renovate-bot commented

Collaborator

This PR contains the following updates:

Package	Update	Change
ghcr.io/calibrain/shelfmark	minor	`v1.6.1` → `v1.7.0`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

calibrain/shelfmark (ghcr.io/calibrain/shelfmark)

`v1.7.0`: : Clear Signals

Compare Source

A release about the Activity list and the request flow. Failed downloads say what went wrong and what happens next, admins can see what was declined and reopen it, and two background sweeps tidy up after stalled torrents and interrupted Soulseek downloads.

Activity and requests

A failed or cancelled download says in plain words what happened and what happens next (another copy is tried in a few minutes, or use Retry) instead of showing the raw log line. Each Soulseek failure gets its own sentence (#1617) (@splitsec2)
Cards are easier to read. Each one shows a format pill (violet for audiobooks, orange for ebooks), names the requester once and says how long a finished download took and how long ago it ended. A download that picked up work already under way shows a Reattached pill (#1618) (@splitsec2)
Admins get a Rejected view next to History that shows who declined each request and when, with Reopen on each card and a way to hide the ones you are done with. An admin can also reopen a fulfilled request whose download failed or was cancelled, and the next search skips the release that failed. "Needs Review" is now "No Match Yet", and a request declined automatically says so (#1618) (@splitsec2)
Clear Completed also clears requests that finished without a download, such as one auto-download closed because the book was already in the library, and it now shows on the Requests tab too (#1650) (@splitsec2)
A new setting, Allow book requests alongside downloads (off by default, can be set per user), lets users in Download mode request a book that has nothing to download yet. Admins can always do this. Thanks @expostarv2 for the original request (#1579, closes #995) (@splitsec2)

Fixes

With automatic downloads on, a request from a user whose downloads need approval now waits for an admin instead of being approved by the automatic pass. Requests are only searched on the sources where their owner could download directly (#1676) (@splitsec2)
When a request's download fails because the download client refused the login, Retry offers the same release again instead of showing it as Failed, and the release isn't remembered as bad. qBittorrent login failures now say so. Thanks @joshft91 for the report and the steps (#1677, fixes #1674) (@splitsec2)
With a proxy set in Settings → Network, the Anna's Archive download counts on search results now go through it too, instead of about 50 requests per search leaving from your own address. Thanks @kris-anderson for finding and fixing it (#1686, fixes #1685)

Downloads that tidy up after themselves

Both sweeps run every 15 minutes, whether or not Hardcover sync is on.

Dead torrents (qBittorrent). A torrent Shelfmark added that has been stalled or stuck fetching metadata for 6 hours, with no download watching it, is removed with its partial data. This is on by default. Torrents you added yourself are never touched, and neither is anything downloading, queued or finished. Set Remove dead torrents after (hours) to 0 to turn it off (#1619) (@splitsec2)
Soulseek leftovers. With isolated slskd downloads on, a finished folder that a restart stopped from being imported is now imported, and a transfer no download is watching any more is picked up again if its request still needs it. This is on by default. Removing old leftover folders is a separate setting, Remove leftover download folders after (days), which is off by default (#1619) (@splitsec2)

Soulseek chat replies

An opt-in setting, SLSKD_CHAT_AUTOPROVE, answers the "type this word to download" messages some Soulseek uploaders send before they will share. It replies at most once per user every 12 hours and logs each reply. It is off by default because it sends messages for you. The idea and the message patterns come from @Nezreka's SoulSync (#1591) (@splitsec2)

Under the hood

CodeRabbit is now listed as a project sponsor in the readme. Thanks @calibrain (#1682)
Python dependency updates (#1679, #1680)

Full Changelog: https://github.com/calibrain/shelfmark/compare/v1.6.2...v1.7.0

`v1.6.2`: : Sanding the Edges

Compare Source

A small one. Fixes and housekeeping, and nothing that changes how Shelfmark behaves day to day. A few of these were bugs people reported on phones, Firefox and behind a reverse proxy, and the rest is tightening up around errors, logins and the secret key.

