2455 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
dgtlmoon	3a71777499	UI - Fixing lots of actions that should be a POST style action which led to a 404 ... Also solves some of GHSA-56fq-63vj-9992 Add-watch-UI should be POST/CSRF protected	2026-09-04 12:38:20 +02:00
dgtlmoon	e0fb224d41	UI - Fixing lots of actions that should be a POST style action which led to a 404 (#4370)	2026-09-04 10:56:23 +02:00
dgtlmoon	050172129e	Translations - support for translation overlays/local translations of existing strings (#4365) ... * Translations - support for translation overlays/local translations of existing strings * Dont forget translations_overlay for pip	2026-09-03 11:15:46 +02:00
dgtlmoon	e573837789	0.60.2 0.60.2	2026-09-03 09:15:35 +02:00
Andrew PeabodyandAndrew Peabody	3d6de42924	fix(conditions): support zero values in condition filtering and json logic conversion (#4362) ... * fix(conditions): support zero values in condition filtering and json logic conversion - Fix filter_complete_rules dropping rules where value is 0/0.0 due to 0 == False in Python - Fix convert_to_jsonlogic raising EmptyConditionRuleRowNotUsable on value=0 due to truthiness check - Fix str != 'None' type comparison typo in convert_to_jsonlogic - Add comprehensive unit tests covering zero value condition filtering, conversion, and execution * chore: re-trigger CI checks --------- Co-authored-by: Andrew Peabody <apeabody@users.noreply.github.com>	2026-09-03 08:57:34 +02:00
dgtlmoonandClaude Opus 5	fbd9472218	fix(api): accept an existing tag UUID in the watch tag field, and deprecate it (#4361) ... `tag` on POST /watch was documented as taking a tag UUID, but the value went to add_tag(title): a UUID silently created a junk tag *titled* with that UUID and never applied the tag the caller asked for. `tags` (UUIDs) was the only thing that worked. - `tag=` now resolves an existing tag UUID to that tag, still falling back to title matching/creation for names. A UUID-shaped value matching nothing is skipped with a warning rather than becoming a group named after a UUID. - Blank tokens ("One,,Two,") no longer store False in watch['tags'] - add_tag() returns False for an empty title and it was appended unguarded. Consumers tolerate it (get_all_tags_for_watch() dictfilt()s over known tags) but it is not valid data. - add_tag()'s title search is extracted to tag_uuid_for_title(), so existence can be tested without creating as a side effect. add_tag()'s contract is unchanged. - api-spec: `tag` is marked `deprecated: true` (so Redoc renders the badge) and states plainly that it takes names, not UUIDs. `tags` now says what it really does - applied verbatim, never creates, unknown UUIDs stored as dangling refs. Rendered docs rebuilt. Every claim in the new field docs is asserted in test_api_tags.py against the real API. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-02 16:46:27 +02:00
dgtlmoonandClaude Opus 5	2669a5cee6	Feature/Watch limit - Adding test (#4360) ... * Env var - PAGE_WATCH_LIMIT enhancements * Rebuild API docs * Bump APi doc version * test: cover PAGE_WATCH_LIMIT across every add path - API create returns 429; API import returns 429 and refuses the batch whole - quick-add and the UI importer flash the limit (importer once per file, not per row) and hand unimported URLs back - clone at the limit no longer KeyErrors - an instance already over the limit still loads from disk and stays editable, only new watches are refused - the Info tab shows the limit only when one is set - add_watch() with no request context returns None instead of raising from flash() - an absent, empty or unparseable env var all mean unlimited Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-02 15:43:59 +02:00
dgtlmoon	68a445df1b	Env var - PAGE_WATCH_LIMIT enhancements (#4359)	2026-09-02 13:37:55 +02:00
dgtlmoon	af234636b9	Watch loading - Dont crawl whole disk, just check each directory for a watch.json/tag.json (#4358)	2026-09-02 11:10:49 +02:00
Andrew Peabody	7708ffa986	fix(llm): support Gemini flash-lite & reasoning models, strip extra_body on 400 retry (#4342) ... - Define _NO_TEMPERATURE_MODEL_KEYWORDS constant and omit temperature=0 on initial request - Omit thinkingConfig in _thinking_extra_body for flash-lite models - Unconditionally strip rejected sampling params and extra_body thinkingConfig on BadRequestError (handling Gemini 400 INVALID_ARGUMENT without named details) - Add comprehensive unit tests in test_llm_client_gemini.py	2026-09-02 10:45:39 +02:00
