From fb6075f9f4b97a31fc5627567d6663093dfef742 Mon Sep 17 00:00:00 2001
From: Christian Tabedzki <35670232+tabedzki@users.noreply.github.com>
Date: Sat, 17 Oct 2026 09:18:22 -0400
Subject: [PATCH 1/2] chore: bump version to 1.4.1rc1

Release candidate so the Docker image picks up the Panel session-leak fix
(#65) and the per-click gc.collect stall fix plus watchdog (#66). The
v1.4.0 image leaks ~27-30 MB per closed session; an overnight scanner
built ~160 sessions and pushed prod RSS to 4.45 GB against a 4500M cap.

CITATION.cff stays on 1.4.0, the archived JOSS release.

Assisted-by: ClaudeCode:claude-opus-5-5
---
 pixelmap/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pixelmap/__init__.py b/pixelmap/__init__.py
index 42aaeb3..0cc510f 100644
--- a/pixelmap/__init__.py
+++ b/pixelmap/__init__.py
@@ -7,6 +7,6 @@
 
 from .backend import *
 
-__version__ = "1.4.0"
+__version__ = "1.4.1rc1"
 __author__ = "Maxime Beau"
 __email__ = "maxime@princeton.edu"

From 33084f8c3d13f1cdcab9db4c4ae0566fb9c5b3b8 Mon Sep 17 00:00:00 2001
From: Christian Tabedzki <35670232+tabedzki@users.noreply.github.com>
Date: Sat, 17 Oct 2026 10:18:21 -0400
Subject: [PATCH 2/2] ci: don't push the latest image tag for pre-releases

Tags with a PEP 440 pre-release or dev marker (a, b, rc, dev; e.g.
v1.4.1rc1) now publish only their own image tag. Prod runs `latest`
under Watchtower, so before this an RC tag rolled straight out to prod.
Final releases (vX.Y.Z) still update `latest`.

Assisted-by: ClaudeCode:claude-opus-5-5
---
 .github/workflows/docker-publish.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 0f1cbea..b945795 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -37,9 +37,12 @@ jobs:
       uses: docker/metadata-action@v5
       with:
         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+        # Pre-releases (PEP 440 a/b/rc/dev, e.g. v1.4.1rc1) get only their
+        # own tag, never `latest`: prod pulls `latest` via Watchtower, so an
+        # RC must not roll out on its own. contains() is case-insensitive.
         tags: |
           type=ref,event=tag
-          type=raw,value=latest
+          type=raw,value=latest,enable=${{ !contains(github.ref_name, 'a') && !contains(github.ref_name, 'b') && !contains(github.ref_name, 'rc') && !contains(github.ref_name, 'dev') }}
 
     - name: Build and push Docker image
       id: build