tippr v0.26.0

✨ Features and improvements

• Paste is no longer used: the error pages, static files and per-request objects (c, g, request) it
  provided are tippr's own now (r2/config/middleware.py, pylons/); PasteDeploy, which reads the ini, stays.
  Updating a server, from /admin/servers or with the installer, uninstalls Paste.
• About 30 fewer Python packages: baseplate no longer needs formenergy-observability, which brought in Dagster (a
  data pipeline framework) and capped packaging below 25; the two tracing helpers it used are in baseplate now.
  Updating a server uninstalls them, and packaging is current (26.3).
• Current Python packages: OpenTelemetry 1.45 (was 1.28), protobuf 7, Pillow 13, wrapt 2, grpcio 1.85, pytest 9,
  and python-json-logger 4 and pyrate-limiter 4 through tippr's baseplate (which now needs Python 3.10 or newer);
  the rest are at their newest too. python-dateutil stays at 2.9, as botocore needs. importlib_metadata and zipp,
  which nothing needs any more, are uninstalled on update, and so is Whoosh, a search library nothing used.
• A check that a server's tippr is up: scripts/smoke_check.sh checks the services the server runs, a few pages
  (the front page, login, the API, an error page, a POST) and the web app's log, and says what failed. The
  installer's CI runs it after installing, so an install that finishes with a broken site fails.
• Package updates from Dependabot: weekly pull requests for newer Python packages and GitHub Actions, with
  packages that move together (OpenTelemetry, boto3 and botocore, grpcio and protobuf) in one. CI installs the exact
  pins as a release would and tests them, and patch updates that pass are merged automatically, once master's
  ruleset requires the checks (.github/workflows/dependabot-automerge.yml).

🐞 Bug fixes

• Domain listings (/domain/example.com) redirected to a broken address: every one went to
  /domain/b'example.com'/ instead of listing the domain's posts. They list them again, and an international domain
  name still goes to its xn-- form.
• Uploading an app's icon (/prefs/apps) gave an error: the resized icon was written as text, which Python 3
  refuses, so no app could have an icon. It's saved as a PNG again.
• "Exclude custom vaults" (/me/f/all) gave "you broke tippr" to gold members: its sidebar asked for the
  filtered vaults by their name from before vaults were renamed. It lists them again, to add to or remove.
• Filtering a vault out of /all didn't take effect for a minute, and could show someone else's filter: the
  spread-out /v/all hot list was cached by the page's address, which is /me/f/all for every member. It's cached by
  the vaults left out now.
• Top and controversial listings never updated when tippr runs as a user other than tippr: the database
  password file named the Linux user instead of the database's, so the job that computes them couldn't connect and
  failed every 15 minutes. Updating rewrites the file.

Downloads

• Docker: docker pull techidiotsllc/tippr:0.26.0, or unpack tippr-0.26.0-compose.tar.gz, copy
  .env.example to .env, fill it in and run docker compose up -d (docker/README.md).
• Proxmox: tippr-0.26.0-proxmox-amd64.tar.zst is an LXC template with the whole site installed;
  create a container with the site's domain as its hostname and start it (docs/PROXMOX.md).
• Installer (Ubuntu 24.04): unpack tippr-0.26.0-installer.tar.gz into /home/tippr/src and
  run sudo TIPPR_USER=tippr TIPPR_DOMAIN=example.com ./install-tippr.sh in tippr/; it doesn't need
  to clone anything (docs/INSTALL_tippr.md).

SHA256SUMS lists the files' checksums.