skunky-art.git, branch v1.3.6

Bump docker/metadata-action from 5 to 6 (#8)

2026-07-15T16:05:15+00:00

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5 to 6. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/v5...v6) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bump docker/login-action from 3 to 4 (#7)

2026-07-15T16:04:50+00:00

Bumps [docker/login-action](https://github.com/docker/login-action) from 3 to 4. - [Release notes](https://github.com/docker/login-action/releases) - [Commits](https://github.com/docker/login-action/compare/v3...v4) --- updated-dependencies: - dependency-name: docker/login-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bump actions/checkout from 4 to 7 (#6)

2026-07-15T16:04:29+00:00

Bumps [actions/checkout](https://github.com/actions/checkout) from 4 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v4...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bump docker/setup-buildx-action from 3 to 4 (#5)

2026-07-15T16:04:08+00:00

Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 3 to 4. - [Release notes](https://github.com/docker/setup-buildx-action/releases) - [Commits](https://github.com/docker/setup-buildx-action/compare/v3...v4) --- updated-dependencies: - dependency-name: docker/setup-buildx-action dependency-version: '4' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bump docker/build-push-action from 6 to 7 (#4)

2026-07-15T16:03:50+00:00

Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 6 to 7. - [Release notes](https://github.com/docker/build-push-action/releases) - [Commits](https://github.com/docker/build-push-action/compare/v6...v7) --- updated-dependencies: - dependency-name: docker/build-push-action dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix: use commas in the viewport meta content

2026-07-15T16:00:25+00:00

The viewport directives were separated with a semicolon, which browsers reject: "';' is not a valid key-value pair separator". Drop the duplicated trailing user-scalable directive that the semicolon introduced.

fix: serve media again by unsetting download-proxy and scoping Host per request

2026-07-15T08:17:09+00:00

Two independent faults made every image fail while pages still rendered. config.example.json shipped download-proxy=http://127.0.0.1:8080. Only media fetches go through that proxy — pages reach DeviantArt via devianter on the default transport — so when nothing listens there, images 502 and the rest of the page looks fine. In a scratch container 127.0.0.1 is the container itself, so the default could never work under Docker. Unset it and document that it must stay empty unless an operator really runs a proxy. Host was a package global reassigned by every request, so a concurrent request could overwrite it mid-render and emit URLs on another origin's host and port. The instance's own default-src 'self' CSP then blocked those images. Thread the request's host through skunkyart instead, and take it as an explicit argument in URLBuilder, ParseMedia, ParseDescription, BuildUserPlate and ConvertDeviantArtURLToSkunkyArt. Feeds keep their absolute URLs. Also start RefreshInstances after ExecuteConfig rather than before it: the goroutine read CFG while json.Unmarshal was writing it (a race the detector flags), and its fetch escaped both the throttle and the configured User-Agent. Verified: 300 concurrent requests with distinct Host headers now round-trip their own host (was 1 leak per 300), go test -race is clean, and cache+proxy both enabled serves 200 image/jpeg cold and from cache.

ci: publish multi-arch image to GHCR on release tags

2026-07-15T07:55:52+00:00

Build and push linux/amd64 + linux/arm64 images to ghcr.io/zerolabsco/skunky-art on every v* tag, with a signed provenance attestation. The Dockerfile cross-compiles from $BUILDPLATFORM, so the arm64 image builds without QEMU emulation. Default both compose examples to the published image and keep `build: .` commented out for building from a checkout, and extend dependabot to the github-actions and docker ecosystems.

docs: correct advertised proxifying flag and instance list link

2026-07-15T07:49:48+00:00

The published entry for zerolabs.sh claimed proxifying was off while the instance runs with proxy enabled, so /about advertised the opposite of what the instance does. The instance list is fetched from main at runtime, so this corrects the live about page without a rebuild. Also point the instances.json link at skunky-art/main, which is what the app actually fetches, rather than the old SkunkyArt/dev path.

build: bump builder image to Go 1.25

2026-07-15T07:44:24+00:00

go.mod requires go 1.25.0, but the Dockerfile still pinned the builder to 1.18, which cannot parse a three-part version string and failed with "invalid go version '1.25.0': must match format 1.23". Track the 1.25 tag rather than a patch release so the builder does not drift out of date again.