mirror of
https://github.com/gesellix/Bose-SoundTouch.git
synced 2026-08-10 04:36:14 +00:00
v0.119.0
1049
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
  
|
31ba2bd9cd |
docs: document and consolidate Management API credential defaults (#586)
## Summary - Documents the default Management API credentials (`admin` / `change_me!`) right where the Local Account tab is introduced (`MUSIC-SERVICES.md`) — surfaced by #269, where the reporter was stuck at an unexplained login prompt. - Consolidates: the defaults now live in one place (`SOUNDTOUCH-SERVICE.md`'s existing Configuration Options table), with the other five mentions across the docs linking to it instead of restating the value independently. - Fixes two factual errors found while consolidating (`SELF-HOSTING.md`): it claimed there's no login by default (wrong — Basic Auth is always on with a published default) and that it protects the Settings tab (wrong — `/api/setup/*` isn't behind Basic Auth at all). Refs #269. ## Test plan - [x] Docs-only change; links verified against existing cross-file anchor conventions used elsewhere in the repo 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>v0.119.0 |
||
|
|
4a76805df4 |
feat(health): flag speakers whose runtime bmxRegistryUrl is still on the Bose cloud (#577)
## What
Adds a new `runtime_bmx_url_stale` health check to `soundtouch-service`.
For each reachable speaker it reads the **runtime** `bmxRegistryUrl`
(from the on-device `SoundTouchSdkPrivateCfg.xml` via SSH, or `getpdo
CurrentSystemConfiguration` over telnet) and warns when it still points
at the shut-down Bose cloud, offering a copy-paste re-migrate command.
## Why
Radio source types (TUNEIN / RADIO_BROWSER / LOCAL_INTERNET_RADIO) are
delivered to the speaker through the BMX registry. A speaker whose
runtime `bmxRegistryUrl` still names the Bose cloud can never mount
them, even though the service's own `/sources` listing is correct. The
existing `sources_xml_diff` check reports the *symptom* ("missing 3
source types"); this check reports the *per-device cause*, so an
operator sees exactly which speakers still need re-migrating.
This is the recurring "radio missing after migration" theme (relates to
#549, #547, #546, #493). In the #549 diagnostic, 6 of 9 speakers had
never actually been migrated (all four runtime URLs still on
`content.api.bose.io` / `streaming.bose.com`) while the service itself
looked healthy; this check would have surfaced that per device
immediately.
## False-positive guard
Under a DNS-based migration (AfterTouch acting as the speaker's DNS
server) a cloud URL is legitimate: the redirect happens at the DNS
layer, not by rewriting the on-device URL. So the check stays silent
while the service's own DNS interception is running (`GetDNSRunning`).
The router-DNS variant (the LAN's DNS points at AfterTouch without our
DNS server running) cannot be detected here, so it is called out as a
known exception in the finding text rather than suppressed.
## Changes
- `pkg/service/health/checks_runtime_bmx_url.go` (+ unit test): the
check, following the injected-closure pattern of `checks_marge_url.go`.
`assessRuntimeBmxURL` is the pure, testable core; `isBoseCloudHost` does
a domain-suffix match on the Bose cloud domains.
- `pkg/service/handlers/handlers_export.go`: a lightweight
`readSpeakerBmxRegistryURL(ip)` reader (SSH then telnet), reusing the
existing export imports. The diagnostic export path itself is unchanged.
- `pkg/service/handlers/server.go`: registers the check, wiring
`GetDNSRunning` as the guard.
The health package stays free of the SSH / `setup` imports (the reader
lives in the handlers layer), matching the existing dependency boundary.
## Testing
- `go test ./pkg/service/health/` green (new tests: cloud URL warns;
AfterTouch URL and empty URL do not; `isBoseCloudHost` matrix).
- `go vet` and `golangci-lint` clean on both packages; `go build
./cmd/soundtouch-service/` succeeds.
Not tied to a single issue to close; it complements the #549 / #547 /
#546 / #493 cluster as a diagnostic aid.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
|
bb9bce440e |
fix(admin): surface silent Management API auth failures, add link-state health checks (#585)
## Summary - #269's stuck Spotify presets traced to the account link never completing, invisible because the admin UI silently swallowed 401s from `/api/mgmt/*` instead of prompting for a retry. The browser's own Basic Auth caching already works correctly here (verified live); the bug was purely missing feedback. - Adds two Health-tab checks: Spotify configured but no account linked, and Management API credentials still at the published default. Refs #269, #419. ## Test plan - [x] `make check` (fmt, vet, unit tests) clean - [x] `make lint` clean - [x] Live-tested end to end with a headless Chrome (chromedp) against a local build: confirmed the new failure-path messages render correctly for `fetchSpotifyStatus`, `fetchAccountList`, and `linkSpotify` 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> |
||
 
|
a0f8b86922 |
ci(deps): bump the codeql-action group with 3 updates (#581)
Bumps the codeql-action group with 3 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action) and [github/codeql-action/upload-sarif](https://github.com/github/codeql-action). Updates `github/codeql-action/init` from 4.37.0 to 4.37.