release: v1.4.7 - #135
Merged
Merged
Conversation
Maintenance and hardening release covering everything merged since v1.4.6.
Bug fixes:
- SABnzbd addfile/addurl return 200 {status:false} instead of HTTP 500 on a
failed enqueue, so Sonarr no longer sees valid grabs as hard failures
(#130, fixes #129).
- Priority changes no longer pause active downloads (#126).
- Resuming a paused job resets its no-progress clock (#125).
- mode=addurl works as a bare POST without a multipart body (#119).
Security:
- SSRF guard applied to the SABnzbd addurl fetch (shared, DNS-rebinding-safe);
user RSS regex compiled with length/size limits (#133).
- Alerts-only Dependabot, dependency-review check, CodeQL security-extended
(#132). rust + CodeQL made required checks; secret-scanning validity checks
enabled; code-scanning backlog triaged to zero (out of band).
Dependencies: quick-xml 0.37->0.41 (parser migration), zip->8.6, tower-http
->0.7, toml->1.1, socket2->0.6, base64->0.23, rand->0.10, md-5->0.11,
sha2->0.11, rust-minor group (17), codeql-action v4.
CI: reconcile stale desktop/src-tauri/Cargo.lock (#131); runner selector
migration (#120).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L7gQssrAVUE6191dfgPZi6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Version bump to v1.4.7 (workspace
rustnzb+mock-nntp-server, plus bothCargo.lockfiles). Covers everything merged since v1.4.6; taggingv1.4.7after this lands triggers the release workflow (multi-arch image + GitHub release).Included since v1.4.6
Bug fixes
addfile/addurlreturn200 {status:false}instead of HTTP 500 on a failed enqueue — Sonarr no longer marks valid grabs as hard failures (fix(sabnzbd): return 200 status:false on addfile enqueue failure (#129) #130, fixes SABnzbd-compatible addfile API returns HTTP 500 after successfully adding NZB #129)mode=addurlworks as a bare POST without a multipart body (SABnzbd compatibility: POST mode=addurl fails with 400 when request has no multipart body #119)Security
addurlfetch (shared, DNS-rebinding-safe); RSS regex bounded (fix(security): SSRF guard for SABnzbd addurl + bounded RSS regex #133)dependency-review, CodeQLsecurity-extended(chore(security): alerts-only Dependabot, dependency-review, CodeQL extended #132);rust+CodeQL now required checks; secret-scanning validity checks on; code-scanning backlog triaged to zeroDependencies: quick-xml 0.37→0.41 (parser migration), zip→8.6, tower-http→0.7, toml→1.1, socket2→0.6, base64→0.23, rand→0.10, md-5→0.11, sha2→0.11, rust-minor group (17), codeql-action v4
CI: stale
desktop/src-tauri/Cargo.lockreconciled (#131); runner selector migration (#120)Validation
cargo test --workspace --all-targets --locked) green on the merge commit in a clean worktree.--locked.🤖 Generated with Claude Code
https://claude.ai/code/session_01L7gQssrAVUE6191dfgPZi6