Fixes

The page no longer goes blank in Firefox when you hover the Stop download button on an in-progress download in the Activity sidebar. Thanks @calibrain, and @TheRealBomber for the report (#1651, fixes #1646)
The release source tabs in Find Releases get their own row on phones, so Direct Download is no longer cut off when more than one source is set up. Thanks @mietu111 for the report and the screenshot (#1663, fixes #1662) (@splitsec2)
An HTTPS Transmission address with no port now connects on 443 instead of 9091, so a Transmission published through a reverse proxy works without adding the port. HTTP addresses still default to 9091. Thanks @mvanhorn, and @lbesnard for the report (#1673, fixes #1667)
When a download fails and its request reopens on its own, the failed release is remembered so the next search doesn't pick it again. A download that failed only because the client couldn't be reached isn't held against the release (#1655) (@splitsec2)
The Debug and Restart menu items only show to admins. Regular users used to see them with Debug Mode on and got a 403 when they clicked one. With auth off both items are still there (#1653) (@splitsec2)

Security and hardening

Unexpected errors in the queue, release, metadata and debug endpoints return a short fixed message instead of the raw error text, which could carry file paths or URLs with tokens. The full error still goes to the log (#1643) (@splitsec2)
The secret key file is created private from the start, instead of being written first and tightened afterwards (#1659) (@splitsec2)
A login that lands at the same moment as the lockout cleanup no longer makes that cleanup fail (#1658) (@splitsec2)

The image

Chromium is now 156.0.8078.79, installed from Debian's trixie-security without a pinned snapshot, so it follows what Debian ships instead of going stale (#1648, closes #1635) (@splitsec2)
oauthlib 4.0.1 for CVE-2026-49272 (#1668). The bug is in oauthlib's server code, which Shelfmark never runs (Apprise only uses it as a client), so no install was exposed
A round of Python, Docker base image and GitHub Actions dependency bumps

Under the hood

Docstrings for the route modules that moved out of main.py in v1.6.1 (#1660) (@splitsec2), and a type fix for download_url that got the typecheck job green again (#1649) (@splitsec2)