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>4.35.4 - 07 May 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/7188fc363630916deb702c7fdcf4e481b751f97a"><code>7188fc3</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4020">#4020</a> from github/update-v4.37.1-9e7c07009</li> <li><a href="https://github.com/github/codeql-action/commit/c8b5f69be686908c3dfd844428137d56fe80c936"><code>c8b5f69</code></a> Update changelog for v4.37.1</li> <li><a href="https://github.com/github/codeql-action/commit/9e7c070092090e89e8b3d62f977d4456e0732cd7"><code>9e7c070</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4014">#4014</a> from github/mbg/explicit-remote-prefix</li> <li><a href="https://github.com/github/codeql-action/commit/3492b7e9ab96e28b1d8b971345d30e929c6f8fee"><code>3492b7e</code></a> Change <code>REMOTE_PATH_PREFIX</code> to <code>remote=</code></li> <li><a href="https://github.com/github/codeql-action/commit/3654baa924bc6456db54002581cb7c1c877548c4"><code>3654baa</code></a> Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix</li> <li><a href="https://github.com/github/codeql-action/commit/2d682ac05f1b3588aaff3814826bede39b9ba6bb"><code>2d682ac</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4017">#4017</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/23f6a50753a88efd9b7ae8687b29f6bdb65f6250"><code>23f6a50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4009">#4009</a> from github/mbg/action-state/additions</li> <li><a href="https://github.com/github/codeql-action/commit/1ee3c75d1988ab8621f01ebb165115c38d56df91"><code>1ee3c75</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4018">#4018</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/e053684dc500899b0b5520edc8549ac0f1ed730b"><code>e053684</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4015">#4015</a> from github/dependabot/npm_and_yarn/npm-minor-fd2e83...</li> <li><a href="https://github.com/github/codeql-action/commit/6803c5671d2f87a83ed96e151c441b1cb3bdc66a"><code>6803c56</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4019">#4019</a> from github/update-bundle/codeql-bundle-v2.26.1</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.0 to 4.37.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>4.35.4 - 07 May 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/7188fc363630916deb702c7fdcf4e481b751f97a"><code>7188fc3</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4020">#4020</a> from github/update-v4.37.1-9e7c07009</li> <li><a href="https://github.com/github/codeql-action/commit/c8b5f69be686908c3dfd844428137d56fe80c936"><code>c8b5f69</code></a> Update changelog for v4.37.1</li> <li><a href="https://github.com/github/codeql-action/commit/9e7c070092090e89e8b3d62f977d4456e0732cd7"><code>9e7c070</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4014">#4014</a> from github/mbg/explicit-remote-prefix</li> <li><a href="https://github.com/github/codeql-action/commit/3492b7e9ab96e28b1d8b971345d30e929c6f8fee"><code>3492b7e</code></a> Change <code>REMOTE_PATH_PREFIX</code> to <code>remote=</code></li> <li><a href="https://github.com/github/codeql-action/commit/3654baa924bc6456db54002581cb7c1c877548c4"><code>3654baa</code></a> Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix</li> <li><a href="https://github.com/github/codeql-action/commit/2d682ac05f1b3588aaff3814826bede39b9ba6bb"><code>2d682ac</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4017">#4017</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/23f6a50753a88efd9b7ae8687b29f6bdb65f6250"><code>23f6a50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4009">#4009</a> from github/mbg/action-state/additions</li> <li><a href="https://github.com/github/codeql-action/commit/1ee3c75d1988ab8621f01ebb165115c38d56df91"><code>1ee3c75</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4018">#4018</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/e053684dc500899b0b5520edc8549ac0f1ed730b"><code>e053684</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4015">#4015</a> from github/dependabot/npm_and_yarn/npm-minor-fd2e83...</li> <li><a href="https://github.com/github/codeql-action/commit/6803c5671d2f87a83ed96e151c441b1cb3bdc66a"><code>6803c56</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4019">#4019</a> from github/update-bundle/codeql-bundle-v2.26.1</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/upload-sarif` from 4.37.0 to 4.37.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/upload-sarif's releases</a>.</em></p> <blockquote> <h2>v4.37.1</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/upload-sarif's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <h2>4.36.1 - 02 Jun 2026</h2> <p>No user facing changes.</p> <h2>4.36.0 - 22 May 2026</h2> <ul> <li><em>Breaking change</em>: Bump the minimum required CodeQL bundle version to 2.19.4. <a href="https://redirect.github.com/github/codeql-action/pull/3894">#3894</a></li> <li>Add support for SHA-256 Git object IDs. <a href="https://redirect.github.com/github/codeql-action/pull/3893">#3893</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.5">2.25.5</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3926">#3926</a></li> </ul> <h2>4.35.5 - 15 May 2026</h2> <ul> <li>We have improved how the JavaScript bundles for the CodeQL Action are generated to avoid duplication across bundles and reduce the size of the repository by around 70%. This should have no effect on the runtime behaviour of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3899">#3899</a></li> <li>For performance and accuracy reasons, <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> will now only be enabled on a pull request when diff-informed analysis is also enabled for that run. If diff-informed analysis is unavailable (for example, because the PR diff ranges could not be computed), the action will fall back to a full analysis. <a href="https://redirect.github.com/github/codeql-action/pull/3791">#3791</a></li> <li>If multiple inputs are provided for the GitHub-internal <code>analysis-kinds</code> input, only <code>code-scanning</code> will be enabled. The <code>analysis-kinds</code> input is experimental, for GitHub-internal use only, and may change without notice at any time. <a href="https://redirect.github.com/github/codeql-action/pull/3892">#3892</a></li> <li>Added an experimental change which, when running a Code Scanning analysis for a PR with <a href="https://redirect.github.com/github/roadmap/issues/1158">improved incremental analysis</a> enabled, prefers CodeQL CLI versions that have a cached overlay-base database for the configured languages. This speeds up analysis for a repository when there is not yet a cached overlay-base database for the latest CLI version. We expect to roll this change out to everyone in May. <a href="https://redirect.github.com/github/codeql-action/pull/3880">#3880</a></li> </ul> <h2>4.35.4 - 07 May 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.4">2.25.4</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3881">#3881</a></li> </ul> <h2>4.35.3 - 01 May 2026</h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/7188fc363630916deb702c7fdcf4e481b751f97a"><code>7188fc3</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4020">#4020</a> from github/update-v4.37.1-9e7c07009</li> <li><a href="https://github.com/github/codeql-action/commit/c8b5f69be686908c3dfd844428137d56fe80c936"><code>c8b5f69</code></a> Update changelog for v4.37.1</li> <li><a href="https://github.com/github/codeql-action/commit/9e7c070092090e89e8b3d62f977d4456e0732cd7"><code>9e7c070</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4014">#4014</a> from github/mbg/explicit-remote-prefix</li> <li><a href="https://github.com/github/codeql-action/commit/3492b7e9ab96e28b1d8b971345d30e929c6f8fee"><code>3492b7e</code></a> Change <code>REMOTE_PATH_PREFIX</code> to <code>remote=</code></li> <li><a href="https://github.com/github/codeql-action/commit/3654baa924bc6456db54002581cb7c1c877548c4"><code>3654baa</code></a> Merge remote-tracking branch 'origin/main' into mbg/explicit-remote-prefix</li> <li><a href="https://github.com/github/codeql-action/commit/2d682ac05f1b3588aaff3814826bede39b9ba6bb"><code>2d682ac</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4017">#4017</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/23f6a50753a88efd9b7ae8687b29f6bdb65f6250"><code>23f6a50</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4009">#4009</a> from github/mbg/action-state/additions</li> <li><a href="https://github.com/github/codeql-action/commit/1ee3c75d1988ab8621f01ebb165115c38d56df91"><code>1ee3c75</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4018">#4018</a> from github/dependabot/github_actions/dot-github/wor...</li> <li><a href="https://github.com/github/codeql-action/commit/e053684dc500899b0b5520edc8549ac0f1ed730b"><code>e053684</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4015">#4015</a> from github/dependabot/npm_and_yarn/npm-minor-fd2e83...</li> <li><a href="https://github.com/github/codeql-action/commit/6803c5671d2f87a83ed96e151c441b1cb3bdc66a"><code>6803c56</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4019">#4019</a> from github/update-bundle/codeql-bundle-v2.26.1</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/99df26d4f13ea111d4ec1a7dddef6063f76b97e9...7188fc363630916deb702c7fdcf4e481b751f97a">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
e47805e6a9 |
ci(deps): bump the actions-core group with 2 updates (#582)
Bumps the actions-core group with 2 updates: [actions/checkout](https://github.com/actions/checkout) and [actions/setup-go](https://github.com/actions/setup-go). Updates `actions/checkout` from 7.0.0 to 7.0.1 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.1</h2> <h2>What's Changed</h2> <ul> <li>skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v7...v7.0.1">https://github.com/actions/checkout/compare/v7...v7.0.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.1</h2> <ul> <li>Skip running unsafe pr check if input is default by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2518">actions/checkout#2518</a></li> <li>Trim only ascii whitespace for branch by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2521">actions/checkout#2521</a></li> <li>Escape values passed to --unset by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2530">actions/checkout#2530</a></li> <li>Various dependency updates</li> </ul> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Various dependency updates</li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/3d3c42e5aac5ba805825da76410c181273ba90b1"><code>3d3c42e</code></a> prep v7.0.1 release (<a href="https://redirect.github.com/actions/checkout/issues/2531">#2531</a>)</li> <li><a href="https://github.com/actions/checkout/commit/28802689a136bfcdb721715abd713740beecbe07"><code>2880268</code></a> escape values passed to --unset (<a href="https://redirect.github.com/actions/checkout/issues/2530">#2530</a>)</li> <li><a href="https://github.com/actions/checkout/commit/12cd2235efa0937479335606d7c3ac9f6c0973b1"><code>12cd223</code></a> trim only ascii whitespace for branch (<a href="https://redirect.github.com/actions/checkout/issues/2521">#2521</a>)</li> <li><a href="https://github.com/actions/checkout/commit/62661c4e71a304b2823ed026347b8d34c3eac541"><code>62661c4</code></a> skip running unsafe pr check if input is default (<a href="https://redirect.github.com/actions/checkout/issues/2518">#2518</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8d4307400f9427dba7cb98e488d6ab85f1cec5f"><code>e8d4307</code></a> Bump the minor-actions-dependencies group with 2 updates (<a href="https://redirect.github.com/actions/checkout/issues/2499">#2499</a>)</li> <li><a href="https://github.com/actions/checkout/commit/631c942040754b6e095e929c1677c07e10ed4f87"><code>631c942</code></a> eslint 9 (<a href="https://redirect.github.com/actions/checkout/issues/2474">#2474</a>)</li> <li><a href="https://github.com/actions/checkout/commit/4f1f4aec02e41874fa0262ea8ff5172d7978ad1e"><code>4f1f4ae</code></a> Bump actions/upload-artifact from 4 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2476">#2476</a>)</li> <li><a href="https://github.com/actions/checkout/commit/ba097532fb203f7e88c9c3c0b899b49469908a92"><code>ba09753</code></a> Bump actions/checkout from 6 to 7 (<a href="https://redirect.github.com/actions/checkout/issues/2488">#2488</a>)</li> <li><a href="https://github.com/actions/checkout/commit/b9e0990d219a03df7633c93f6f005a8fecbcab22"><code>b9e0990</code></a> Bump docker/login-action from 3.3.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2479">#2479</a>)</li> <li><a href="https://github.com/actions/checkout/commit/e8cb398be4a550817e382abf69e4c12c76fce1f2"><code>e8cb398</code></a> Bump docker/build-push-action from 6.5.0 to 7.