5 Commits
Author SHA1 Message Date
fallenbagel 53e77bf347 Merge commit from fork
User.settings is an eager relation, so it rode along into every response embedding a User, exposing
pushover, pushbullet, telegram, discord and PGP values through the request, issue, issue comment,
blocklist, and watchlist endpoints. It now omits it by using User.toJSON(). GET /auth/me builds
settings from seven non-credential fields the web app reads, so locale and region defaults keep
working. Reported as a security advisory, GHSA-8j73-j6rc-q8xh.
2026-09-28 07:06:04 +08:00
fallenbagel abe2f3bb80 test: block outbound HTTP in unit tests (#3511) 2026-09-14 14:36:57 +05:00
Michael Thomas 7a76142ae3 test: add scanner update rate override for testing (#3241) 2026-09-13 07:32:51 +08:00
0xsysr3ll c604bccc00 fix(requests): scope download status to requested seasons on request cards (#3412) 2026-09-05 09:33:21 +02:00
Michael Thomas 8563362588 test: support server-side unit testing (#2485) 2026-03-12 18:39:41 +05:00