v1.4.6

1.4.6 (2026-09-17)

Bug Fixes

• ci: pin yt-dlp builds (#58) (ffcbf0a)
• filesystem: propagate File.rmdir errors in empty-directory cleanup (#93) (23f3a17)
• http: cap the size of responses the shared HTTP client buffers (#56) (9495ce3)
• http: match any 2xx status in HTTPClient.get/3 (#87) (cda0106), closes #83
• podcasts: strip XML 1.0 forbidden control characters from RSS feed fields (#88) (d0a78f3)
• rollback: delete ROLLBACK.md and rollback.sh, which describe a different downstream (#95) (74e4820)
• security: deny /dev/dashboard when basic auth is not configured (#105) (fcfbb6c), closes #103
• slow_indexing: stop FileFollowerServer gracefully when watched file is missing or unreadable (#90) (ceaa9c0), closes #85
• sources: ignore unknown sort keys on the sources index instead of crashing (#91) (f6a2e5b), closes #80
• URL-encode API keys and pinned versions in outbound request URLs (#94) (be6c6cb), closes #81

Chores

• diagnostics: show full last-attempt error instead of truncating to 200 chars (#89) (978dd42), closes #86
• diagnostics: use String.to_existing_atom/1 in queue job counts (#92) (d81e4d9), closes #79
• update native loop settings (#104) (839d993)

Documentation

• correct stale references in CONTRIBUTING, CODEBASE, and DEVELOPMENT (#96) (24b359f)