9 Commits

Include renames

Author	SHA1	Message	Date
bvandeusenandClaude Opus 5.5	fcbad3ad40	fix(deps): raise golang.org/x/text to v0.41.0 for GO-2026-6629 ... govulncheck began failing on a new advisory: a panic parsing crafted input in x/text/secure/precis, reachable from db.Open via pgxpool. x/text is indirect (through pgx), so the Dependency Dashboard has no update queued for it. x/text v0.41.0 requires x/sync v0.22.0, which go mod tidy raised with it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-07 15:13:09 -04:00
bvandeusenandClaude Opus 5.5	3217e10168	fix(deps): clear known vulnerabilities in what ships; build on the Go line CI tests (M462 #4984) ... - golang.org/x/text v0.37.0 -> v0.39.0 (GO-2026-5970, infinite loop on invalid input, reachable from pgxpool). x/sync follows to v0.21.0. - web lockfile: in-range updates from `npm audit fix` for devalue (high) and svelte (moderate), both of which ship in the browser bundle. package.json is unchanged. - Dockerfile builder golang:1.25 -> golang:1.26. CI has tested on 1.26 since the ci-go migration while the image was still compiled with 1.25, left over from the April skeleton; the shipped binary now uses the toolchain the tests ran on. govulncheck under golang:1.26-bookworm (go1.26.8) reports 0 vulnerabilities reachable from our code. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-06 09:51:37 -04:00
bvandeusen	c39a9ca18f	feat(server): targeted ScanFiles + fsnotify library watcher ... Add Scanner.ScanFiles (watcher-driven targeted scan returning changed album IDs) and a recursive fsnotify Watcher that debounces filesystem events and enriches just the affected albums inline. Pure classifyEvent/drainPending seams unit-tested; ScanFiles covered in the scanner integration test.	2026-06-06 21:43:27 -04:00
bvandeusenandClaude Opus 4.7	6a62120457	chore(deps): Go server bumps (x/crypto, pgx, migrate, pgerrcode) ... Direct bumps: - golang.org/x/crypto v0.35.0 → v0.51.0 (security backports; single highest-priority bump in the audit) - github.com/jackc/pgx/v5 v5.7.4 → v5.9.2 - github.com/golang-migrate/migrate/v4 v4.18.2 → v4.19.1 - github.com/jackc/pgerrcode 2022-04-16 → 2025-09-07 (untagged pseudo refresh) Side effects (good): - `go mod tidy` dropped three transitives that migrate v4.18 pulled in but v4.19 no longer needs: hashicorp/errwrap, hashicorp/go-multierror, go.uber.org/atomic. Toolchain note: - `go.mod` `go` directive auto-bumped 1.23.0 → 1.25.0 because x/crypto v0.51.0 declares Go 1.25 as its minimum. If the go-ci runner image isn't on Go 1.25+, CI will bounce on this; the runner image bump is operator infra (memory: project_forgejo_ci.md). Tracked in Fable #464. Reference: Fable #464 + audit note #460. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-20 13:02:32 -04:00
bvandeusenandClaude Opus 4.7	46c8edfa82	feat(playlists): gocron-based per-user scheduler ... Builds the per-user daily-at-03:00-local scheduler for #392 Half B. Uses github.com/go-co-op/gocron/v2 with WithLocation(userTZ) for each user's job. Hourly reconciliation pass keeps the in-memory job set in sync with the active-users query. Start sequence: clear stale in_flight rows; register a daily job for every active user at their stored timezone; fire a one-shot runOnce to catch up missed schedules during downtime; start gocron. Stop drains and shuts down the gocron loop. Refresh(ctx, userID) removes the user's existing job (if any) and registers a fresh one at their current timezone — wired into the PUT /api/me/timezone handler and new-user registration in the next commit. Server struct gains PlaylistScheduler; main.go constructs it after the eventbus and threads it through to api.Mount. The existing StartSystemPlaylistCron call stays for one more commit so we don't have a window where no scheduler is running; Task 3 deletes it. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-13 11:57:13 -04:00
bvandeusen	0e727b85b0	M1/#293: go.sum for dhowden/tag	2026-04-19 15:14:56 +00:00
bvandeusen	69ffc32b7d	M1/#292: go.sum tidy for bcrypt	2026-04-19 02:30:27 +00:00
bvandeusen	8041d19dbe	M1/#291: sync go.sum for pgx + golang-migrate deps	2026-04-19 01:11:46 +00:00
bvandeusen	f98b9f66aa	feat(skel): add go.sum for initial dependency set	2026-04-18 21:19:26 +00:00