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2478">#2478</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-go` from 6.5.0 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-go/releases">actions/setup-go's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/priyagupta108"><code>@priyagupta108</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/763">actions/setup-go#763</a></li> <li>chore(deps): bump <code>@actions/cache</code> to 6.2.0 by <a href="https://github.com/philip-gai"><code>@philip-gai</code></a> in <a href="https://redirect.github.com/actions/setup-go/pull/771">actions/setup-go#771</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/philip-gai"><code>@philip-gai</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-go/pull/771">actions/setup-go#771</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-go/compare/v6...v7.0.0">https://github.com/actions/setup-go/compare/v6...v7.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-go/commit/b7ad1dad31e06c5925ef5d2fc7ad053ef454303e"><code>b7ad1da</code></a> chore(deps): bump <code>@actions/cache</code> to 6.2.0 (<a href="https://redirect.github.com/actions/setup-go/issues/771">#771</a>)</li> <li><a href="https://github.com/actions/setup-go/commit/0778a10ce47b5d450cf60fb94fafad4330008a35"><code>0778a10</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-go/issues/763">#763</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-go/compare/924ae3a1cded613372ab5595356fb5720e22ba16...b7ad1dad31e06c5925ef5d2fc7ad053ef454303e">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
ee5f351828 |
deps(deps): bump github.com/chromedp/chromedp from 0.15.1 to 0.16.0 (#579)
Bumps [github.com/chromedp/chromedp](https://github.com/chromedp/chromedp) from 0.15.1 to 0.16.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/chromedp/chromedp/commit/7963c203ed5458147d27dc39a5c06d2b12e81664"><code>7963c20</code></a> Running modernize</li> <li><a href="https://github.com/chromedp/chromedp/commit/9178eba2a70c7691c6d710fd3383542503d4aa38"><code>9178eba</code></a> Updating to latest cdproto, running go fix</li> <li>See full diff in <a href="https://github.com/chromedp/chromedp/compare/v0.15.1...v0.16.0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
|
1270eed554 |
feat(player): add name/IP device sort toggle (#571) (#576)
Relates to #571. ## What Adds a **Name / IP** sort toggle to the Player device list. The choice is persisted in `localStorage` (`aftertouch_device_sort`), following the same preference pattern as the service-URL field in `PlayURL.js`. ## Why The device list was previously ordered only by IP: the service datastore keys devices by IP address and Go marshals map keys lexicographically, so the frontend received an already-IP-ordered object and rendered it as-is. BirdyBA (#571) asked to be able to sort by name instead. ## Changes - `DeviceList.js`: a `sortEntries()` helper plus a `useState`-backed toggle seeded from `localStorage`. Name mode sorts by `device.info.name` (falling back to the IP key when a device has no name yet); IP mode sorts the IP key **numerically** (`.2` before `.10`), which also tidies the old lexicographic ordering. - `css/app.css`: additive `.device-sort` / `.sort-btn` styling, reusing the existing accent / `.active` look. No existing rules touched. No backend change: the device name and IP are already in the payload. ## Testing - `node --check` on `DeviceList.js` passes. - `make build-player` succeeds (the static tree is `//go:embed`ed into the binary). - Manual: open the Player, toggle Name / IP, confirm the order changes and the choice survives a page reload. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
ca4adb3e11 |
ci(deps): bump actions/setup-node in the actions-core group
Bumps the actions-core group with 1 update: [actions/setup-node](https://github.com/actions/setup-node). Updates `actions/setup-node` from 6.4.0 to 7.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020) --- updated-dependencies: - dependency-name: actions/setup-node dependency-version: 7.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-core ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
66ab981695 |
ci(deps): bump softprops/action-gh-release from 3.0.1 to 3.0.2
Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 3.0.1 to 3.0.2. - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/718ea10b132b3b2eba29c1007bb80653f286566b...3d0d9888cb7fd7b750713d6e236d1fcb99157228) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
d34e095c9f |
ci(deps): bump docker/metadata-action from 6.1.0 to 6.2.0
Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 6.1.0 to 6.2.0. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9...dc802804100637a589fabce1cb79ff13a1411302) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: 6.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
745bef5acc |
ci(deps): bump docker/login-action from 4.2.0 to 4.4.0
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.2.0 to 4.4.0. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
00db897c24 |
ci: group codeql-action sub-actions in Dependabot
github/codeql-action/init, /analyze and /upload-sarif are separate Dependabot dependencies but must run on the same version. Without a group they update in independent PRs that merge at different times, producing a version mismatch that fails CodeQL. Group them so all sub-actions bump together in one PR. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
c20e15df21 |
ci: align codeql-action init/upload-sarif with analyze v4.37.0
Dependabot bumped only github/codeql-action/analyze to v4.37.0 while init and upload-sarif stayed on v4.36.2. CodeQL requires all of its action steps on the same version; the mismatch failed every Analyze job with 'Loaded a configuration file for version 4.36.2, but running version 4.37.0'. Bump init and upload-sarif to the same v4.37.0 commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
7e555d8c86 |
ci(deps): bump github/codeql-action/analyze from 4.36.2 to 4.37.0
Bumps [github/codeql-action/analyze](https://github.com/github/codeql-action) from 4.36.2 to 4.37.0. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...99df26d4f13ea111d4ec1a7dddef6063f76b97e9) --- updated-dependencies: - dependency-name: github/codeql-action/analyze dependency-version: 4.36.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
d523d96b6f |
test: refresh router snapshot for chi 5.3.1 QUERY method
