490 Commits

Include renames

Author	SHA1	Message	Date
dgtlmoon	97317398ac	LLM - Per watch/group settings and UI tidyup (#4354) ... * UI - LLM section tidyup * Rebuild translatiosn * UI - Fixing language for prompt adjustement to be more clear * UI - clarify field action * UI - clarify layout for sections * WIP * test tweaks	2026-09-02 10:07:34 +02:00
dgtlmoon	10521dd5e1	UTF-8/Lone Surrogate encoding test improvements related to #4273 (#4353)	2026-09-01 17:55:13 +02:00
dgtlmoon	227b011d73	Memory usage - small improvement by tidying up module imports (#4352)	2026-09-01 17:50:50 +02:00
dgtlmoon	dce6f23cf9	Scheduler+API Bug - if an invalid timezone was set (through edit of watch or API) it could have crashed the scheduler, Added timezone to the official API docs (#4350) ... * Scheduler+API Bug - if an invalid timezone was set (through edit of watch or API) it could have crashed the scheduler, Added `timezone` to the official API docs * adding missing files	2026-09-01 17:00:03 +02:00
dgtlmoonandClaude Opus 5	143a0f116f	fix(llm): handle reasoning blocks that aren't a well-formed <think>...</think> pair (#4349) ... Follow-up to #4340. The <think> stripper added there only matches a closed pair, but a reasoning scratchpad routinely contains JSON of its own ("initially I thought {"important": false}, but..."), so any leftover scratchpad lets _extract_json lock onto a discarded intermediate answer. Three shapes slipped through, all of which inverted the verdict to important=false and therefore silently suppressed the notification: - opener stripped by the provider/chat template, only </think> comes back over the wire - <thinking> spelled out in full - unterminated block, i.e. the response was cut off mid-thought by max_tokens The first two are now stripped. The third raises ValueError, because a truncated response holds no answer at all - only the abandoned guess. Raising routes it to the existing handler in evaluator.py, which passes the change through as important rather than dropping it; parse_eval_response deliberately does not catch ValueError, since its own fallback (important=False) would suppress the notification instead. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-01 12:42:16 +02:00
Andrew Peabody	9e54ed3adb	fix(llm): string boolean parsing, reasoning model <think> stripping, and timestamp diff annotation (#4340) ... - Simplify _to_bool using changedetectionio.strtobool.strtobool - Strip <think>...</think> reasoning blocks in _extract_json for reasoning models - Fix _annotate_moved_lines short-circuit so standalone relative timestamps are always annotated - Add comprehensive unit tests in test_response_parser and test_prompt_builder	2026-09-01 11:52:40 +02:00
dgtlmoon	7b61c20e68	Python 3.10 EOL October/2026 - Dropping support - conflicts with jsomschema and litellm (#4347)	2026-08-31 21:19:12 +02:00
dgtlmoon	5e7c9f7aa6	Puppeteer/Playwright CSP bypass - test refactor (#4346)	2026-08-31 16:44:00 +02:00
Andrew Peabody	be75168570	fix(backup): add utf-8 encoding when writing url list files (#4345)	2026-08-31 13:41:46 +02:00
dgtlmoon	c24f338f95	Add watch UI - Tidying up logic around browser selection/visibility	2026-08-26 12:29:55 +02:00
TowyTowyandClaude	5e9a8583e2	Restock detection - fix inverted condition that skipped the OpenGraph availability fallback (#4262) ... * Restock detection - fix inverted condition that skipped the OpenGraph availability fallback get_itemprop_availability() only dug through OpenGraph properties when price was missing OR when availability was ALREADY found - so on pages that expose price via JSON-LD but stock state only via the OpenGraph commerce tags (<meta property="product:availability">), the availability (and currency) was silently dropped. The inner loop already guards each field with 'if not value.get(...)', so the outer gate now matches that intent: dig OpenGraph when any of price/availability/currency is still missing. Co-Authored-By: Claude <noreply@anthropic.com> * Normalise availability after the OpenGraph fallback, not before An availability found via OpenGraph was left raw, so the Facebook commerce spelling 'in stock' never matched the 'instock' test and the product read as out of stock. --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-26 10:59:29 +02:00
Karl Q.	465ff40bde	feat: make Playwright CSP bypass configurable (#4298)	2026-08-25 22:24:10 +02:00
dgtlmoon	bb2e6adece	Add watch UI should show which browser(s) are available and set default browser (#4334)	2026-08-25 20:15:59 +02:00
dgtlmoon	d11b584fe4	LIBXML Data integrity fix, libxml must be locked across threads for any XML parsing (#4325)	2026-08-24 19:21:07 +02:00
dgtlmoon	f42da28dab	GHSA-23mp-8222-96fr - reflected XSS in /diff/<uuid>/download-patch via from_version - Using built-in plain text response instead. Reported-by: Mayssare Amakhtari (@cy3erm) ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> (#4324)	2026-08-24 16:24:22 +02:00