dgtlmoon	59c9e9e4be	Docs - rebuilding API docs	2026-09-02 10:26:26 +02:00
dgtlmoon	f9e3627d82	Update - pyppeteer-ng to 2.0.0rc16 (#4357)	2026-09-02 10:23:27 +02:00
dgtlmoon	97317398ac	LLM - Per watch/group settings and UI tidyup (#4354) ... * UI - LLM section tidyup * Rebuild translatiosn * UI - Fixing language for prompt adjustement to be more clear * UI - clarify field action * UI - clarify layout for sections * WIP * test tweaks	2026-09-02 10:07:34 +02:00
dgtlmoon	10521dd5e1	UTF-8/Lone Surrogate encoding test improvements related to #4273 (#4353)	2026-09-01 17:55:13 +02:00
dgtlmoon	227b011d73	Memory usage - small improvement by tidying up module imports (#4352)	2026-09-01 17:50:50 +02:00
dgtlmoon	780c8dc8af	Pause Queue - Best to pause it in the watch loop so that it works with very long lists of watches	2026-09-01 17:45:51 +02:00
dgtlmoon	dce6f23cf9	Scheduler+API Bug - if an invalid timezone was set (through edit of watch or API) it could have crashed the scheduler, Added timezone to the official API docs (#4350) ... * Scheduler+API Bug - if an invalid timezone was set (through edit of watch or API) it could have crashed the scheduler, Added `timezone` to the official API docs * adding missing files	2026-09-01 17:00:03 +02:00
dgtlmoon	2b0c5e24e6	Memory - GC freeze after startup to save CPU cycles and improve memory management (#4351)	2026-09-01 16:59:58 +02:00
dgtlmoonandClaude Opus 5	143a0f116f	fix(llm): handle reasoning blocks that aren't a well-formed <think>...</think> pair (#4349) ... Follow-up to #4340. The <think> stripper added there only matches a closed pair, but a reasoning scratchpad routinely contains JSON of its own ("initially I thought {"important": false}, but..."), so any leftover scratchpad lets _extract_json lock onto a discarded intermediate answer. Three shapes slipped through, all of which inverted the verdict to important=false and therefore silently suppressed the notification: - opener stripped by the provider/chat template, only </think> comes back over the wire - <thinking> spelled out in full - unterminated block, i.e. the response was cut off mid-thought by max_tokens The first two are now stripped. The third raises ValueError, because a truncated response holds no answer at all - only the abandoned guess. Raising routes it to the existing handler in evaluator.py, which passes the change through as important rather than dropping it; parse_eval_response deliberately does not catch ValueError, since its own fallback (important=False) would suppress the notification instead. Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-09-01 12:42:16 +02:00
Andrew Peabody	9e54ed3adb	fix(llm): string boolean parsing, reasoning model <think> stripping, and timestamp diff annotation (#4340) ... - Simplify _to_bool using changedetectionio.strtobool.strtobool - Strip <think>...</think> reasoning blocks in _extract_json for reasoning models - Fix _annotate_moved_lines short-circuit so standalone relative timestamps are always annotated - Add comprehensive unit tests in test_response_parser and test_prompt_builder	2026-09-01 11:52:40 +02:00
dgtlmoon	7b61c20e68	Python 3.10 EOL October/2026 - Dropping support - conflicts with jsomschema and litellm (#4347)	2026-08-31 21:19:12 +02:00
dgtlmoon	5e7c9f7aa6	Puppeteer/Playwright CSP bypass - test refactor (#4346)	2026-08-31 16:44:00 +02:00
Andrew Peabody	be75168570	fix(backup): add utf-8 encoding when writing url list files (#4345)	2026-08-31 13:41:46 +02:00
dgtlmoon	9c0dfcd5d5	Merge branch 'master' of github.com:dgtlmoon/changedetection.io	2026-08-31 13:21:59 +02:00
dgtlmoon	83707dc837	Puppeteer fetcher - page crash handler (if there wasnt one, it could have crashed the CDP session)	2026-08-31 13:21:38 +02:00
Andrew Peabody	eb482d1362	deps: update litellm dependency cap (#4341)	2026-08-30 12:01:13 +02:00
JDubbandJustin Willhite	5d9c7c6da7	fix: Browser Steps picker cannot select a <select> nested in a <div> (#4336) ... Add select to the element-priority list in the mousemove handler so a <select> wrapped in a similarly sized <div> resolves to the select instead of the div. The process_selected() branch for a select already exists but was unreachable because the select never became the selected element. Fixes #3440. Co-authored-by: Justin Willhite <5132924+thejdubb02@users.noreply.github.com>	2026-08-27 11:34:06 +02:00