chi 5.3.1 recognizes the HTTP QUERY method, so chi.Walk now expands the all-methods HandleFunc registrations for the SiriusXM live-adapter routes to include QUERY. The routes are functionally unchanged; only the walk output grew two lines. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
27aa88b317 |
deps(deps): bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.3.0 to 5.3.1. - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.3.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
 github-actions[bot]andTobias Gesellchen
|
9d17955430 | chore: sync static dependencies with package.json | ||
|
dependabot[bot]andTobias Gesellchen
|
c5441639c5 |
deps(deps): bump preact from 10.29.3 to 10.29.7
Bumps [preact](https://github.com/preactjs/preact) from 10.29.3 to 10.29.7. - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](https://github.com/preactjs/preact/compare/10.29.3...10.29.7) --- updated-dependencies: - dependency-name: preact dependency-version: 10.29.7 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
397faaaabd |
docker: use Go 1.26.5 release instead of 1.27rc2
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
486fb2faab |
deps: bump Go toolchain to 1.26.5
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
a4cc6f5c96 |
deps(deps): bump the golang group with 9 updates
Bumps the golang group with 9 updates: | Package | From | To | | --- | --- | --- | | [golang.org/x/crypto](https://github.com/golang/crypto) | `0.53.0` | `0.54.0` | | [golang.org/x/net](https://github.com/golang/net) | `0.56.0` | `0.57.0` | | [golang.org/x/term](https://github.com/golang/term) | `0.44.0` | `0.45.0` | | [golang.org/x/image](https://github.com/golang/image) | `0.43.0` | `0.44.0` | | [golang.org/x/mod](https://github.com/golang/mod) | `0.37.0` | `0.38.0` | | [golang.org/x/sync](https://github.com/golang/sync) | `0.21.0` | `0.22.0` | | [golang.org/x/sys](https://github.com/golang/sys) | `0.46.0` | `0.47.0` | | [golang.org/x/text](https://github.com/golang/text) | `0.38.0` | `0.40.0` | | [golang.org/x/tools](https://github.com/golang/tools) | `0.47.0` | `0.48.0` | Updates `golang.org/x/crypto` from 0.53.0 to 0.54.0 - [Commits](https://github.com/golang/crypto/compare/v0.53.0...v0.54.0) Updates `golang.org/x/net` from 0.56.0 to 0.57.0 - [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0) Updates `golang.org/x/term` from 0.44.0 to 0.45.0 - [Commits](https://github.com/golang/term/compare/v0.44.0...v0.45.0) Updates `golang.org/x/image` from 0.43.0 to 0.44.0 - [Commits](https://github.com/golang/image/compare/v0.43.0...v0.44.0) Updates `golang.org/x/mod` from 0.37.0 to 0.38.0 - [Commits](https://github.com/golang/mod/compare/v0.37.0...v0.38.0) Updates `golang.org/x/sync` from 0.21.0 to 0.22.0 - [Commits](https://github.com/golang/sync/compare/v0.21.0...v0.22.0) Updates `golang.org/x/sys` from 0.46.0 to 0.47.0 - [Commits](https://github.com/golang/sys/compare/v0.46.0...v0.47.0) Updates `golang.org/x/text` from 0.38.0 to 0.40.0 - [Release notes](https://github.com/golang/text/releases) - [Commits](https://github.com/golang/text/compare/v0.38.0...v0.40.0) Updates `golang.org/x/tools` from 0.47.0 to 0.48.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](https://github.com/golang/tools/compare/v0.47.0...v0.48.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.54.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/net dependency-version: 0.57.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/term dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/image dependency-version: 0.44.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/mod dependency-version: 0.38.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/sync dependency-version: 0.22.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/sys dependency-version: 0.47.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/text dependency-version: 0.40.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang - dependency-name: golang.org/x/tools dependency-version: 0.48.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
0374b2a680 |
docker(deps): bump golang from 1.26.4-alpine to 1.27rc2-alpine
Bumps golang from 1.26.4-alpine to 1.27rc2-alpine. --- updated-dependencies: - dependency-name: golang dependency-version: 1.27rc2-alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
d944a5a794 |
ci(deps): bump docker/setup-buildx-action in the setup-actions group
Bumps the setup-actions group with 1 update: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action). Updates `docker/setup-buildx-action` from 4.1.0 to 4.2.0 - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5...bb05f3f5519dd87d3ba754cc423b652a5edd6d2c) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: 4.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: setup-actions ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
7dfe2dc160 |
ci(deps): bump docker/build-push-action from 7.2.0 to 7.3.0
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.2.0 to 7.3.0. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/f9f3042f7e2789586610d6e8b85c8f03e5195baf...53b7df96c91f9c12dcc8a07bcb9ccacbed38856a) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: 7.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
c153592a40 |
docs: document HTTPS URL derivation/override + cert-chain health warning (#355)
- HTTPS-SETUP.md: the HTTPS endpoint is only needed for certain features and its URL now derives from the Target Domain by default; note the https-Target-Domain shortcut and the Settings override. - SOUNDTOUCH-SERVICE.md: HTTPS_SERVER_URL is an override that derives from SERVER_URL when empty, and is viewable/overridable in Settings. - TROUBLESHOOTING.md: new entry for the "HTTPS endpoint TLS configuration" health warning (wrong port / not reachable), how to fix via the Settings HTTPS URL, and when it's an expected reverse-proxy case. refs #355 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>v0.118.0 |
||
|
Tobias GesellchenandClaude Opus 4.8
|
edc6869faf |
ui(settings): group Target Domain + HTTPS URL under a "Service URLs" header