Full Changelog: https://github.com/calibrain/shelfmark/compare/v1.6.1...v1.6.2

Configuration

📅 Schedule: (in timezone Europe/Rome)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/calibrain/shelfmark](https://github.com/calibrain/shelfmark) | minor | `v1.6.1` → `v1.7.0` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/6) for more information. --- ### Release Notes <details> <summary>calibrain/shelfmark (ghcr.io/calibrain/shelfmark)</summary> ### [`v1.7.0`](https://github.com/calibrain/shelfmark/releases/tag/v1.7.0): : Clear Signals [Compare Source](https://github.com/calibrain/shelfmark/compare/v1.6.2...v1.7.0) A release about the Activity list and the request flow. Failed downloads say what went wrong and what happens next, admins can see what was declined and reopen it, and two background sweeps tidy up after stalled torrents and interrupted Soulseek downloads. ##### Activity and requests - A failed or cancelled download says in plain words what happened and what happens next (another copy is tried in a few minutes, or use Retry) instead of showing the raw log line. Each Soulseek failure gets its own sentence ([#1617](https://github.com/calibrain/shelfmark/issues/1617)) ([@splitsec2](https://github.com/splitsec2)) - Cards are easier to read. Each one shows a format pill (violet for audiobooks, orange for ebooks), names the requester once and says how long a finished download took and how long ago it ended. A download that picked up work already under way shows a Reattached pill ([#1618](https://github.com/calibrain/shelfmark/issues/1618)) ([@splitsec2](https://github.com/splitsec2)) - Admins get a Rejected view next to History that shows who declined each request and when, with Reopen on each card and a way to hide the ones you are done with. An admin can also reopen a fulfilled request whose download failed or was cancelled, and the next search skips the release that failed. "Needs Review" is now "No Match Yet", and a request declined automatically says so ([#1618](https://github.com/calibrain/shelfmark/issues/1618)) ([@splitsec2](https://github.com/splitsec2)) - Clear Completed also clears requests that finished without a download, such as one auto-download closed because the book was already in the library, and it now shows on the Requests tab too ([#1650](https://github.com/calibrain/shelfmark/issues/1650)) ([@splitsec2](https://github.com/splitsec2)) - A new setting, **Allow book requests alongside downloads** (off by default, can be set per user), lets users in Download mode request a book that has nothing to download yet. Admins can always do this. Thanks [@expostarv2](https://github.com/expostarv2) for the original request ([#1579](https://github.com/calibrain/shelfmark/issues/1579), closes [#995](https://github.com/calibrain/shelfmark/issues/995)) ([@splitsec2](https://github.com/splitsec2)) ##### Fixes - With automatic downloads on, a request from a user whose downloads need approval now waits for an admin instead of being approved by the automatic pass. Requests are only searched on the sources where their owner could download directly ([#1676](https://github.com/calibrain/shelfmark/issues/1676)) ([@splitsec2](https://github.com/splitsec2)) - When a request's download fails because the download client refused the login, Retry offers the same release again instead of showing it as Failed, and the release isn't remembered as bad. qBittorrent login failures now say so. Thanks [@joshft91](https://github.com/joshft91) for the report and the steps ([#1677](https://github.com/calibrain/shelfmark/issues/1677), fixes [#1674](https://github.com/calibrain/shelfmark/issues/1674)) ([@splitsec2](https://github.com/splitsec2)) - With a proxy set in Settings → Network, the Anna's Archive download counts on search results now go through it too, instead of about 50 requests per search leaving from your own address. Thanks [@kris-anderson](https://github.com/kris-anderson) for finding and fixing it ([#1686](https://github.com/calibrain/shelfmark/issues/1686), fixes [#1685](https://github.com/calibrain/shelfmark/issues/1685)) ##### Downloads that tidy up after themselves Both sweeps run every 15 minutes, whether or not Hardcover sync is on. - **Dead torrents (qBittorrent).** A torrent Shelfmark added that has been stalled or stuck fetching metadata for 6 hours, with no download watching it, is removed with its partial data. **This is on by default.** Torrents you added yourself are never touched, and neither is anything downloading, queued or finished. Set **Remove dead torrents after (hours)** to 0 to turn it off ([#1619](https://github.com/calibrain/shelfmark/issues/1619)) ([@splitsec2](https://github.com/splitsec2)) - **Soulseek leftovers.** With isolated slskd downloads on, a finished folder that a restart stopped from being imported is now imported, and a transfer no download is watching any more is picked up again if its request still needs it. **This is on by default.