Patch release with one dependency fix and two follow-ups from the #417 investigation.
Security
- smol-toml raised to 1.7.1 or later in both the app and the website (#422). smol-toml 1.7.0 and below can be made to hang on a malformed TOML document (GHSA-7w5x-hrqm-74c2). The app lockfile had 1.6.0 through astro, which Dependabot does not see; both now resolve to 1.8.0.
Fixes
- Crash recovery no longer resumes a job that is still running (#423). A job older than two hours was treated as interrupted even while it checkpointed every two minutes, so recovery started a second pass over the same repositories alongside the original. Only a missing or stale checkpoint marks a job interrupted now. Every completed item is recorded in the checkpoint instead of one in every few, so a real resume skips exactly what was done, and concurrent progress writes no longer overwrite each other.
- The same upstream repository is no longer imported twice under two sources that point at the same host (#424). An organization pinned to a public-only github.com source next to a personal github.com token produced two rows for one repository, and both mirrored to the same destination in the same batch. Discovery and the import endpoints now identify a repository by host and full name whichever source lists it, and a scheduler pass runs one row per repository, logging any duplicate rows it skips.
Upgrade notes
- Existing duplicate rows are not deleted. The scheduler log names them ("is tracked more than once"); remove the one you do not want from the Repositories page.