chore(main): release 2.49.0

[github-actions]

🤖 I have created a release beep boop

2.49.0 (2026-09-13)

Features

• upgradinatorr: report upgrades that completed, not grabs (#609) (5f03c0b)

Bug Fixes

• act on the CodeRabbit root-slice review (#628) (#636) (c9d5f83)
• api: close unauthenticated log forging and four input-handling faults (#632) (f8af2d6)
• api: stop non-awaiting handlers from blocking the event loop (#603) (ee8e658)
• config: give config read-modify-write a single owner (#611) (f3c25b9)
• config: refuse settings saves that store a schedule that never runs (#639) (2cb09fe)
• correctness and cost findings across modules, cache and notifications (#634) (b081e9c)
• deps: update all non-major dependencies (c4cd849)
• deps: update all non-major dependencies (4dfb301)
• deps: update all non-major dependencies (#637) (c4cd849)
• deps: update all non-major dependencies (#638) (4dfb301)
• frontend: act on the #625 review for layout, search and toolbar (#640) (9f68bb9)
• jduparr: measure relinks from inodes instead of assuming them (#621) (2ed07c4)
• Lidarr endpoints, year-0 metadata, empty config sections and stale caches (#630) (e25678c)
• posters: make match state transitions atomic (#606) (f5aab1d)
• preview-refresh collisions and the reversed container uid/gid (#612) (6e19078)
• scheduler,nohl: stop blocks re-firing and an unreadable share aborting a run (#633) (22c8d4e)
• security: close fail-open scheduler gate, SSRF rebind and body-flag coercion (#629) (cb85e22)
• settings: stop password managers filling logins into secret fields (#620) (26508f8)
• upgradinatorr: report first acquisitions, not just upgrades (#615) (b8f17bb)

Performance

• batch per-row database writes and bound hot-path allocations (#631) (7fd754e)

Documentation

• correct comments and docstrings that disagree with the code (a94dc9a)
• trim over-length comments to the 1-2 line cap (807cfce)

---

This PR was generated with Release Please. See documentation.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 6c0b6540-68c0-4215-a25d-0fade4c4b571

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}