** Removing old leftover folders is a separate setting, **Remove leftover download folders after (days)**, which is off by default ([#1619](https://github.com/calibrain/shelfmark/issues/1619)) ([@splitsec2](https://github.com/splitsec2)) ##### Soulseek chat replies - An opt-in setting, `SLSKD_CHAT_AUTOPROVE`, answers the "type this word to download" messages some Soulseek uploaders send before they will share. It replies at most once per user every 12 hours and logs each reply. It is off by default because it sends messages for you. The idea and the message patterns come from [@Nezreka](https://github.com/Nezreka)'s SoulSync ([#1591](https://github.com/calibrain/shelfmark/issues/1591)) ([@splitsec2](https://github.com/splitsec2)) ##### Under the hood - CodeRabbit is now listed as a project sponsor in the readme. Thanks [@calibrain](https://github.com/calibrain) ([#1682](https://github.com/calibrain/shelfmark/issues/1682)) - Python dependency updates ([#1679](https://github.com/calibrain/shelfmark/issues/1679), [#1680](https://github.com/calibrain/shelfmark/issues/1680)) **Full Changelog**: <https://github.com/calibrain/shelfmark/compare/v1.6.2...v1.7.0> ### [`v1.6.2`](https://github.com/calibrain/shelfmark/releases/tag/v1.6.2): : Sanding the Edges [Compare Source](https://github.com/calibrain/shelfmark/compare/v1.6.1...v1.6.2) A small one. Fixes and housekeeping, and nothing that changes how Shelfmark behaves day to day. A few of these were bugs people reported on phones, Firefox and behind a reverse proxy, and the rest is tightening up around errors, logins and the secret key. ##### Fixes - The page no longer goes blank in Firefox when you hover the Stop download button on an in-progress download in the Activity sidebar. Thanks [@calibrain](https://github.com/calibrain), and [@TheRealBomber](https://github.com/TheRealBomber) for the report ([#1651](https://github.com/calibrain/shelfmark/issues/1651), fixes [#1646](https://github.com/calibrain/shelfmark/issues/1646)) - The release source tabs in Find Releases get their own row on phones, so Direct Download is no longer cut off when more than one source is set up. Thanks [@mietu111](https://github.com/mietu111) for the report and the screenshot ([#1663](https://github.com/calibrain/shelfmark/issues/1663), fixes [#1662](https://github.com/calibrain/shelfmark/issues/1662)) ([@splitsec2](https://github.com/splitsec2)) - An HTTPS Transmission address with no port now connects on 443 instead of 9091, so a Transmission published through a reverse proxy works without adding the port. HTTP addresses still default to 9091. Thanks [@mvanhorn](https://github.com/mvanhorn), and [@lbesnard](https://github.com/lbesnard) for the report ([#1673](https://github.com/calibrain/shelfmark/issues/1673), fixes [#1667](https://github.com/calibrain/shelfmark/issues/1667)) - When a download fails and its request reopens on its own, the failed release is remembered so the next search doesn't pick it again. A download that failed only because the client couldn't be reached isn't held against the release ([#1655](https://github.com/calibrain/shelfmark/issues/1655)) ([@splitsec2](https://github.com/splitsec2)) - The Debug and Restart menu items only show to admins. Regular users used to see them with Debug Mode on and got a 403 when they clicked one. With auth off both items are still there ([#1653](https://github.com/calibrain/shelfmark/issues/1653)) ([@splitsec2](https://github.com/splitsec2)) ##### Security and hardening - Unexpected errors in the queue, release, metadata and debug endpoints return a short fixed message instead of the raw error text, which could carry file paths or URLs with tokens. The full error still goes to the log ([#1643](https://github.com/calibrain/shelfmark/issues/1643)) ([@splitsec2](https://github.com/splitsec2)) - The secret key file is created private from the start, instead of being written first and tightened afterwards ([#1659](https://github.com/calibrain/shelfmark/issues/1659)) ([@splitsec2](https://github.com/splitsec2)) - A login that lands at the same moment as the lockout cleanup no longer makes that cleanup fail ([#1658](https://github.com/calibrain/shelfmark/issues/1658)) ([@splitsec2](https://github.com/splitsec2)) ##### The image - Chromium is now 156.0.8078.79, installed from Debian's trixie-security without a pinned snapshot, so it follows what Debian ships instead of going stale ([#1648](https://github.com/calibrain/shelfmark/issues/1648), closes [#1635](https://github.com/calibrain/shelfmark/issues/1635)) ([@splitsec2](https://github.com/splitsec2)) - oauthlib 4.0.1 for CVE-2026-49272 ([#1668](https://github.com/calibrain/shelfmark/issues/1668)). The bug is in oauthlib's server code, which Shelfmark never runs (Apprise only uses it as a client), so no install was exposed - A round of Python, Docker base image and GitHub Actions dependency bumps ##### Under the hood - Docstrings for the route modules that moved out of `main.py` in v1.6.1 ([#1660](https://github.com/calibrain/shelfmark/issues/1660)) ([@splitsec2](https://github.com/splitsec2)), and a type fix for `download_url` that got the typecheck job green again ([#1649](https://github.com/calibrain/shelfmark/issues/1649)) ([@splitsec2](https://github.com/splitsec2)) **Full Changelog**: <https://github.com/calibrain/shelfmark/compare/v1.6.1...v1.6.2> </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Rome) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

