Pullbox v1.0.0

What's Changed

The first stable release. Pullbox 1.0 is a complete, self-hosted comic library
manager: pull list automation, weekly release discovery, a matching engine built
for how comics actually get named, and the operational depth to run unattended
on your server.

Library & Collection

• Series management with eleven distinct series types, including annuals, trade
  paperbacks, omnibuses, hardcovers, one-shots, and more, so collections
  organize the way comics actually work.
• Pull list monitoring: mark a series monitored and new issues are searched,
  grabbed, and filed automatically.
• Review-first collection import: scan a folder, match against ComicVine,
  resolve conflicts and duplicates explicitly, then import with full rollback.
• Mylar3 importer: reads a Mylar3 database strictly read-only, preserves its
  ComicVine matches as high-confidence imports, and preserves external source
  folders during import.
• File-level tracking with naming templates per series type, configurable
  transfer methods, and ComicInfo.xml metadata writing.

Acquisition

• Five download clients with full lifecycle management: SABnzbd, NZBGet,
  qBittorrent, Transmission, and Deluge.
• Indexer support: Prowlarr integration plus direct Newznab and Torznab
  connections, with health checks and per-indexer priority.
• Matching engine: a three-stage parse, match, validate pipeline developed
  against a corpus of more than 20,000 real-world release names, with an
  intervention queue for ambiguous matches instead of silent wrong grabs.
• Universal blocklist across all client types, with configurable expiry,
  wildcard release-group patterns, and per-series clearing.
• Two-pass search with configurable thresholds, size guardrails, scoring
  weights, and ignored-phrase filters.

Weekly Release Discovery

• What's New: this week's releases, filterable by publisher.
• Coming Soon: upcoming weeks, with graceful offline fallback to cached data.

Metadata

• ComicVine integration with your own free API key, encrypted at rest, with
  aggressive caching and internal rate limiting to stay well inside ComicVine's
  limits.

Utilities

• Seven built-in tools, job-queue backed with live progress: File Converter,
  Mass Convert, Mass Rename, Integrity Check, Library Permissions, DB Check &
  Cleanup, and Export Library.

Operations

• Health dashboard covering database, filesystem, ComicVine, clients, indexers,
  scheduler, and system resources, with actionable guidance on failures.
• One-click diagnostics packages with secrets redacted.
• Scheduled database backups with retention and restore.
• Audit log of security-relevant events.
• Full REST API behind the same auth as the UI, with an interactive reference
  served from the instance at /docs.

Security & Runtime

• Ships on Python 3.14 using Docker Hardened Images, running as a fixed non-root
  user with a minimal attack surface.
• Encrypted credentials at rest, CSRF protection, tiered rate limiting, bcrypt
  password hashing, signed sessions, and API keys stored as hashes.
• Native HTTPS with your own certificates, or reverse-proxy friendly with
  trusted-proxy support.
• Multi-architecture images for amd64 and arm64 on GHCR and Docker Hub.
• Anonymous usage telemetry that is opt-in, off by default, and documented
  field-by-field on the public transparency page.

Interface

• Light and dark themes with system-preference detection.
• Responsive layout from phone to desktop.
• Targets WCAG 2.2 AA with automated contrast, keyboard, focus, and axe
  regression checks.

Commit Details

✨ Features

• support issue file replacement workflows

🐛 Bug Fixes

• harden issue replacement cancellation
• address release review findings
• show intervention bulk action progress
• force history issue links to navigate
• stagger metadata refresh schedule
• show pointer cursor on library file rows
• report manual import transfer progress
• keep partial-catalog duplicates importable
• refresh import review after series override
• strip parenthesized webrip metadata
• weight step 2 import eta
• preserve collection import sources
• protect imports from scheduler contention
• reload search history diagnostics after navigation
• stabilize search on add annual handling
• align dashboard outcomes table contract
• rename bulk utility preview badges
• stabilize download history detail toggle
• cache versioned cover images
• show pointer cursor on pagination controls

🧪 Testing

• align ci expectations with current import behavior

🧰 Chores

• prepare v1.0.0 release

🏗️ CI / Build

• bump actions/setup-python in the actions-all group

🐳 Docker Images

docker pull ghcr.io/pullboxapp/pullbox:1.0.0
docker pull docker.io/pullbox/pullbox:1.0.0

Digest: sha256:859d2a7bf37249c823585e5381094ec4e48b04e4a5061ff38e6723893cae4e66

🔐 Image Verification

Release images are signed with keyless Sigstore/Cosign using GitHub Actions OIDC.
These commands verify the exact multi-architecture image digest published by this release.

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.0$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  ghcr.io/pullboxapp/pullbox@sha256:859d2a7bf37249c823585e5381094ec4e48b04e4a5061ff38e6723893cae4e66

cosign verify \
  --certificate-identity-regexp '^https://github.com/pullboxapp/pullbox/\.github/workflows/docker-release\.yml@refs/tags/v1.0.0$' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  docker.io/pullbox/pullbox@sha256:859d2a7bf37249c823585e5381094ec4e48b04e4a5061ff38e6723893cae4e66

Full Changelog: v1.0.0-rc1...v1.0.0