.unit_deadline(waiting=n)` opens a child deadline for
one unit of work. It gets the parent's remaining time minus 30s for each
unit still waiting, never less than 30s and never more than the parent
has left. A single provider still gets everything, a fast provider's
unused time rolls on to the next, and a stuck one stops at its own limit
with the reserve intact.

It's used in the provider loop in `DirectDownloadSource.search`, and in
the source loop in `/api/releases` since it's the same shape and four
lines. With several sources enabled the first one now gets 30s less per
source behind it, which is still well above a cold solve for the usual
two or three.

Tests: a stuck first provider no longer starves the second (fails on
main, passes here), a lone provider gets the full budget, and a child
never outlives its parent. Two existing tests in
`test_releases_api_budget.py` tripped the deadline in force from inside
the source, which is now the child, so they use a short request budget
instead. ruff, basedpyright on the changed files and the non-e2e suite
are clean.

OceanofPDF is inactive on my own instance (no mirror URL set), so I
haven't reproduced this live. It's verified by reading the code and by
the tests. I had Claude do the pass on this one.
 2026-10-22 20:17:44 -04:00
splitsec2 8e425da527 refactor: one default and one reader for the Supported Book Formats list (#1532) 
The default for Supported Book Formats (`epub, mobi, azw3, fb2, djvu,
cbz, cbr`) was written out in five places: the settings registry,
`postprocess/policy.py`, `irc/parser.py`, Prowlarr's `source.py` (added
in #1490) and slskd's `source.py` (added in #1428). Both of those two
arrived in 1.5.0, and both are mine, so this is cleaning up after myself
as much as anything.

The setting was also read three different ways. Post-processing split on
commas only. slskd split on commas and spaces and stripped a leading
dot. IRC split on commas and kept the dot. Prowlarr split on commas and
kept `""` as a format when the value was an empty string. So `.epub` or
`epub mobi` worked in one source and not another.

This puts `DEFAULT_EBOOK_FORMATS` and `normalize_format_list` in
`core/utils.py` next to `AUDIOBOOK_FORMATS`, and the registry,
post-processing, IRC, Prowlarr and slskd all use them. I took the most
lenient reading of the three (comma or space split, leading dot dropped,
empties ignored, default when nothing is left), so no existing config
gets stricter. I put the reader in `core/utils.py` and not in
`policy.py` because the release sources can't import `policy` without
pulling in the whole post-processing package.

A config with a sensible list reads exactly as before. The only
differences are for malformed values: an emptied setting or an empty
string now falls back to the default in every place, where IRC used to
filter everything out and Prowlarr treated `""` as a format.

The audiobook default is a separate story and I left it alone: the
registry and slskd default to every processable audiobook format plus
the archives, while post-processing and IRC fall back to `m4b, mp3`.
They only differ when the setting is unset or emptied, but they do
differ, and I'd rather ask which one you want than pick one here.

Ruff, basedpyright on the changed files and the backend suite pass (4400
passed, e2e not run). New tests cover the reader and the two fallbacks.
 2026-10-22 15:32:00 -04:00
Amalkrishna A SandCaliBrain a11a63a29e feat(notifications): add {User}/{Email} placeholders to per-user routes (#1499) 
Closes #1130.

Per-user notification route URLs can now use `{Email}` and `{User}`,
filled in from each user's account at send time, the same way `{User}`
already works in destination paths. One default route like
`mailtos://user:pass@smtp.example.com?to={Email}` now reaches every user
at their own address, with no per-user setup.

- Values are URL-encoded (`alice+books@example.com` keeps its `+`);
placeholders are case-insensitive.
- A route that needs a value the user doesn't have (e.g. no email on
file) is skipped for that user; other routes still send.
- The user lookup only runs when a route contains a placeholder.
- The personal "Test notification" button expands the placeholders too,
so testing a `{Email}` route works.
- Added to the routes setting help, `docs/users-and-requests.md`, and
tests.

@calibrain ready for review.

---------

Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-22 15:29:34 -04:00
dependabot[bot] 182e80f894 build(deps): bump publicsuffixlist from 1.1.0.20261017 to 1.1.0.20261018 (#1527) 
Bumps [publicsuffixlist](https://github.com/ko-zu/psl) from
1.1.0.20261017 to 1.1.0.20261018.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/ko-zu/psl/commits">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=publicsuffixlist&package-manager=uv&previous-version=1.1.0.20261017&new-version=1.1.0.20261018)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-22 03:21:05 -04:00
CaliBrain c5af6b9ae6 ci(jules): review the whole PR diff, not just the latest push (#1529) 
jules-pr-reviewer v0.0.2 reviewed only before...head on synchronize.
After
"Update branch" merged main into fork PRs, that range was main's
commits, so
of their own changes. v0.0.3 of the calibrain fork always reviews the
PR's
full diff. Also correct the fork workflow comment: jules-forks has no
required reviewers by design, so runs don't wait for approval.
 2026-10-22 03:20:45 -04:00
dbdefaultdbdefaultCaliBrain
 		c43da4537d fix(network): apply HTTP proxy to Open Library and Prowlarr requests (#1526) 
Fixes #1524

Open Library metadata searches and Prowlarr API calls used
`get_ssl_verify` but never `get_proxies`, so the HTTP proxy set in
Settings → Network was not applied to their HTTPS requests. Both now
pass the configured proxies. Relying on `requests`' `trust_env` with
only `HTTP_PROXY` set leaves the same gap for `https://` destinations.