renovate-bot added the

renovate/container

type/patch

labels

2026-11-08 23:02:03 +01:00

renovate-bot added 1 commit

2026-11-08 23:02:04 +01:00

fix(container): update image ghcr.io/calibrain/shelfmark (v1.6.1 ➔ v1.6.2)

Labeler / Labeler (pull_request) Successful in 6s

Details

Lint / actionlint (pull_request) Successful in 28s

Details

Lint / yamllint (pull_request) Successful in 29s

Details

AI PR Review / AI PR Review (pull_request) Successful in 3m12s

Details

Konflate 2 resources changed

Details

21f7525190

lab-assistant-bot commented

2026-11-08 23:02:06 +01:00

Collaborator

Routine: only container-image and chart-version changes; 2 resources across 2 apps

image	from	to	upstream
`ghcr.io/calibrain/shelfmark`	`v1.6.1@sha256:0e5c9f…`	`v1.7.0@sha256:6544e0…`	❔

_{konflate 0.6.6 · rendered 326b769 · full diff →}

**Routine**: only container-image and chart-version changes; 2 resources across 2 apps | image | from | to | upstream | |---|---|---|---| | `ghcr.io/calibrain/shelfmark` | `v1.6.1@sha256:0e5c9f…` | `v1.7.0@sha256:6544e0…` | ❔ | <sub>konflate 0.6.6 · rendered `326b769` · [full diff →](https://konflate.aresu.eu/#/pr/2615)</sub>

forgejo-actions added the

area/kubernetes

label

2026-11-08 23:02:11 +01:00

forgejo-actions commented

2026-11-08 23:05:16 +01:00

AI Automated Review

Analysis engine: (model unavailable) · pr-reviewer-action v3.8.0

AI review could not run

The configured model endpoint(s) did not return a usable review for this run (reason: Fallback model failed).

This is an automated notice, not a substantive review. Re-run the workflow once the endpoint is reachable; see the action logs for the underlying error.

# AI Automated Review _Analysis engine: (model unavailable) · pr-reviewer-action v3.8.0_ ## AI review could not run The configured model endpoint(s) did not return a usable review for this run (reason: Fallback model failed). This is an automated notice, not a substantive review. Re-run the workflow once the endpoint is reachable; see the action logs for the underlying error.

renovate-bot force-pushed renovate/ghcr.io-calibrain-shelfmark-1.x from 21f7525190

Labeler / Labeler (pull_request) Successful in 6s

Details

Lint / actionlint (pull_request) Successful in 28s

Details

Lint / yamllint (pull_request) Successful in 29s

Details

AI PR Review / AI PR Review (pull_request) Successful in 3m12s

Details

Konflate 2 resources changed

Details

to 326b7693a2

Labeler / Labeler (pull_request) Successful in 3s

Details

Lint / actionlint (pull_request) Successful in 15s

Details

Lint / yamllint (pull_request) Successful in 17s

Details

AI PR Review / AI PR Review (pull_request) Successful in 3m8s

Details

Konflate 2 resources changed

Details

2026-11-14 00:11:34 +01:00

Compare

renovate-bot changed title from ~~fix(container): update image ghcr.io/calibrain/shelfmark (v1.6.1 ➔ v1.6.2)~~ to feat(container): update image ghcr.io/calibrain/shelfmark (v1.6.1 ➔ v1.7.0)

2026-11-14 00:11:36 +01:00

Labeler / Labeler (pull_request) Successful in 3s

Details

Lint / actionlint (pull_request) Successful in 15s

Details

Lint / yamllint (pull_request) Successful in 17s

Details

AI PR Review / AI PR Review (pull_request) Successful in 3m8s

Details

Konflate 2 resources changed

Details

This pull request can be merged automatically.

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin "renovate/ghcr.io-calibrain-shelfmark-1.x:renovate/ghcr.io-calibrain-shelfmark-1.x"

git switch "renovate/ghcr.io-calibrain-shelfmark-1.x"

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch "main"

git merge --no-ff "renovate/ghcr.io-calibrain-shelfmark-1.x"

git switch "renovate/ghcr.io-calibrain-shelfmark-1.x"

git rebase "main"

git switch "main"

git merge --ff-only "renovate/ghcr.io-calibrain-shelfmark-1.x"

git switch "renovate/ghcr.io-calibrain-shelfmark-1.x"

git rebase "main"

git switch "main"

git merge --no-ff "renovate/ghcr.io-calibrain-shelfmark-1.x"

git switch "main"

git merge --squash "renovate/ghcr.io-calibrain-shelfmark-1.x"

git switch "main"

git merge --ff-only "renovate/ghcr.io-calibrain-shelfmark-1.x"

git switch "main"

git merge "renovate/ghcr.io-calibrain-shelfmark-1.x"

git push origin "main"

Rows
Columns

feat(container): update image ghcr.io/calibrain/shelfmark (v1.6.1 ➔ v1.7.0) #2615

Release Notes

v1.7.0: : Clear Signals

Activity and requests

Fixes

Downloads that tidy up after themselves

Soulseek chat replies

Under the hood

v1.6.2: : Sanding the Edges

Fixes

Security and hardening

The image

Under the hood

Configuration

AI Automated Review

AI review could not run

Checkout

Merge

`v1.7.0`: : Clear Signals

`v1.6.2`: : Sanding the Edges