Follow-up polish to the HTTPS-URL settings work: - Group Target Domain and the derived HTTPS URL under a single bold "Service URLs" section header, matching the existing section-header pattern (Landing page, TLS extra hosts, Device Discovery) rather than a one-off fieldset box — consistent across the whole Settings tab. - Tighten the spacing so the HTTPS URL sits with Target Domain (drop the empty :443-status reserved line, reduce the intra-group gap) instead of floating toward the next section. - Make "Landing page" a bold header for the same consistency. - Expand the HTTPS URL override hint: HTTPS is only needed for certain features (DNS redirect, Spotify/Amazon login, cert trust); it derives from the Target Domain; and if you don't need plain HTTP you can set the Target Domain itself to an https:// URL, no override required. refs #355 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
9957c9d64f |
fix(ui): correct HTTPS URL override toggle + normalize derived override (#355)
Two follow-ups to the derive/show/override settings work: - The "advanced override" affordance reused the .info-toggle style with a text label, which is an 18px circular icon badge — the label rendered as a broken blue circle. Use the icon-toggle pattern like TLS extra hosts: a small ⓘ that reveals a details block containing the explanation and the override input. - Existing installs persist their old effective HTTPS URL in the (now override) https_server_url field, so the UI showed "(override)" even when the value equals what we would derive. On load, treat an override that exactly matches the derived URL as "derive" (clear it), so default installs show "(derived from Target Domain)"; genuinely custom values are kept as overrides. Verified live: an existing settings.json with https_server_url equal to the derived value now reports an empty override, and the served admin HTML uses the ⓘ toggle. refs #355 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
381ab4639a |
fix(export): report effective HTTPS URL + override in diagnostics (#355)
The diagnostic export wrote the raw persisted https_server_url, which is now the override (empty when the URL is derived). Report the effective HTTPS URL actually in use plus the override as a separate field, so a diagnostic makes an advertised-URL/listener mismatch legible instead of showing an empty field. refs #355 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
b1b3472297 |
feat(settings): derive the HTTPS URL from the Target Domain, show + override in UI (#355)
The HTTPS URL AfterTouch advertises (and points speakers at for the DNS-redirect, OAuth, install-ca and cert-trust flows) was a separate, internally-tracked value: sourced only from --https-server-url / HTTPS_SERVER_URL / the settings file, defaulting to the machine hostname, and never shown or editable in the web UI. So it could silently diverge from the Target Domain (e.g. a different host, or a port-less value that fell back to 443 while the listener was on 8443 — the root of #355), with no way to see or fix it in the UI. Make it derive + show + override: - DeriveHTTPSURL resolves the effective HTTPS URL: an explicit override wins; otherwise it follows the Target Domain (same host, https, on the configured HTTPS port); an already-https Target Domain is honoured verbatim (its port is not second-guessed); empty falls back to the hostname default. So changing the Target Domain updates the HTTPS URL automatically for the common single-host case. - The persisted https_server_url is now the *override* (empty = derive). Existing installs carry their old value here, so it is preserved as an override — no silent change on upgrade; clearing it opts into derive. - The server keeps httpsServerURL as the effective value, so all consumers (cert SANs, migration, export, health) are unchanged; it is recomputed whenever the Target Domain or override changes. - Settings API returns https_server_url (effective) plus https_server_url_override; the Settings page shows the effective URL with a derived/override note and an "advanced" override field. Verified live on a clean data dir: derive from an http Target Domain, auto-follow when the Target Domain changes, explicit override, an https Target Domain kept verbatim, and override persistence across restart. Unit tests cover DeriveHTTPSURL including the already-https cases. refs #355 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
433a779998 |
fix(health): detect advertised-HTTPS-URL / listener port mismatch (#355)
Follow-up to the previous commit. The cert-chain check dialed the advertised HTTPS URL, whose port defaults to 443 when the URL omits it (splitHTTPSHostPort). The advertised URL comes from --https-server-url / HTTPS_SERVER_URL / the settings file and is not editable in the web UI, so when it lost its port it silently pointed the check (and speakers) at 443 while the real listener was on 8443 — the exact "port 443" complaint in issue #355. Thread the actual HTTPS listener port into the check (new Server.SetHTTPSListenAddr, wired from config.httpsAddr). When the dial fails and the advertised port differs from the listener port, emit a mismatch-specific warning that names both ports and offers the corrected HTTPS_SERVER_URL, while still deferring to reverse-proxy setups. A reachable endpoint never reaches this branch. Reproduced locally on a clean data dir: seeding a port-less https_server_url with the listener on 8443 previously errored on :443; it now warns with both ports and the fix. Regression tests added. refs #355 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
9d69b61779 |
fix(health): don't error when the advertised HTTPS URL is unreachable from the service
The `service_cert_chain` check ("HTTPS endpoint TLS configuration") dials
the service's own configured HTTPS URL. When that dial fails before any
certificate is presented (connection refused, timeout, handshake reset),
it reported a hard red error.
But from inside the service we can't distinguish "the endpoint is down"
from "the advertised HTTPS URL simply isn't reachable from here" — and
the latter is a normal, healthy deployment: TLS terminated by a reverse
proxy in front of AfterTouch, or a Docker-published port / LAN-only
hostname that the container itself can't dial. In those setups the red
error is a false alarm (issue #355: reporter runs HTTP 8080 / HTTPS 8443
and noted "in my configuration that is expected").
