mikeknight85/PriceStalker v2.1.0-beta.12 on GitHub

One fix, for a regression this project shipped a day earlier.

What was wrong

2.1.0-beta.11 took the client-hint full version from the Chrome/ token in the User-Agent. That is correct for the "Chromium" brand entry in Sec-CH-UA, and wrong for Sec-CH-UA-Full-Version, which carries the browser's own number. So Opera announced the Chromium version it is built on rather than its own.

Found by measurement rather than reasoning, by @Mootjelh in #229: a local server sending Accept-CH, and Opera GX 136 on Chromium 152 replying 136.0.6008.67.

Chrome and Edge were never affected, because for them the two numbers coincide. Even for Opera the exposure was narrow — only a high-entropy Sec-CH-UA-Full-Version probe could observe it.

The same capture also settled a question the previous release had left open, and confirmed beta.11 was right about it: the GREASE brand is seeded from the Chromium major, not the browser's own. "Not?A_Brand";v="24" is the entry for 152; seeded from Opera's 136 it would have been "Not.A/Brand";v="99".

Also in it

Two more real Sec-Ch-Ua strings in the identity tests, reaching four of the six entries in Chromium's brand-order table.
greaseBrand is no longer exported from either copy of the user-agent module.

Upgrading

ghcr.io/mikeknight85/pricestalker-backend:2.1.0-beta.12
ghcr.io/mikeknight85/pricestalker-frontend:2.1.0-beta.12
ghcr.io/mikeknight85/pricestalker-scraper:2.1.0-beta.12

No schema change. Migration 020_canonical_items.ts is still the highest, so upgrading is just pulling the tag, and rolling back is re-pinning it.
No behaviour change for users. Unlike beta.11, nothing here can start rejecting a URL that previously worked.
This is a prerelease: it publishes :2.1.0-beta.12 and moves :beta. stable and latest stay where they are.

If you are coming from 2.1.0-beta.10 or earlier

beta.11 was a large release — sixteen issues — and it carries one change that affects existing installs: products tracking a loopback or link-local URL will start failing their scheduled refresh, as a consequence of the SSRF guard in #207. Set ALLOW_INTERNAL_SCRAPING=true if you have any. LAN addresses are unaffected. See the CHANGELOG for the full list.