dgtlmoon	c24f338f95	Add watch UI - Tidying up logic around browser selection/visibility	2026-08-26 12:29:55 +02:00
TowyTowyandClaude	5e9a8583e2	Restock detection - fix inverted condition that skipped the OpenGraph availability fallback (#4262) ... * Restock detection - fix inverted condition that skipped the OpenGraph availability fallback get_itemprop_availability() only dug through OpenGraph properties when price was missing OR when availability was ALREADY found - so on pages that expose price via JSON-LD but stock state only via the OpenGraph commerce tags (<meta property="product:availability">), the availability (and currency) was silently dropped. The inner loop already guards each field with 'if not value.get(...)', so the outer gate now matches that intent: dig OpenGraph when any of price/availability/currency is still missing. Co-Authored-By: Claude <noreply@anthropic.com> * Normalise availability after the OpenGraph fallback, not before An availability found via OpenGraph was left raw, so the Facebook commerce spelling 'in stock' never matched the 'instock' test and the product read as out of stock. --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-26 10:59:29 +02:00
Karl Q.	465ff40bde	feat: make Playwright CSP bypass configurable (#4298)	2026-08-25 22:24:10 +02:00
dgtlmoon	bb2e6adece	Add watch UI should show which browser(s) are available and set default browser (#4334)	2026-08-25 20:15:59 +02:00
iG8R	22ab668f83	Add Ukrainian support for the 'In stock'/'Not in stock' status (#4330)	2026-08-24 22:59:20 +02:00
dgtlmoon	c2744dc02e	translations - recompiling	2026-08-24 21:15:45 +02:00
Darek	b3120c2402	Add Polish translation (#4329)	2026-08-24 21:15:14 +02:00
dgtlmoon	d11b584fe4	LIBXML Data integrity fix, libxml must be locked across threads for any XML parsing (#4325)	2026-08-24 19:21:07 +02:00
dgtlmoon	f42da28dab	GHSA-23mp-8222-96fr - reflected XSS in /diff/<uuid>/download-patch via from_version - Using built-in plain text response instead. Reported-by: Mayssare Amakhtari (@cy3erm) ... Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> (#4324)	2026-08-24 16:24:22 +02:00
dependabot[bot]	c5d04a8c96	Build robot - Bump actions/setup-python in the all group across 1 directory (#4291)	2026-08-24 14:55:17 +02:00
dgtlmoon	b1bb5371d5	GHSA-q85w-c766-h5g8 - Advisory for four unprotected routes in price_data_follower, check_proxy and language handling that missing. Reported-by: Mayssare Amakhtari (@cy3erm) Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-24 13:47:31 +02:00
dgtlmoon	fce24780e7	ghsa-gwph-fp79-379w - changedetection.io SSRF protection bypass via CGNAT addresses, also adding to ALLOW_IANA_RESTRICTED_ADDRESSES behaviour.	2026-08-20 18:11:02 +02:00
dgtlmoon	288926b44e	GHSA-4j9m-cxq4-9c36 - Improved validation Stored CSS Injection via tag_colour Field (#4317)	2026-08-20 17:59:02 +02:00
dgtlmoon	50389b0778	GHSA-56fq-63vj-9992 Improved URL filtering (#4315)	2026-08-20 15:49:41 +02:00
dgtlmoon	0956318000	RSS - RSS pubDate is wrong on any non-UTC container: local time is relabelled as UTC - #4309 (#4314)	2026-08-20 15:49:29 +02:00
3 people	01cf56c8fb	feature: allow a watch or group to append to the inherited AI Change Summary prompt (#4294) ... Co-authored-by: snowyukitty <270071858+snowyukitty@users.noreply.github.com> Co-authored-by: dgtlmoon <dgtlmoon@gmail.com>	2026-08-20 15:14:59 +02:00
dgtlmoon	6b9040256a	CSRF - Test fix (#4316)	2026-08-20 15:13:16 +02:00
Nameless-Monster-NerdandNameless-Monster-Nerd	3a7d18dd3c	Move development tools out of runtime requirements (#4280) ... Co-authored-by: Nameless-Monster-Nerd <207905925+Nameless-Monster-Nerd@users.noreply.github.com>	2026-08-20 11:10:52 +02:00
Northern Monkey	4bfce3c4b0	Security: hide the running version from anonymous visitors when a password is set (#2190) (#4306)	2026-08-20 11:09:13 +02:00
dgtlmoon	89a41c0dda	GHSA-3v57-xv5m-v7m7 - Multiple front-end endpoints lacking CSRF protection	2026-08-20 10:59:38 +02:00
dgtlmoon	acc4533f51	Security - GHSA-mh42-m7cg-49fr - Authenticated path traversal to arbitrary file write via the watch processor field (enum bypassed through /imports/import)	2026-08-20 10:56:13 +02:00
dgtlmoon	22efcca529	Update docker-compose.yml - Adding ALLOW_IANA_RESTRICTED_ADDRESSES description	2026-08-20 10:40:01 +02:00
dgtlmoon	811256df98	UI - Change 'Live' to 'Running' makes more sense	2026-08-16 18:32:45 +02:00