* ci: pin third party actions to commit SHAs
A tag or branch ref is a movable pointer, whoever controls the action
repository can repoint it and the next run executes their code with
this repo's secrets, here the Docker Hub tokens and the container
publish path. The March 2025 tj-actions/changed-files incident
(CVE-2025-30066) worked exactly that way. Each pin keeps the resolved
tag in a comment and dependabot's weekly github-actions config bumps
SHA pins like tags, so they self-maintain. The pypi publish action
moves from the floating release/v1 branch to its current release.
* ci: declare least-privilege workflow permissions
Without a permissions block every job token inherits the repository
default scope. Each workflow now declares what it uses. The test and
build workflows get read-only tokens, CodeQL keeps its code scanning
upload, the container publish job keeps packages write for the ghcr
push, and the pypi publish job already carried its own id-token block
for trusted publishing, untouched.
* ci: pass release metadata to inline scripts through env
The two debug steps interpolated the release tag name and the
workflow_run branch directly into bash. Those strings are event
metadata that can carry shell syntax, and the workflow runs on
release events with the publish credentials in reach. Routed through
env they arrive as plain data, output unchanged.
* ci: stop persisting the checkout token in .git/config
actions/checkout writes the job token into .git/config so later steps can
push. None of these 21 jobs push with git: the containers are published
with registry credentials, PyPI uses trusted publishing, and the test
and CodeQL jobs only read the tree. A token left in .git/config is one
more credential for a compromised step or a packed artifact to pick up,
so each checkout now sets persist-credentials: false.
Multi-language / Translations Support (#3696)
- Complete internationalization system implemented
- Support for 7 languages: Czech (cs), German (de), French (fr), Italian (it), Korean (ko), Chinese Simplified (zh), Chinese Traditional (zh_TW)
- Language selector with localized flags and theming
- Flash message translations
- Multiple translation fixes and improvements across all languages
- Language setting preserved across redirects
Pluggable Content Fetchers (#3653)
- New architecture for extensible content fetcher system
- Allows custom fetcher implementations
Image / Screenshot Comparison Processor (#3680)
- New processor for visual change detection (disabled for this release)
- Supporting CSS/JS infrastructure added
UI Improvements
Design & Layout
- Auto-generated tag color schemes
- Simplified login form styling
- Removed hard-coded CSS, moved to SCSS variables
- Tag UI cleanup and improvements
- Automatic tab wrapper functionality
- Menu refactoring for better organization
- Cleanup of offset settings
- Hide sticky tabs on narrow viewports
- Improved responsive layout (#3702)
User Experience
- Modal alerts/confirmations on delete/clear operations (#3693, #3598, #3382)
- Auto-add https:// to URLs in quickwatch form if not present
- Better redirect handling on login (#3699)
- 'Recheck all' now returns to correct group/tag (#3673)
- Language set redirect keeps hash fragment
- More friendly human-readable text throughout UI
Performance & Reliability
Scheduler & Processing
- Soft delays instead of blocking time.sleep() calls (#3710)
- More resilient handling of same UUID being processed (#3700)
- Better Puppeteer timeout handling
- Improved Puppeteer shutdown/cleanup (#3692)
- Requests cleanup now properly async
History & Rendering
- Faster server-side "difference" rendering on History page (#3442)
- Show ignored/triggered rows in history
- API: Retry watch data if watch dict changed (more reliable)
API Improvements
- Watch get endpoint: retry mechanism for changed watch data
- WatchHistoryDiff API endpoint includes extra format args (#3703)
Testing Improvements
- Replace time.sleep with wait_for_notification_endpoint_output (#3716)
- Test for mode switching (#3701)
- Test for #3720 added (#3725)
- Extract-text difference test fixes
- Improved dev workflow
Bug Fixes
- Notification error text output (#3672, #3669, #3280)
- HTML validation fixes (#3704)
- Template discovery path fixes
- Notification debug log now uses system locale for dates/times
- Puppeteer spelling mistake in log output
- Recalculation on anchor change
- Queue bubble update disabled temporarily
Dependency Updates
- beautifulsoup4 updated (#3724)
- psutil 7.1.0 → 7.2.1 (#3723)
- python-engineio ~=4.12.3 → ~=4.13.0 (#3707)
- python-socketio ~=5.14.3 → ~=5.16.0 (#3706)
- flask-socketio ~=5.5.1 → ~=5.6.0 (#3691)
- brotli ~=1.1 → ~=1.2 (#3687)
- lxml updated (#3590)
- pytest ~=7.2 → ~=9.0 (#3676)
- jsonschema ~=4.0 → ~=4.25 (#3618)
- pluggy ~=1.5 → ~=1.6 (#3616)
- cryptography 44.0.1 → 46.0.3 (security) (#3589)
Documentation
- README updated with viewport size setup information
Development Infrastructure
- Dev container only built on dev branch
- Improved dev workflow tooling
dependabot[bot]