* fix: address open issues #169, #170, #173#170 — Stored XSS via library folder names: folder.name was interpolated
raw into innerHTML in the folder render path. Escape it with the existing
esc() helper (catalog.js), matching the track render paths.
#173 — SoundCloud SSRF surface: drop the on.soundcloud.com share shortener
from the host allowlist (it redirects to arbitrary targets) and add a
yt-dlp extractor allowlist (allowed_extractors=[youtube, soundcloud]) so a
URL that slips past host validation can't invoke the generic extractor.
#169 — Version stuck at 0.6.0-alpha.2 for source/Docker/self-hosted: make
the version git-tag-derived via hatch-vcs (pyproject dynamic version,
app/_version.py build artifact). app_version() now reads package metadata
-> _version.py -> dev placeholder; static/version.json is removed (now a
build artifact, gitignored). Install sites pin SETUPTOOLS_SCM_PRETEND_VERSION
from the release version so shallow CI clones / Docker (no .git) don't break
(Dockerfile, make-runtime-pack.sh, make-portable.ps1). make-app.sh defaults
VERSION to `git describe`. Desktop version literals (Cargo.toml, package.json,
tauri.conf.json) are now 0.0.0 placeholders stamped from the tag at build.
The update-check no longer nags dev/source builds.
Tests: 81 passed; ruff clean; app_version derives correctly.
* build: exclude generated app/_version.py from ruff
The hatch-vcs build hook writes app/_version.py during uv sync, and CI's
`ruff format --check app/` tripped on it (it's gitignored but present on
disk during lint). Add it to ruff's exclude list.
* ci: make git-derived version resilient to CI's shallow clone (#169)
CI runs uv sync in every step, which builds the editable package and
triggers hatch-vcs/setuptools_scm. On Woodpecker's shallow, tagless clone
setuptools_scm raises ("unable to detect version"), failing the lint step
before ruff runs (and skipping the rest).
- Set SETUPTOOLS_SCM_PRETEND_VERSION=0.0.0 in the uv-based CI steps so the
build never invokes git for the version (CI only lints/tests, never ships).
- Add hatch-vcs fallback-version as a second safety net for shallow source
installs outside CI.
Verified: uv sync --frozen --all-extras succeeds with the env set.
* feat: validate library folder names (reject symbols/markup)
Folder names now accept only letters (any language), digits, spaces, and a
small safe punctuation set (- _ ' & ( ) . ,). Names with markup or symbols
(e.g. the XSS probe, or ±!@£$%^&*()_+{:"|?><) are rejected on Save with an
inline message instead of being created. Complements the render-time escaping
from #170 by blocking such names at the source.
* feat: raise folder name limit to 100 chars + enforce in validator
Bump the editor input maxlength from 48 to 100 and reject over-length names
on Save with an inline message (defensive, in case the cap is bypassed).
Tha.Les
ff66e15e6c