- apk upgrade in runtime stage to fix OpenSSL CVEs (CVE-2025-15467 CRITICAL, CVE-2025-69419 HIGH)
- remove npm from runtime image to eliminate npm-bundled CVEs
- update fastify to 5.8.5 and force via pnpm override (CVE-2026-33806 HIGH)
- switch vitest pool to threads to fix flaky audio extractor tests
- simplify unit test setup with direct instantiation
- resolve all 69 client type-checking errors for stricter TS compliance
- remove obsolete type-check baseline scripts and files
- overhaul project root with updated README.md and new DEVELOPMENT.md
- migrate to unified baseline migration strategy and cleanup docker configs
- remove redundant production and dev-specific shell scripts
- replace shared 'providerId' key in pickedSources with provider-specific
field names (googleBooksId, goodreadsId, etc.) so each provider's ID
pick is independent and not overwritten when switching tabs
- extract candidate relevance scoring into candidate-relevance.ts with
Levenshtein-based title/author scoring, ISBN exact match, and junk
title filtering; remove duplicate inline scoring from goodreads provider
- add audiobook reader with playback queue, progress tracking, and audio settings
- add narrator support with DB schema, module, and metadata extraction
- add Audible and Audnexus metadata providers with mappers and tests
- improve scanner with file classification, walk utilities, and file-event processing
- extend upload validator and processor for audio formats
- audit_log table with action, resource, resourceId, description, ip, countryCode, meta
- AuditEventsService (EventEmitter), AuditRepository, AuditService, AuditInterceptor
- @Auditable decorator wired on all mutating endpoints across every controller
- auth events (login, logout, register, password change, failed login) emitted directly in AuthService with IP capture
- geoip-lite for offline IP-to-country resolution
- nightly retention cleanup via cron with configurable audit_retention_days setting
- superuser-only GET /audit-log endpoint with userId, action, resource, date range filters
- AuditLogPage.vue with table, filters, pagination, and failed-auth row highlighting
- regenerated baseline migration to include audit_log in 0000_baseline.sql
- add CODEOWNERS assigning .github/ to @neonsolstice
- configure automated updates for npm, docker, and github-actions ecosystems
- replace custom change-detection bash script with dorny/paths-filter@v4
- consolidate lint, typecheck, and test into a single checks matrix job
- gate per-package change detection via has-changes step (matrix unavailable in job-level if)
- fix duplicate actions/setup-node call in setup-node-pnpm composite action
- scope pnpm store cache key by pnpm version to prevent stale cross-version cache hits
- pin all action references to commit SHAs
- fix container-image concurrency group to use commit SHA across all trigger types
- add timeout-minutes to all jobs
- document fail-fast: false rationale and checks: write trade-off
- add tooltips to all header icons (search, upload, appearance, settings, theme toggle, sidebar trigger)
- fix appearance popover by moving Tooltip outside Popover
- add POST /api/books/export endpoint to zip and download books
- add POST /api/books/bulk-refresh-metadata and bulk-re-extract-cover endpoints
- add BulkBookIdsDto and ExportBooksDto
- add archiver dependency for zip streaming
- update theme CSS variables and component styles across client
- add URI versioning: global prefix changed to api/v1, all frontend call sites updated
- add AbortSignal.timeout to all outbound fetch calls (10s API, 15s scrapers)
- add X-Request-Id response header and requestId field in error payloads
- add response compression via @fastify/compress (gzip + brotli)
- add security headers via @fastify/helmet with CSP for the Vite SPA
- tune pg pool: max 20, idle/connection/statement timeouts on app and migration pools
- add GET /api/v1/health endpoint via @nestjs/terminus with DB connectivity check
neon