v1.2.7

What's Changed

• cloudflared: bump to 2026.10.4 (Cloudflare requires >= 2026.10.2) by @Granitosaurus in #9

Full Changelog: v1.2.6...v1.2.7

v1.2.6

What's Changed

• release: empty NEW.md gets GitHub's generated notes instead of no release by @Granitosaurus in #6
• backup: rclone copy --immutable for an add-only off-site remote (B2) by @Granitosaurus in #7
• cloudflared gets its own env file; app container no longer holds the tunnel token by @Granitosaurus in #8

Full Changelog: v1.2.5...v1.2.6

v1.2.5

What's Changed

• deploy: fetch tags with --force, without --quiet by @Granitosaurus in #4
• deploy: recreate containers via the compose unit, not podman-compose up by @Granitosaurus in #5

Full Changelog: v1.2.4...v1.2.5

v1.2.4

• Releases can now be cut from the GitHub Actions "release" workflow; production deploys new release tags automatically.

v1.2.3

• Security fix: uv 0.13.4 in the image build and CI (GHSA-hq85-5cpj-mr62,
  compromised emSign root CA in uv's bundled trust store).
• invoke redeploy now also recreates cloudflared when docker-compose.yml
  pins a different image than the one running.

v1.2.2

• Supply-chain hardening: Renovate for dependency updates (7-day release
  cooldown), CI with tests, pip-audit and a Trivy image scan; the Dockerfile
  now pins base images by digest, verifies the Tailwind/daisyUI downloads by
  sha256, installs with uv sync --locked and ships without pip;
  cloudflared is pinned instead of :latest.
• Security fixes: certifi 2026.10.19 (PYSEC-2026-4320), multidict 6.9.1
  (PYSEC-2026-4244).

v1.2.1

• The giveaway page now makes it clear that quests are entirely optional:
  the quest box says "Entirely optional, but fun", the login card notes you
  can enter without doing the quest, and the entry checkbox no longer asks
  you to promise to do it.

v1.2.0

• Giveaways that get zero entries now reopen for a fixed 24 hours instead of
  re-running their full original duration (so a 30-day giveaway no longer
  silently restarts for another 30 days).
• Added an "Auto-extend" option on the create/edit forms (on by default) to
  turn that reopen-on-no-entries behavior off per giveaway.
• uv run invoke release now cuts a GitHub release from NEW.md automatically.