dgtlmoon	b1bb5371d5	GHSA-q85w-c766-h5g8 - Advisory for four unprotected routes in price_data_follower, check_proxy and language handling that missing. Reported-by: Mayssare Amakhtari (@cy3erm) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-24 13:47:31 +02:00
dgtlmoon	288926b44e	GHSA-4j9m-cxq4-9c36 - Improved validation Stored CSS Injection via tag_colour Field (#4317)	2026-08-20 17:59:02 +02:00
dgtlmoon	0956318000	RSS - RSS pubDate is wrong on any non-UTC container: local time is relabelled as UTC - #4309 (#4314)	2026-08-20 15:49:29 +02:00
3 people	01cf56c8fb	feature: allow a watch or group to append to the inherited AI Change Summary prompt (#4294) ... Co-authored-by: snowyukitty <270071858+snowyukitty@users.noreply.github.com> Co-authored-by: dgtlmoon <dgtlmoon@gmail.com>	2026-08-20 15:14:59 +02:00
dgtlmoon	6b9040256a	CSRF - Test fix (#4316)	2026-08-20 15:13:16 +02:00
Northern Monkey	4bfce3c4b0	Security: hide the running version from anonymous visitors when a password is set (#2190) (#4306)	2026-08-20 11:09:13 +02:00
dgtlmoon	89a41c0dda	GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection	2026-08-20 10:59:38 +02:00
dgtlmoon	acc4533f51	Security - GHSA-mh42-m7cg-49fr - Authenticated path traversal to arbitrary file write via the watch processor field (enum bypassed through /imports/import)	2026-08-20 10:56:13 +02:00
dgtlmoon	6f2e4aa9af	UI - Move rendering of each watchlist row out of the watchlist main template so it can be re-used by the realtime update (#4305)	2026-08-16 18:07:34 +02:00
snowyukittyandsnowyukitty	21f19b239a	fix: avoid division by zero when logging watch load rate (#4289) ... Co-authored-by: snowyukitty <270071858+snowyukitty@users.noreply.github.com>	2026-08-16 14:26:39 +02:00
snowyukittyandsnowyukitty	3e3300896f	fix: invalidate favicon cache when clearing watch history (#4286) ... Co-authored-by: snowyukitty <270071858+snowyukitty@users.noreply.github.com>	2026-08-16 14:24:45 +02:00
dgtlmoon	c3361943aa	Improved content type detection - adding regression test	2026-08-15 18:59:59 +02:00
snowyukittyandsnowyukitty	5d47a0764d	fix: sanitize lone unicode surrogates before filtering JSON (#4293) ... Co-authored-by: snowyukitty <270071858+snowyukitty@users.noreply.github.com>	2026-08-15 17:24:47 +02:00
Jan Kahmen	aac6fcfa59	fix: Visual Selector renders scraped selectors as text, not markup (#4282)	2026-08-04 09:11:33 +02:00
dgtlmoon	fdfa3859ee	Watch history - fix for restock.previous_price returns the first-ever price once a watch has 3+ snapshots (#4268)	2026-07-22 11:23:53 +02:00
Willy Farrell	966f89736b	fix: watches auto-tagged by group url_match_pattern regex missing from group tab filter (#4267)	2026-07-22 08:44:22 +02:00
dgtlmoon	71d332d5a0	UI full refactor / upgrade (#4183)	2026-07-16 15:08:29 +02:00
Ehsan	5eb2638ffc	fix: report the actual 1-based failed browser-step number (#4200) (#4258)	2026-07-14 14:48:36 +02:00
dgtlmoon	a69ddbd787	LLM - Raise or remove LLM timeout when local endpoint detected #4225 (#4254)	2026-07-13 09:50:35 +02:00
Ehsan	aa60984754	fix: safe-empty restock default so restock notification tokens work for any watch (#4249)	2026-07-13 09:26:54 +02:00
TowyTowy	ef0af25d91	fix: don't error watches when Content-Type is JSON but body isn't parsable (#3827) (#4250)	2026-07-13 09:26:35 +02:00
Dokuchaev Konstantin	f292e0d327	Add Russian (ru) translation (#4236)	2026-07-13 08:53:10 +02:00
Amir	5015bfa0cd	fix: URL validation rejects valid URLs with '|' in the anchor/fragment (#4209) (#4243)	2026-07-06 19:27:59 +02:00
Adam Medziński	3f0d944e97	fix: ensure all RSS endpoints bypass global auth when using token (#4235)	2026-06-28 10:50:00 +02:00
dgtlmoon	24da66f92c	Restock - Threshold change since "first check" was working really as "since last check", update UI, tests, field name.	2026-06-18 12:01:41 +02:00
dgtlmoon	f58d004070	Restock - test fix	2026-06-18 10:49:24 +02:00
Charles RossiandCharles Rossi	be4718f2b8	fix: extract <title> from pages with large <head> sections (#4217) (#4220) ... Co-authored-by: Charles Rossi <charles@choreless.dev>	2026-06-15 13:52:28 +02:00
dgtlmoon	d7a1b67c5a	UI - LLM - Fix for settings (wtforms vs pydantic) (#4184)	2026-05-25 18:43:33 +02:00
dgtlmoon	08017d66d6	Security - SSRF in ChangeDetection.io via urlparse/urllib3 Parser Differential	2026-05-25 17:57:41 +02:00
dgtlmoon	0e3f1941b3	Code - LLM settings pydantic refactor (#4181)	2026-05-25 10:43:52 +02:00
dgtlmoon	701833b6ed	UI - LLM - Flag LLM_FEATURES_DISABLED to disable all LLM from the UI/system (#4171)	2026-05-21 12:51:56 +02:00
dgtlmoon	43bb196aa4	UI - Preview problem fix for extract_text/ignore_text #4138 (#4169)	2026-05-20 13:57:17 +02:00
dgtlmoon	649c153bf4	Notifications - Fix 'str' object is not callable when {{ diff(...) }} callable tokens are used with HTML/htmlcolor output (#4161)	2026-05-19 18:09:28 +02:00
dgtlmoon	624dee60d5	API Security - Watch GET history snapshot - Should return text/plain mimetype so it cant be accidently executed in the browser (#4158)	2026-05-19 11:36:42 +02:00
dgtlmoon	00d26e3656	UI - LLM - SSRF guard for the LLM api_base setting (#4157)	2026-05-19 11:05:02 +02:00