Verification (Linux, `uv run --frozen pytest`):
- New tests `tests/metadata/test_openlibrary_proxy.py` and
`tests/prowlarr/test_api_proxy.py`: 4 passed. With the source change
reverted they fail (2 failed, 2 errors).
- `tests/metadata` + `tests/prowlarr`: 949 passed, 42 skipped.
- The full suite in my environment showed 61 failures and 26 errors
outside these areas. I did not compare them against `main`, so I'm not
claiming the full suite is green here; CI will show it.
- `ruff check` and `ruff format --check` on the changed files pass.

Prepared with AI assistance; reviewed and tested by me before
submitting.

Co-authored-by: dbdefault <246079841+dbdefault@users.noreply.github.com>
Co-authored-by: CaliBrain <calibrain@l4n.xyz>
 2026-10-22 02:47:43 -04:00
CaliBrain 9d5bcf0c58 ci(jules): review fork PRs through a gated pull_request_target workflow (#1528) 
Fork PRs get no secrets under pull_request and Dependabot runs get only
Dependabot secrets, so JULES_API_KEY was empty and every such run failed
at
config. The same-repo workflow now skips them, and a new
pull_request_target
workflow reviews fork PRs behind maintainer approval on the jules-forks
environment, without checking out PR code. Both use calibrain's fork of
jules-pr-reviewer, since upstream refuses pull_request_target.
 2026-10-22 02:40:50 -04:00
CaliBrain d887942630 fix(search): name the proxy when a gateway cuts a search off (#1522) 
A reverse proxy whose read timeout is shorter than the release search
budget
(nginx defaults to 60s) answers a slow search with its own 504 page.
describeSearchFailure found no server message there and fell back to
"Unable to reach download source. Network may be restricted or mirrors
blocked.", which sent users off changing mirrors (discussion #1520).

- 504 and Cloudflare's 524 now say the proxy stopped waiting and that
its
  read timeout should be at least the release search timeout.
- A 502/503 with a non-JSON body keeps fetchJSON's "Server unavailable"
  wording instead of the mirrors line.
- docs: the root-path nginx example sets proxy_read_timeout and
  proxy_send_timeout like the subpath ones, and a new troubleshooting
  section covers searches that time out behind a proxy.
 2026-10-22 01:40:00 -04:00
CaliBraingoogle-labs-jules[bot]calibrain
 		eab8f7bc9a Add Advanced Jules PR Reviewer action (#1523) 
This PR adds the Advanced Jules PR Reviewer workflow to automatically
review PRs. It is configured to run on forks automatically as requested
by setting `skip_forks: false`. JULES_API_KEY and GITHUB_TOKEN are
mapped correctly as per documentation.

---
*PR created automatically by Jules for task
[10601196597817548410](https://jules.google.com/task/10601196597817548410)
started by @calibrain*

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: calibrain <191882101+calibrain@users.noreply.github.com>
 2026-10-21 14:25:27 -04:00
CaliBrain 1aa9846f22 fix(download): trust a pinned AA mirror and repair the full e2e profile (#1518) 
The destination guard from the oceanofpdf/SSRF fix (f837506) trusts only
hosts in
the mirror lists and refuses any other host that resolves to a private
address.

The full e2e profile has failed on every PR since then: its AA mirror
was mock-aa,
but the slow-download links pointed at cf.mock.test (172.30.0.11). The
guard refused
the slow-download page before the internal Chrome bypasser ever started,
so the
download ended with "All download sources failed". Adding cf.mock.test
as a second
AA mirror would not help: AAMirrorSelector.rewrite would then move the
gated link
onto mock-aa, and the test would pass without Chrome solving anything.
The profile
now uses the gate as its only AA mirror. The cloudflare mock takes
CF_GATED_PATHS,
and the full profile challenges only /slow_download/, so search, detail
and the
final file pass through while the download still needs Chrome. The
unused
SLOW_DOWNLOAD_BASE indirection is gone.

The same allowlist missed a supported setup: Primary Mirror
(AA_BASE_URL) may pin a
URL that is not in the mirror list, and network uses it as the active AA
base. With
it on a LAN address, every AA request was refused. The guard now trusts
the pinned
URL too (mirrors.get_pinned_aa_base_url), and
has_aa_mirror_configuration reuses
the same helper.

download_url also ran the guard a second time outside its try block,
which repeated
the DNS lookup and could raise instead of returning None. The duplicate
call is gone.
v1.5.0 		2026-10-21 11:19:48 -04:00