52 Releases 53 Tags

RSS Feed

• v2.2.1 649f821850

  Compare

  v2.2.1 Stable

  john-okeefe released this 2026-10-26 08:49:31 -04:00 | 0 commits to main since this release

  Bug Fixes

  • (admin) Hash-conflict routes served at sane path — resolve buttons were dead (11b179b)
  • (docs) Work Order 2 — correct stale paths (11 docs + 3 Bruno) (5028289)
  • Wire security headers, graceful shutdown, and settings invalidation (a716b38)
  • (web) Restore Alpine theme members and allow eval for Alpine expressions (b6eba66)
  • (scanner) Split comma-joined ABS sidecar genres into separate tags (ab2a556)
  • (ui) Hide Comic/Manga editor section for non-comics media (d41c3e4)
  • (web) Complete the CSP-build migration across remaining surfaces (09545ca)
  • (web) Convert remaining JS-global bindings for the CSP build; drop unsafe-eval (6d01bd7)
  • (devices) Copy buttons via component method (copyFromId) under CSP build (3b66b98)
  • (reader) Highlight color picker + window-aware note popover under CSP build (6a59878)

  Documentation

  • (devices) Work Order 3 batch 1 — 6 missing device endpoints + gate entries (c4b62af)
  • (libraries) Work Order 3 batch 2 — 10 missing endpoints + array-response gate support (85cdaf7)
  • (media-items) Work Order 3 batch 3a — reader-adjacent CRUD (11 endpoints) (ed0ce5d)
  • (media-items) Work Order 3 batch 3b — management endpoints (8) (4a6fb03)
  • (analytics,jobs) Work Order 3 batch 4 — device usage, popular books, job create/status (7471ca9)
  • (saved-filters,dashboard,system,series) Beam WO3 batch 5 — 15 endpoints + dedupe (fa00d6d)
  • (conflicts,queue) Beam WO5 batch — 13 endpoints backfilled, registry pinned (eacc33b)
  • (auth,devices) Beam WO5 batch 3 — 15 endpoints backfilled, registry pinned (ae9588f)
  • (media-items core) Beam WO5 batch 4 — 12 endpoints backfilled, registry pinned (6f13dc2)
  • (libraries) Beam WO5 batch 5 — 11 endpoints backfilled + pilot recovery (b77eab7)
  • (kobo,koreader,collections) Beam WO5 batch 6 — 12 endpoints (25ef0d1)
  • (scanner) Beam batch 7 — all 10 scanner endpoints backfilled (2c56ae4)
  • (auth,users,devices,progress,matching) Beam batch 8 — WO5 backfill complete (cc5677e)
  • (highlights,notes,opds,progress,analytics) Beam batch 9 — 13 endpoints (7a7b2ab)
  • (book-matching,collections) Beam batch 10 — 15 endpoints (18084de)
  • (media-items,collections,koreader,admin) Beam batch 11 — final backfill (e21e1fa)
  • (stats) Claude-side pinning — all 4 stats endpoints + UNVERIFIED sweep to zero (6fc501b)
  • (users) Live-smoke correction — GET /api/auth/users emits sqlc ListUsersRow, no password_hash (0c45137)
  • (ui) Cookie-rendered sidebar state, data-collapsed CSS, working overview links + link-checker gate (a8f8c4d)
  • (ui) Drop sidebar saved-state — server defaults already ARE the standard docs behavior (73e8cde)
  • (ui) Canonicalize .md URLs — sidebar now opens when arriving from overview links (a1ac5b1)
  • (ui) Scroll the sidebar so the active (bold) link is in view on load (da0bae9)
  • (ui) Center the active nav link in the sidebar instead of edge-clamping (dd2ab4e)
  • Drop stale interactive API Explorer references (4ab6a64)
  • Docs nav: promote Devices and Administration out of User Guide

  Follows the developer/api → API Reference carve-out: placement-only, no
  file paths or URLs change. placeDoc routes user/devices/* to a new
  top-level "Devices" section (icon: device) and user/admin-* to a new
  top-level "Administration" section (icon: shield); User Guide keeps its
  direct guides with no groups. Sidebar order: Getting Started, User
  Guide, Devices, Administration, API Reference, Developer, Operations,
  Contributing.

  Verified live: on kobo-setup the Devices section opens with the three
  device guides; on admin-guide Administration opens with both admin
  guides; on user/dashboard User Guide opens as before. Tests
  (TestPlaceDoc, TestBuildNavigation) updated to pin the new placement. (27f42bf)

  • Docs nav: move Administration above Devices in sidebar order (56dbca3)
  • Docs nav: correct casing of 'Searching and Filtering' sidebar label

  docTitleOverrides now pins the label with lowercase 'and' (the naive
  titleCase fallback capitalized every word); only the sidebar label was
  affected — the page h1 comes from the markdown heading and was already
  correct. Test pin added to TestDocTitle. (649f821)

  Features

  • (docs) Standalone docs site chrome + category/subcategory navigation (84cd632)
  • (docs) Drift gate — docs frontmatter validated against real routes (cc893f7)
  • (web) Switch to the Alpine CSP build; drop 'unsafe-eval' from CSP (eb57b72)

  Miscellaneous Tasks

  • (web) Drop unreferenced highlight-dark.min.css (994e0f8)
  • (web) Add knip and remove unused npm dependencies (dc0e357)

  Other

  • Regenerate collection from canonical docs + permanent docs↔Bruno parity gate (acd82ff)
  • Replace Python generator with Go golden-writer in the drift test (cfcd95b)
  • Status asserts on generated mirrors, OpenAPI spec, safe negative scenarios (983980d)
  • Fix admin/docs theme flash + persist sidebar open/closed state (f1a6de7)
  • Apply gofmt across Go sources (8733e83)
  • Replace 'unsafe-inline' with a content hash for the theme flash guard (fb95b6d)
  • CSP tripwire: source-scan test + AGENTS.md rule; drop last native onchange

  templates/csp_source_test.go scans .templ sources and fails the build on
  the three authoring patterns hash-mode CSP refuses silently: native on*=
  handler attributes (quote and templ brace forms), inline <script>
  content outside the sanctioned theme_flash_guard.templ, and htmx's
  eval-dependent bindings (hx-on*, js:-prefixed hx-vals — 'unsafe-eval' is
  not granted). Verified to fire on all four violation classes via a
  scratch probe file.

  The dry run immediately caught a live leftover: unlinked_books.templ's
  onchange="updateSelectedCount()" — CSP-refused since the hash flip.
  Removed; the count already updates through the document-level delegated
  change listener that x-init="setupEventDelegation()" registers.

  AGENTS.md gains a "CSP discipline" ALWAYS-apply section documenting the
  hash allow-list, the sanctioned-guard invariant, the replacement
  patterns, and the tripwire test.

  Verified: go build/vet, templates+middleware+docs tests green; /unlinked-
  books loads with zero console violations (no fixture rows to exercise the
  checkbox; the delegated path is unchanged code). (4681e98)

  Refactor

  • Remove dead code across server, templ pages, and client modules (8631aa0)
  • (ui) Promote generic publication fields to their own editor section (a730a62)

  Tests

  • (e2e) Add Playwright system smoke and regression suite (ecfd727)

  Downloads

  • Source Code (ZIP)
  • Source Code (TAR.GZ)