Downgrade that specific case (no cert presented) to a warning, reword it
to name the expected reverse-proxy / unreachable-advertised-URL case, and
add an `openssl s_client` command to verify the endpoint from a client
that actually reaches the advertised URL. Cert-classification outcomes
(own-CA info, foreign-chain warning) are unchanged.
Reproduced locally on a clean data dir before/after: custom ports and
localhost/127.0.0.1 already returned INFO; only the unreachable-URL case
produced the error, which now returns a warning.
refs #355
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
||
|
Tobias GesellchenandClaude Opus 4.8
|
c3e3391db6 |
docs: add Downloads page + telnet re-migration workaround for #493
Address the two docs follow-ups from #493 (radio sources not mounting after an in-place migration). Troubleshooting: the "Radio sources never activate after an in-place migration" entry now leads with the confirmed non-destructive fix, re-running migration via the telnet method so all four service URLs (incl. bmxRegistryUrl / statsServerUrl) land on the speaker's runtime: soundtouch-cli --host <ip> setup migrate --method telnet --service-url http://<host>:8000 Factory reset is kept as the fallback for models without a reachable telnet port. The cause text is updated to the diagnosed BMX-registry explanation, and notes why pointing the service at http://bose:8000 with a server-side /etc/hosts entry does not help. Downloads: new top-level docs section (docs/content/docs/downloads/) structured by tool (service / player / cli / backup) x OS/arch, using the real release asset naming (soundtouch-<tool>-v<ver>-<os>-<arch>), plus install-script, Docker, and go-install routes. Sibling section weights bumped so Downloads leads the sidebar. README, the release-notes template, and the key install guides now point here. Also fixes the stale, never-produced .tar.gz/.zip filenames in SELF-HOSTING.md. refs #493 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
github-actions[bot]andTobias Gesellchen
|
8695816d36 | chore: sync static dependencies with package.json | ||
|
dependabot[bot]andTobias Gesellchen
|
bdbfc8dcf6 |
deps(deps): bump preact from 10.29.2 to 10.29.3
Bumps [preact](https://github.com/preactjs/preact) from 10.29.2 to 10.29.3. - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](https://github.com/preactjs/preact/compare/10.29.2...10.29.3) --- updated-dependencies: - dependency-name: preact dependency-version: 10.29.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
2663357c9c |
ci(deps): bump golangci/golangci-lint-action from 9.2.1 to 9.3.0
Bumps [golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action) from 9.2.1 to 9.3.0. - [Release notes](https://github.com/golangci/golangci-lint-action/releases) - [Commits](https://github.com/golangci/golangci-lint-action/compare/82606bf257cbaff209d206a39f5134f0cfbfd2ee...ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a) --- updated-dependencies: - dependency-name: golangci/golangci-lint-action dependency-version: 9.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
3f26b9ddf1 |
ci(deps): bump the actions-core group with 2 updates
Bumps the actions-core group with 2 updates: [actions/setup-go](https://github.com/actions/setup-go) and [actions/cache](https://github.com/actions/cache). Updates `actions/setup-go` from 6.4.0 to 6.5.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/4a3601121dd01d1626a1e23e37211e3254c1c06c...924ae3a1cded613372ab5595356fb5720e22ba16) Updates `actions/cache` from 5.0.5 to 6.1.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions-core - dependency-name: actions/cache dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: actions-core ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
7f2f30604c |
deps(deps): bump golang.org/x/tools in the golang group
Bumps the golang group with 1 update: [golang.org/x/tools](https://github.com/golang/tools). Updates `golang.org/x/tools` from 0.46.0 to 0.47.0 - [Release notes](https://github.com/golang/tools/releases) - [Commits](https://github.com/golang/tools/compare/v0.46.0...v0.47.0) --- updated-dependencies: - dependency-name: golang.org/x/tools dependency-version: 0.47.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: golang ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
8a8b74386d |
docs(blog): add a thank-you shout-out to AfterTouch sponsors
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
4aad9fbcf0 |
docs(blog): fix /blog-update skill (footer convention, no-push, narrative)
- Close every post with the established footer convention (## Current release + dated release line + subscribe note), and never restyle already-published posts to fit a new convention. - Prefer a narrative over a bare release-note aggregation. - Forbid em dashes (with a grep check). - Allow an explicit tag/date argument to override lookback detection. - Stop the skill from pushing or opening the PR itself: commit to a branch and hand the maintainer the push + PR commands (maintainer always pushes over SSH). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
d154d459c6 |
docs(blog): add May – June 2026 narrative update post
Tells the story since v0.93.1 (rescue to platform): local music + TTS, robustness/security hardening, health diagnostics. Emphasises that the roadmap is community-driven, shouts out Sander ten Brinke's soundtouch-maui companion app, and sets out what v1.0.0 signals (stability, clean-slate re-migration, beyond-Bose value: #495, #508, #188). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
e61d2d9ac9 |
docs: clarify the proxy trust gate is on the immediate TCP peer
Spell out that AfterTouch reads X-Forwarded-For only when the connecting socket's source IP is in trusted_proxy_cidrs (the socket address, which a header can't forge), reword the table rows in those terms, and note that a proxy in a separate Docker container is usually seen as the Docker bridge subnet rather than its published address. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>v0.117.0 |
||
|
Tobias GesellchenandClaude Opus 4.8
|
022cafbe23 |
docs: move proxy client-IP guidance to the deployment walkthrough
