calibrain/shelfmark v1.6.2

v1.6.2: Sanding the Edges

on GitHub

A small one. Fixes and housekeeping, and nothing that changes how Shelfmark behaves day to day. A few of these were bugs people reported on phones, Firefox and behind a reverse proxy, and the rest is tightening up around errors, logins and the secret key.

Fixes

• The page no longer goes blank in Firefox when you hover the Stop download button on an in-progress download in the Activity sidebar. Thanks @calibrain, and @TheRealBomber for the report (#1651, fixes #1646)
• The release source tabs in Find Releases get their own row on phones, so Direct Download is no longer cut off when more than one source is set up. Thanks @mietu111 for the report and the screenshot (#1663, fixes #1662) (@splitsec2)
• An HTTPS Transmission address with no port now connects on 443 instead of 9091, so a Transmission published through a reverse proxy works without adding the port. HTTP addresses still default to 9091. Thanks @mvanhorn, and @lbesnard for the report (#1673, fixes #1667)
• When a download fails and its request reopens on its own, the failed release is remembered so the next search doesn't pick it again. A download that failed only because the client couldn't be reached isn't held against the release (#1655) (@splitsec2)
• The Debug and Restart menu items only show to admins. Regular users used to see them with Debug Mode on and got a 403 when they clicked one. With auth off both items are still there (#1653) (@splitsec2)

Security and hardening

• Unexpected errors in the queue, release, metadata and debug endpoints return a short fixed message instead of the raw error text, which could carry file paths or URLs with tokens. The full error still goes to the log (#1643) (@splitsec2)
• The secret key file is created private from the start, instead of being written first and tightened afterwards (#1659) (@splitsec2)
• A login that lands at the same moment as the lockout cleanup no longer makes that cleanup fail (#1658) (@splitsec2)

The image

• Chromium is now 156.0.8078.79, installed from Debian's trixie-security without a pinned snapshot, so it follows what Debian ships instead of going stale (#1648, closes #1635) (@splitsec2)
• oauthlib 4.0.1 for CVE-2026-49272 (#1668). The bug is in oauthlib's server code, which Shelfmark never runs (Apprise only uses it as a client), so no install was exposed
• A round of Python, Docker base image and GitHub Actions dependency bumps

Under the hood

• Docstrings for the route modules that moved out of main.py in v1.6.1 (#1660) (@splitsec2), and a type fix for download_url that got the typecheck job green again (#1649) (@splitsec2)

Full Changelog: v1.6.1...v1.6.2