docs(release): record the v26.16.0 release notes #930

Merged

timothy merged 4 commits from release/v26.16.0-notes into main 2026-10-27 20:39:50 +01:00

Conversation 0 Commits 4 Files Changed 3

+16 -13

timothy commented 2026-10-22 08:25:29 +02:00

Owner

Copy Link

Copy Source

Release notes row for v26.16.0: range 736649b3b..1f7b763a7, 24 merged PRs.

Headline: Jellyfin music videos play again (#924/#928). After deploy, existing rows need a deep scan of the Music Videos library (id 16).

Also included: #880 (slipped from v26.15.0), #887 (image builds), #568, #554, #830, plus the Process/CI items. No migrations, no dependency bumps.

Release-boundary checks, 2026-10-22:

• decisions_validate.py: OK. build_decisions_catalog.py: no drift.
• dotnet list package --vulnerable --include-transitive: two advisories published after v26.15.0, carried unchanged and tracked in #929. Neither is new exposure relative to prod.

Docs-only (docs/ci-cd.md).

🤖 Generated with Claude Code

Release notes row for **v26.16.0**: range `736649b3b..1f7b763a7`, 24 merged PRs. Headline: Jellyfin music videos play again (#924/#928). After deploy, existing rows need a deep scan of the Music Videos library (id 16). Also included: #880 (slipped from v26.15.0), #887 (image builds), #568, #554, #830, plus the Process/CI items. No migrations, no dependency bumps. Release-boundary checks, 2026-10-22: - `decisions_validate.py`: OK. `build_decisions_catalog.py`: no drift. - `dotnet list package --vulnerable --include-transitive`: two advisories published after v26.15.0, carried unchanged and tracked in #929. Neither is new exposure relative to prod. Docs-only (`docs/ci-cd.md`). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

timothy added 1 commit 2026-10-22 08:25:30 +02:00

docs(release): record the v26.16.0 release notes ... 02aa05d75b

Range 736649b3b..1f7b763a7 (v26.15.0 was cut at 736649b3b, not at
main's head, because of #887). Headline: Jellyfin music videos play
again (#924/#928). Also carries the #880 recurrence fix that slipped
from v26.15.0, and the #887 image-build fix. No migrations and no
dependency bumps. Two advisories published after v26.15.0 are carried
unchanged and tracked in #929.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: 99d1dedb-f027-4e05-baab-2111f3a7d951

timothy added 1 commit 2026-10-27 19:30:41 +01:00

docs(release): the v26.16.0 cut verifies the positive half of the v* tag protection ... bdd4ed7bad

release.tag-protection-v-star deferred its positive verification to the
next real cut. The v26.16.0 tag push as `timothy` succeeded on
2026-10-27, and GET tag_protections the same day showed rule id 1
unchanged since 2026-09-04, so the push ran with the rule in force. The
record and both ci-cd.md caveats now say so. That a renovate push is
refused remains unverified.

Decisions-Edit: yes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: 99d1dedb-f027-4e05-baab-2111f3a7d951

timothy added 1 commit 2026-10-27 20:06:50 +01:00

docs(release): v26.16.0 notes record the .NET 10.0.14 runtime and the release scan ... e458630f48

The tag build picked up MCR's 10.0.14 aspnet/sdk images (published
2026-10-26), measured inside :26.16.0. ZAP and semgrep results are
recorded as triaged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: 99d1dedb-f027-4e05-baab-2111f3a7d951

timothy added 1 commit 2026-10-27 20:07:10 +01:00

docs(ci-cd): the security scan names its real host, and a skipped semgrep pass is not a passed one ... e61bbb63b5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: 99d1dedb-f027-4e05-baab-2111f3a7d951

timothy merged commit e919b925f8 into main 2026-10-27 20:39:50 +01:00

timothy deleted branch release/v26.16.0-notes 2026-10-27 20:39:51 +01:00

timothy referenced this pull request 2026-10-27 20:59:17 +01:00

security-scan.sh: a missing semgrep must FAIL the release gate, not WARN + exit 0 (and correct the ci-cd.md cause line) #931

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

ad-hoc

One-off / ad-hoc work not tracked by a dedicated issue

api

REST API / HTTP endpoints

bug

Something isn't working

ci-cd

Build, test, deploy pipeline

content

Channel content / schedules / playlists

dependencies

Dependency updates (Renovate)

enhancement

New feature or improvement

frontend

ChicoryTV React SPA frontend

in-progress

Claimed by an active session — do not pick up

jellyfin

Jellyfin tuner / IPTV integration

parked

Excluded from automatic queue pickup; work only when explicitly selected

priority: high

priority: low

priority: medium

review

Adversarial review finding

security

Security / vulnerability fix

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

renovate timothy (Timothy)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: timothy/ersatztv#930