Query the npm registry for the exact local version instead of comparing only with the latest dist-tag.
Report unpublished packages accurately and avoid spawning pnpm for each lookup.
Declare compatible Artalk ranges and npm repository metadata for the pending plugin versions.
Correct ESM and CommonJS declaration exports, trim plugin-kit package contents, and validate package types in CI.
Replace the long-lived npm token with GitHub OIDC credentials, verify the release version, and retain pnpm packaging so the published tarball still includes the repository license.
Pass the resolved release commit into Docker builds, verify every checkout against it, and derive image version metadata and sha tags from the packaged source instead of the workflow invocation commit.
Resolve automatic releases from the merged release PR commit and require an explicit immutable commit when recovering a missing tag. Reuse existing tags idempotently, restore annotated release tags, and reject duplicate release preparation or inconsistent version files.
Create lightweight release refs directly at the checked-out commit so the v* linear-history rule evaluates the commit instead of an annotated tag object. Resolve existing tags through the remote API, verify their exact target without overwriting them, and accept an explicit version for safe manual release retries.
Keep the movable nightly tag while replacing the release, verify its exact commit through the Git refs API, and pass the build SHA as the release target. This avoids the tag visibility race caused by deleting and immediately recreating the tag before --verify-tag.
Treat cache writes as best-effort after a successful database query. Keep database errors authoritative and cover both paths with a failing store.
Fixes#1154
Represent control characters with reversible dashboard escapes, keep custom separators intact, and reject empty separators before loading keyword files. Document and test the full YAML round trip.
Fixes#1062
Generate a unique RFC 5322 message identifier for every SMTP and sendmail message, using the sender domain when valid and a safe fallback otherwise.
Fixes#1111
Protect checksum globs and quote test artifact paths for ShellCheck. Pass release versions to Perl through the environment instead of interpolating shell variables into the program text.
Inject the requested release version and commit hash through Go linker variables so Docker images report the version they were built for, and make release preparation update the linkable version variable.\n\nAssert the version in release image smoke tests and trim unused files from Docker build contexts while preserving both prebuilt-UI and full frontend build paths.
Run Go tests natively on Linux AMD64, Linux ARM64, and macOS; reduce the frontend matrix while keeping Node 22, Node 24, and Windows coverage; and make type-entry validation blocking.\n\nAdd the Playwright browser UAT flow to CI, pin test tools, isolate architecture-specific caches and artifacts, and cancel superseded pull-request runs.
Pin every third-party action to an immutable commit, enforce least-privilege tokens, avoid persisted checkout credentials, and validate all user-controlled values before they reach scripts.\n\nKeep dry-run GoReleaser jobs tokenless, publish npm provenance, generate tags through authenticated GitHub API calls, disable shared caches for release artifacts, and continuously audit workflow syntax and security policy.
Run AMD64 and ARM64 Docker builds on native GitHub-hosted Linux runners, reuse architecture-scoped BuildKit caches, and merge validated image digests after both builds succeed.\n\nMake manual dry runs build, smoke-test, and upload artifacts without exposing DockerHub credentials or replacing the nightly tag and release.
Build Docker images once per native AMD64 and ARM64 runner, merge immutable digests into the release manifest, and reuse a single UI artifact across architectures.\n\nKeep dry runs local by separating the source ref from the release version, avoid remote tags and package publication, scope reusable-workflow secrets, and smoke-test each image before publication.
Use the current English development-page labels and the configured base URL. Register the POST response wait before submission to avoid missing fast responses.
Point Playwright directly at tests/e2e so Vitest unit suites are not collected as browser tests. The Chromium project now discovers only the intended comment UAT spec.
Treat YAML null values as empty arrays before checking for YAML node serialization. This prevents the settings page from throwing while mounting optional array preferences.
Site and user scoped comment responses intentionally omit the page object. Only enforce page data for page-scoped requests and skip page state updates when it is absent.
Add regression coverage for sidebar scopes and the normal page flow.
Record the backend, frontend, container, and CI dependency refresh in both v2.10.0 release guides.
Explain JWT wire compatibility, the sanitizer replacement, patched transitive pins, generator reproducibility, and unchanged release artifact layout.
Pass the event ref through the environment instead of interpolating expression data into the shell, validate the derived semantic version, and quote Git refs and environment files.
Use rev-parse for an exact tag existence check before creating and pushing the release tag.
Regenerate the Swagger specification and TypeScript client with the pinned generators, including accurate optional response fields and the verified-email SSO description.
Validate comment-list page data at the API boundary and normalize it back to the public ListData contract before storing or emitting the response.
BREAKING CHANGE: Beyond #997, #1007, and #1011, v2.10.0 changes default config/data discovery and relative-path semantics; raises source builds to Go 1.26.5; replaces the CGO-backed SQLite driver with a pure-Go implementation; fixes application timezone at process initialization, requiring a full restart to change it; removes the useBackendConf opt-out and remoteConfModifier; changes DI registration, Context mutation, update() return value, and created timing; and requires marked 18 with modern package resolution. Migration guide: https://artalk.js.org/en/guide/releases/v2.10.0.html
Update checkout, setup, cache, artifact, Docker, CodeQL, Codecov, repository-dispatch, and supporting GitHub Actions to their current major releases.
Move the builder and runtime images to Go 1.26.5 on Alpine 3.24 while preserving workflow inputs and release artifact layout.
qwqcode