Skip to content

feature/dependency upgrades #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
codebude merged 4 commits into from
Oct 15, 2026
Merged

feature/dependency upgrades #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a2c8003
Update frontend and Python dependency lockfiles with minor safe/upgrades
codebude Oct 14, 2026
5cabc5e
Migrate frontend imports to #lib and upgrade SvelteKit/Vitest
codebude Oct 14, 2026
9eb10e5
Ignore intentional Pydantic deprecation warnings in backend tests
codebude Oct 14, 2026
ecd3758
Document Node.js 22.17 requirement and SvelteKit 3 upgrade
codebude Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,6 +50,8 @@ coverage.xml
.hypothesis/
.pytest_cache/
cover/
# Vitest 5 writes generated reports and artifacts here
.vitest/

# Translations
*.mo
Expand Down
6 changes: 6 additions & 0 deletions backend/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,5 +52,11 @@ pythonpath = ["."]
filterwarnings = [
"error::ResourceWarning",
"ignore::DeprecationWarning:lxml\\.html.*",
# Pydantic emits a DeprecationWarning with the message "deprecated" on every read of a
# field declared with deprecated=True. The legacy `author` field is deliberately
# deprecated in favour of `authors`, and both the router and the tests read it on
# purpose, so this fires ~290 times per run and buries any real warning. The API
# deprecation itself is unaffected: it still warns for library consumers.
"ignore:^deprecated$:DeprecationWarning",
]
addopts = "-ra --cov=app --cov-report term-missing"
2 changes: 1 addition & 1 deletion docs/guide/developer-setup.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ The backend runs on http://localhost:8000 with auto-reload on code changes.
## Local Development — Frontend

Requirements:
- Node.js 20+ (see `frontend/.nvmrc`)
- Node.js 22.17+ (see `frontend/.nvmrc`) — SvelteKit 3 requires it when building the frontend

Steps:

Expand Down
9 changes: 6 additions & 3 deletions docs/releases.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ LibrisLog v1.9.0 brings shareable public profile pages, edition grouping and an

| Version | Date | Type |
|---|---|---|
| [Unreleased](#unreleased-more-book-sources) | — | In development |
| [Unreleased](#unreleased-more-book-sources-upgrades) | — | In development |
| [v1.9.0](#v1-9-0-smarter-import-search-input-ux) | 2026-09-15 | Feature release |
| [v1.8.0](#v1-8-0-camera-zoom-control-optional-telemetry) | 2026-09-02 | Feature release |
| [v1.7.0](#v1-7-0-reading-streaks-goals) | 2026-08-26 | Feature release |
Expand All @@ -36,11 +36,11 @@ LibrisLog v1.9.0 brings shareable public profile pages, edition grouping and an

---

## Unreleased: More Book Sources
## Unreleased: More Book Sources & Upgrades

<Badge type="warning" text="In development" />

**Summary:** Adds three more metadata sources to the import search, brings back coverage for non-English editions that Open Library misses, adds an on/off switch for every import source, and keeps the Add Book dialog header reachable while scrolling.
**Summary:** Adds three more metadata sources to the import search, brings back coverage for non-English editions that Open Library misses, adds an on/off switch for every import source, keeps the Add Book dialog header reachable while scrolling, and updates the frontend framework and dependency set.

**Features**
- 📚 **Bibliothèque nationale de France (BnF)** as a search source, queried over the public SRU endpoint. No API key needed. Strong coverage of French editions: an ISBN such as `9791020923554` returns no result from Open Library but a full record from BnF, with title, subtitle, authors, publisher, year, page count, language, and subject headings. BnF answers one ISBN with several records, including a commercial barcode stub; those are grouped per ISBN so only the richest record is imported
Expand All @@ -55,6 +55,9 @@ LibrisLog v1.9.0 brings shareable public profile pages, edition grouping and an
- 📌 **Sticky Add Book dialog header.** The dialog title and the close button stay pinned to the top of the window while the content scrolls, so closing the dialog no longer requires scrolling back up after a long list of results
- 🔍 **Search results report each source.** The progress list names every source that was queried, including those that were skipped and why

**Dependencies**
- ⬆️ Updated backend and frontend dependencies, most notably SvelteKit 3 and Vitest 5. Building the frontend from source now needs Node.js 22.17 or newer

**Bug fixes / security**
- 🛡️ **Remote SRU responses are parsed with entity expansion disabled.** The BnF and Library of Congress responses are untrusted remote XML and are now parsed defensively, so a hostile or malformed response cannot exhaust memory or read local files through entity references
- 🛡️ **Import rejects cover URLs that point at private addresses.** A book candidate is submitted by the client, so its cover URL is untrusted input. URLs resolving to loopback, private, or link-local addresses are now rejected before download instead of being fetched
Expand Down
Loading
Loading