Repository navigation
Conversation
Release candidate so the Docker image picks up the Panel session-leak fix (m-beau#65) and the per-click gc.collect stall fix plus watchdog (m-beau#66). The v1.4.0 image leaks ~27-30 MB per closed session; an overnight scanner built ~160 sessions and pushed prod RSS to 4.45 GB against a 4500M cap. CITATION.cff stays on 1.4.0, the archived JOSS release. Assisted-by: ClaudeCode:claude-opus-5-5
tabedzki
force-pushed
the
tabedzki/chore/release-1.4.1
branch
from
October 17, 2026 13:20
a1e0831 to
fb6075f
Compare
tabedzki
changed the title
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #70 +/- ##
=======================================
Coverage ? 69.57%
=======================================
Files ? 20
Lines ? 3119
Branches ? 0
=======================================
Hits ? 2170
Misses ? 949
Partials ? 0 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Tags with a PEP 440 pre-release or dev marker (a, b, rc, dev; e.g. v1.4.1rc1) now publish only their own image tag. Prod runs `latest` under Watchtower, so before this an RC tag rolled straight out to prod. Final releases (vX.Y.Z) still update `latest`. Assisted-by: ClaudeCode:claude-opus-5-5
tabedzki
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 AI text below 🤖
Two commits:
chore: bump version to 1.4.1rc1: a release candidate whose image includespn.state._viewsleak)gc.collectstall and adds the stall/RSS watchdogci: don't push the latest image tag for pre-releases:docker-publish.ymlused to push:latestfor everyv*tag. Prod runs:latestunder Watchtower, so an RC tag would have rolled straight out. Now tags containing a PEP 440 pre-release or dev marker (a,b,rc,dev;contains()is case-insensitive) publish only:<tag>. FinalvX.Y.Ztags still update:latest. I checked the rule against every existing tag: onlyv0.0.1a1andv0.1.1-devare treated as pre-releases.Why now: prod is running the
v1.4.0image, which predates both fixes. Overnight on 2026-10-16/17 an internal vulnerability scanner (172.17.100.3, ~9k 404s) built ~160 Bokeh sessions. Each one leaked ~27–30 MB, and RSS peaked at 4447 MB against the 4500M container limit before the scan stopped. It sat at ~3.3 GB afterwards with no users connected.CITATION.cffstays on 1.4.0 because it points at the archived JOSS/Zenodo release.After merge, tag
v1.4.1rc1on the merge commit. That publishesghcr.io/m-beau/pixelmap:v1.4.1rc1only. Pin prod to it to test.