release: 1.4.7

[its-miso]

🤖 I have created a release beep boop

1.4.7 (2026-10-13)

Bug Fixes

• keep media references when a file cannot be deleted (#149) (62a519f)
• preserve yt-dlp policy state when binary updates fail (#144) (e9b39a6)
• security: validate PR-image metadata against trusted GitHub run data (#142) (f15c410), closes #139
• stop the OPML access key from ever defaulting to "tmp-token" (#113) (d923a8c)

Chores

• ai-review: upgrade reviewer to v3.2.0 (#136) (d30b713)
• ci: format AI review workflow (#131) (5d55c74)
• ci: stop gh rejecting --slurp with --jq in PR image publish (#146) (94a8223)
• deps: remove vulnerable hackney dependency (#133) (572664c)
• deps: update dependency alpinejs to v3.17.4 (#118) (0e83b3b)
• deps: update dependency dns_cluster to v0.3.1 (#132) (30fbeb1)
• deps: update dependency ecto_sqlite3 to ~> 0.25.0 (#124) (1df7702)
• deps: update dependency ex_check to ~> 0.17.0 (#125) (b2955c5)
• deps: update dependency finch to ~> 0.24 (#126) (190d384)
• deps: update dependency gettext to v1 (#128) (ce2e227)
• deps: update dependency phoenix to v1.8.15 (#120) (87fee83)
• deps: update dependency phoenix_live_view to v1.2.12 (#121) (ea12d7c)
• deps: update dependency prettier to v3.9.9 (#122) (deb65c9)
• deps: update dependency sobelow to ~> 0.16 (#127) (a1e1664)
• deps: update dependency swoosh to v1.28.1 (#123) (e088256)
• deps: update dependency ubuntu to v26 (#129) (a006519)
• deps: update github actions (#117) (d9d6ca1)
• security: declare websocket protections (#134) (fc851bd)

Documentation

• clarify route_token is OPML-only and lock the feed auth model (#148) (b086b6a)

---

This PR was generated with Release Please. See documentation.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3 (anthropic) — primary route · pr-reviewer-action v3.2.0

Partial coverage: required-check coverage is incomplete — this review did not resolve every required check and must not be read as a complete pass.

Recommendation: approve

This is a release-please bot-generated release PR (authored its-miso[bot], branch release-please--branches--main) that performs a clean 1.4.6 → 1.4.7 version bump and regenerates the changelog. All three required CI checks (Build PR Image, Build RC Image, Lint and Test) succeeded for head fff41749.

Change-by-change findings

• .release-please-manifest.json — "1.4.6" → "1.4.7". Single line; matches the pattern release-please uses for a simple release-type repo.
• mix.exs — version: "1.4.6" → version: "1.4.7", still inside the # x-release-please-start-version / # x-release-please-end-version markers (lines 7 / 9). Marker preservation means release-please will continue to detect and rewrite this file on the next cut.
• version.txt — 1.4.6 → 1.4.7. The file is consumed by test/pinchflat/utils/version_utils_test.exs and test/pinchflat_web/controllers/settings/yt_dlp_version_live_test.exs, so the bumped value is what the tests will assert against on the next test run; CI's passing Lint and Test confirms the version string parses consistently with the rest of the app.
• CHANGELOG.md — new 1.4.7 section with 4 bug-fix entries, 15 chore entries (dependency upgrades, CI tweaks, AI-review version bump, websocket-protections declaration, hackney removal), and 1 documentation entry. References track commits via GitHub compare URLs and link back to the corresponding issues. All commits referenced in the changelog (e.g. 62a519f for PR 149, f15c410 for PR 142, d923a8c for PR 113) exist in the git log context provided; the most recent published release on the repo is v1.4.6, making 1.4.7 the next logical cut.

Claims to falsify

• Claim 1 (security: PR-image metadata validation, PR 142 / closes PR 139): the changelog entry at CHANGELOG.md:8 references commit f15c410 and issue PR 142. No code change to validate is in this PR (it lives in the referenced commit); the changelog line is correctly attributed. Held: 1/1 item (the entry is present and correctly formed).
• Claim 2 (route_token docs clarification, PR 148): the changelog entry at CHANGELOG.md:38 references commit b086b6a and issue PR 148. Documentation-only, not in this PR's diff. Held: 1/1 item.
• Claim 3 (keep media references when file cannot be deleted, PR 149): changelog entry at CHANGELOG.md:7 references commit 62a519f and issue PR 149. Held: 1/1 item (changelog attribution correct).
• Claim 4 (CHANGELOG header [1.4.7]): present at CHANGELOG.md:3, compare link points at v1.4.6...v1.4.7, date 2026-10-13 matches the bot author timestamp. Held: 1/1 item.

Sources

• PR Metadata, Related Code Context, Repository Map, PR Files, Version Hints, PR Diff (head)
• CI Check Results: Build PR Image success, Build RC Image success, Lint and Test success on commit fff41749
• Repository Impact Scan: version terms 1.4.7 consistent across .release-please-manifest.json:2, CHANGELOG.md:3, mix.exs:8, version.txt:1
• Repository History: most recent release tag is v1.4.6 (commit 83dfa8e), making 1.4.7 the correct next bump
• release-please-config.json configures release-type: simple with extra-files: mix.exs and pull-request-title-pattern: "release: ${version}", which this PR's title matches

Standards Compliance

The repository standards file (AGENTS.md) requires that behavioural changes update AGENTS.md, CODEBASE.md, or DEVELOPMENT.md. This PR contains no behavioural changes — it only bumps three version strings and regenerates the changelog entry. No doc update is required. The PR does not modify any lib/, test/, or workflow files, so the substantive review gates (Credo naming, alias usage, Oban queue names, allowed fields, path assumptions) do not apply to this diff.

No issues found in this release PR. Approving.

Requirement trace

3 of 5 requirement(s) not fully traced to enforcement and a test:

• req-f082fd28d0b2 — unverifiable (no valid enforcement location)
• req-259d4903f81b — unverifiable (no valid enforcement location)
• req-cec06a117f01 — unverifiable (no valid enforcement location)

Approval withheld: this review's coverage is incomplete — required-check coverage or the tool-loop investigation did not finish, so it is publishing as an advisory comment rather than an approval.