fallenbagel 53e77bf347 Merge commit from fork ...

User.settings is an eager relation, so it rode along into every response embedding a User, exposing
pushover, pushbullet, telegram, discord and PGP values through the request, issue, issue comment,
blocklist, and watchlist endpoints. It now omits it by using User.toJSON(). GET /auth/me builds
settings from seven non-credential fields the web app reads, so locale and region defaults keep
working. Reported as a security advisory, GHSA-8j73-j6rc-q8xh.

2026-09-28 07:06:04 +08:00

..

db.ts

test: support server-side unit testing (#2485)

2026-03-12 18:39:41 +05:00

index.mts

fix(requests): scope download status to requested seasons on request cards (#3412)

2026-09-05 09:33:21 +02:00

runWithMockTimers.ts

test: add scanner update rate override for testing (#3241)

2026-09-13 07:32:51 +08:00

setup.ts

test: block outbound HTTP in unit tests (#3511)

2026-09-14 14:36:57 +05:00

userSettings.ts

Merge commit from fork

2026-09-28 07:06:04 +08:00