Update sharp from 0.35.3 to 0.35.5 and its matching prebuilt binaries, addressing GHSA-wq5f-xc86-pv6w and GHSA-rgj7-g3m4-5g8c (Dependabot alerts #273 and #256).
Verified npm ci reports zero vulnerabilities and sharp renders the existing sponsors SVG to an 800x570 PNG. No application dependencies or workflow configuration changed.
Always showing the lot was too bulky. It now sits behind "Show lot
numbers" in the Filter menu, next to the archived and no-spools
toggles, off by default. When on, every spool row in any grouping ends
its details line with the lot. Like showEmpty it lives in the URL (lots=1)
and is remembered per browser, since it only adds to what's shown.
The parallel per-platform builds shared one uv cache mount, so they
queued on uv's cache lock. When uv.lock changed, the emulated armv7
sync held it long enough for the others to hit uv's 300 s lock timeout
and fail publish-images.
The filament picker loaded up to 1000 filaments once and filtered them
in the browser, so anything past the first 1000 could not be printed.
It now works like the spool picker: 100 per page with the same pager
and sort, search through the backend, and All adding the current page.
Spools of one filament looked alike in the grouped list, with only the
usage status to tell them apart. Add the lot number after it when the
spool has one. A long lot is cut by the existing ellipsis, with the full
text on hover. Flat rows and other groupings are unchanged.
It came in by accident with the sponsors workflow change and nothing
imports it. Removing it also drops urllib3, reactivex, six and
python-dateutil from the image.
Backend via uv lock --upgrade, client and client_v2 via npm update.
SQLAlchemy stays on 2.0.x: 2.1 is in range, but sqlalchemy-cockroachdb
2.0.4 requires <2.1 and uv would otherwise downgrade the dialect to
2.0.3, which lacks that cap. Paraglide stays on 2.23.0: 2.27.0 (with
@inlang/sdk 4) hangs compiling the inlang project.
PATCH /location/{location} returned 404 for names like "Shelf 1/2",
even URL-encoded, because the path is decoded before routing and the
default converter stops at a slash. Use the path converter.
The import only looked for a vendor by external_id, so a manufacturer
the user had created by hand was missed and a duplicate was made. Fall
back to the existing case-insensitive name match before creating one.
Both external_id lookups now send a quoted term, since the filter is a
substring match otherwise and "Prusa" would match "Prusament".
The add-spool form and the new-filament flow turned a typed 0 into
"not set", so a spool or filament could not store a tare or price of 0
and fell back to the filament or vendor value instead. Blank still means
not set; 0 is now sent as 0. Comma decimals go through parseDecimal.
Dependabot and Weblate branches are excluded from push runs, and the
root jobs skipped same-repo pull_request runs, so their PRs got no
checks and stayed blocked. Let those PRs run the pull_request suite.
Weblate PRs are now merged by a Monday schedule instead of as soon as
each sync goes green, to cut down the merge commits on master.
Donkie