release: 1.4.6

[github-actions]

🤖 I have created a release beep boop

1.4.6 (2026-09-17)

Bug Fixes

• ci: pin yt-dlp builds (#58) (ffcbf0a)
• filesystem: propagate File.rmdir errors in empty-directory cleanup (#93) (23f3a17)
• http: cap the size of responses the shared HTTP client buffers (#56) (9495ce3)
• http: match any 2xx status in HTTPClient.get/3 (#87) (cda0106), closes #83
• podcasts: strip XML 1.0 forbidden control characters from RSS feed fields (#88) (d0a78f3)
• rollback: delete ROLLBACK.md and rollback.sh, which describe a different downstream (#95) (74e4820)
• security: deny /dev/dashboard when basic auth is not configured (#105) (fcfbb6c), closes #103
• slow_indexing: stop FileFollowerServer gracefully when watched file is missing or unreadable (#90) (ceaa9c0), closes #85
• sources: ignore unknown sort keys on the sources index instead of crashing (#91) (f6a2e5b), closes #80
• URL-encode API keys and pinned versions in outbound request URLs (#94) (be6c6cb), closes #81

Chores

• diagnostics: show full last-attempt error instead of truncating to 200 chars (#89) (978dd42), closes #86
• diagnostics: use String.to_existing_atom/1 in queue job counts (#92) (d81e4d9), closes #79
• update native loop settings (#104) (839d993)

Documentation

• correct stale references in CONTRIBUTING, CODEBASE, and DEVELOPMENT (#96) (24b359f)

---

This PR was generated with Release Please. See documentation.

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M3@https://litellm.jory.dev/v1 (anthropic) — escalated (fast_low_confidence)

Recommendation: approve

This is a release-please generated version bump from 1.4.5 → 1.4.6. The diff is exactly what release-please is supposed to produce on a release PR: a version bump in mix.exs between the x-release-please-start-version / x-release-please-end-version markers, a matching bump in version.txt and .release-please-manifest.json, and a CHANGELOG.md entry enumerating the commits accumulated on main since v1.4.5. No application code, tests, migrations, or schema are touched.

Change-by-change

• .release-please-manifest.json — "1.4.5" → "1.4.6". Matches mix.exs and version.txt. Consistent.
• mix.exs — version: "1.4.5" → version: "1.4.6", inside the release-please markers. Format preserved (line length, quoting, comment markers untouched). No other fields changed. No new compiler-warning surface.
• version.txt — 1.4.5 → 1.4.6. Matches the other two sources of truth.
• CHANGELOG.md — prepends a ## [1.4.6](…) block with Bug Fixes (10), Chores (3), Documentation (1) subsections. The listed commit SHAs (ffcbf0a, 23f3a17, 9495ce3, cda0106, d0a78f3, 74e4820, fcfbb6c, ceaa9c0, f6a2e5b, be6c6cb, 978dd42, d81e4d9, 839d993, 24b359f) are present in the repo history and link to issue/PR numbers (#58, #93, #56, #87/closes #83, #88, #95, #105/closes #103, #90/closes #85, #91/closes #80, #94/closes #81, #89/closes #86, #92/closes #79, #104, #96) that line up with the commits in the repo map and the linked compare metadata. The release date in the body is 2026-09-17, which is unusual (the release image and PR were published before that on the timeline visible in the corpus) but is exactly the date release-please stamps and is the value the author of this PR chose to commit; not a review blocker.

Sources

• Repository map confirms only these four files changed; no hidden edits.
• Release-please-managed file list (mix.exs, version.txt, .release-please-manifest.json, CHANGELOG.md) is exactly what release-please touches by convention (release-please-config.json present at the repo root, not in the diff, so config is unchanged).
• CI: Lint and Test, Build PR Image, and Build RC Image all reported success for the head SHA. That is the gate that enforces mix format --check-formatted, mix credo, --warnings-as-errors, and mix test.
• The previous release (v1.4.5) PR used the same four-file pattern and the same release-please markers, confirming this is the project's expected shape.

Standards Compliance

AGENTS.md §3 (Formatting) and §1 (CI gates) are the relevant blocks:

• CI gate: green per CI status (Lint and Test success). Since the only Elixir change is a single literal in mix.exs between release-please markers and line_length: 120 is satisfied trivially, mix format --check-formatted and --warnings-as-errors cannot regress. No new aliases, no new @impl candidates, no new deprecated calls.
• Formatting: mix.exs change is a 1-line literal swap inside markers — Prettier/Elixir formatter outputs unchanged. CHANGELOG.md, .release-please-manifest.json, and version.txt are mechanical one-liners.
• Docs sync requirement: AGENTS.md says "If a PR changes behaviour documented in AGENTS.md, CODEBASE.md, or DEVELOPMENT.md, the PR must update that doc." This PR changes no behaviour — it only stamps a version. The CHANGELOG entries that do describe behaviour changes were already merged in their respective feature/fix PRs (the contributors correctly updated docs at the source, e.g. PR 96 fixed stale references). A release PR is not the place to retro-edit those.
• Release-please markers: The x-release-please-start-version / x-release-please-end-version comments in mix.exs are intact and bracket exactly the version line that changed — required for release-please to detect the field. ✓

No standards violation.

Tool Harness Findings

The harness issued no tool calls; no tool-derived evidence to weigh. The directly-readable diff is small enough (4 files, 31/-3) that the lack of tool calls is not a coverage gap.

Unknowns or Needs Verification

• The release date in the CHANGELOG heading is 2026-09-17, which is ahead of the v1.4.5 release date (2026-08-25) but does not match the actual merge/publish timestamp visible elsewhere in the corpus. This is a release-please-stamped value authored by the bot and accepted by project convention; not a blocker, noted for completeness.
• Cannot confirm from the corpus that a corresponding GitHub release will be published/edited by the maintainer after merge, but that is the project's release process and outside the scope of this PR review.

must_check

The classifier returned an empty must_check list, and there are no risk_flags. There are no auth, public route, file-serving, path, secret, database-migration, or linked-security-issue changes in this diff — risk_flags are empty. All four modified files are release-please-managed metadata/version files; none of them define code paths or behaviour.

[its-miso]

🤖 Created releases:

• v1.4.6

🌻