Reverse-proxy client-IP resolution (trust_forwarded_headers / trusted_proxy_cidrs) was documented under HTTPS-SETUP because proxies are commonly used for TLS termination, but it's really a deployment concern. Relocate it to CLOUD-DEPLOY-WALKTHROUGH as a "Client IP behind a proxy or load balancer" section with a behavior table (no-proxy default, trusted-proxy XFF resolution, and the untrusted-peer spoofing gate). HTTPS-SETUP keeps the TLS-termination example and now cross-links to it; the deployment section links back for the cert details. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
1cac9989be |
fix(service): detect first run by settings.json absence, not empty server_url
Startup treated an empty server_url as "first run" and wrote a fresh default settings.json via createDefaultSettings, which builds the struct from CLI flags and does not merge the existing file. A hand-authored settings.json that sets, say, trust_forwarded_headers but leaves server_url to the --server-url flag has no server_url, so it was silently clobbered on first start (losing the operator's keys). Gate the default-seed (and the lost-volume "first run" notice) on the ABSENCE of settings.json instead. An existing file is now always respected; a genuinely empty data dir still gets defaults and the notice. This also fixes a latent loop where a never-set server_url made every start look like a first run. Adds regression tests: settingsFileExists, plus first-run seed both preserving a hand-authored file and writing defaults when absent. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
d31710bd8e |
docs(clientip): document X-Forwarded-For-only proxy client-IP resolution
Update the HTTPS reverse-proxy guide and the trust_forwarded_headers / trusted_proxy_cidrs settings comments to reflect that the client IP is now resolved from X-Forwarded-For only (no longer X-Real-IP / True-Client-IP), read via the request context rather than by rewriting r.RemoteAddr. The nginx example now sets X-Forwarded-For. (Release note staged locally at _/releases/v0_117_0.md, which is gitignored like prior release notes.) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
67c30850cd |
fix(handlers): resolve client IP via chi ClientIP, drop deprecated RealIP
chi v5.3.0 deprecates middleware.RealIP (IP-spoofing advisories), which failed the Lint and Static Security Analysis CI jobs (SA1019). Replace the RealIP wrapper with chi's middleware.ClientIP: ClientIPFromRemoteAddr is always applied so middleware.GetClientIP is populated, and when trust_forwarded_headers is set and the immediate peer is a trusted-proxy CIDR, ClientIPFromXFF resolves the real client from X-Forwarded-For (rightmost entry outside the trusted CIDRs). The immediate-peer trust gate is preserved, so a non-trusted peer's XFF is ignored. CIDR strings are validated with netip.ParsePrefix first to avoid ClientIPFromXFF's panic. Behavior change: only X-Forwarded-For is honored now (RealIP also read X-Real-IP / True-Client-IP). Docs and a release note follow. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
28d7675fc4 |
refactor(handlers): resolve client IP via a clientHost helper
Route every HTTP read of the client IP through a single clientHost(r) helper backed by chi's new middleware.GetClientIP, falling back to the socket peer from r.RemoteAddr. AddDeviceToAccount now takes a bare client host instead of a "host:port" RemoteAddr. Behavior is unchanged in this commit (no ClientIP middleware is wired yet, so the fallback is always taken); a follow-up wires middleware.ClientIP and removes the deprecated middleware.RealIP. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
dependabot[bot]andTobias Gesellchen
|
f4c59c1e58 |
deps(deps): bump github.com/go-chi/chi/v5 from 5.2.5 to 5.3.0
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi) from 5.2.5 to 5.3.0. - [Release notes](https://github.com/go-chi/chi/releases) - [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md) - [Commits](https://github.com/go-chi/chi/compare/v5.2.5...v5.3.0) --- updated-dependencies: - dependency-name: github.com/go-chi/chi/v5 dependency-version: 5.3.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
a033ec077f |
fix(health): reword sources_xml_diff title to an expectation (refs #493)
The check title asserted "Speaker /sources matches service Sources.xml", but the row renders as a warning when they differ, so "matches" plus a warning read as a contradiction (reported in #493). Reword to "should match" so the title states the expectation; the per-finding messages and severities already convey whether it holds and what the differences are. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>v0.116.0 |
||
|
Tobias GesellchenandClaude Opus 4.8
|
1fff2c07a9 |
feat(health): show device name and IP on per-device findings
Per-device health findings previously labelled the device by account and device IDs only (e.g. "account 3230304 · device 08DF1F0BA325"), which is hard to place at a glance. Add display-only Name and IP fields to health.Target and fill them centrally via EnrichTargets after the checks run, so individual checks don't each have to look up the device record. Both the live health endpoint and the diagnostic export go through the new Server.runHealthChecks helper, and the Health tab renders the friendly name first, then account/device IDs, then IP. Fixes match on Account+Device only, so the new fields don't affect quick-fix dispatch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Tobias GesellchenandClaude Opus 4.8
|
84dc5fe999 |
docs(guides): add FRITZ!Box + AdGuard DNS-based bose hostname guide
Document the setup where AfterTouch sits behind a local resolver (AdGuard Home / Pi-hole / FRITZ!Box) and is addressed by a short hostname like `bose` instead of a raw IP. Captures the symptom cluster (INVALID_SOURCE, missing source types, URL-mismatch pre-flight) and the fix: short-hostname DNS rewrites, TLS_EXTRA_HOST coverage, switching the service URLs to the hostname, and re-migration. Based on a real user-contributed setup; IPs sanitised to RFC 5737. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |