ipx 1.5.0, ipx-directory 1.4.0 and ipx-web 1.3.0

The security audit's 26 findings, three dependency advisories and the
performance issues found in traces (#318-#352), each already deployed
as a -dev build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Cargo.lock

@@ -1860,7 +1860,7 @@ checksum = "791930b43c0d5973160d90a8f3894509f2b273430f5c5c73b668636d0287c5c0"
 
 [[package]]
 name = "ipx"
-version = "1.4.1-dev"
+version = "1.5.0"
 dependencies = [
  "ammonia",
  "anyhow",
@@ -1894,7 +1894,7 @@ dependencies = [
 
 [[package]]
 name = "ipx-directory"
-version = "1.3.1-dev"
+version = "1.4.0"
 dependencies = [
  "ammonia",
  "anyhow",

crates/directory/CHANGELOG.md

@@ -10,6 +10,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.4.0] - 2026-10-23
+
 ### Fixed
 
 - A WordPress.com site that answers its feed with a browser check (HTTP 403) is read from WordPress.com's API instead of failing (#317).
@@ -83,7 +85,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - `ipx-directory`, a directory of public podcasts that ipx servers share: each sends the public feeds its people subscribe to, and any server with a token browses them, each feed listed once it has been read. Tokens are in its config file, each read-only, read-write or admin, and revoked one at a time (#204, #205).
 - Traces: a span a request, joining the trace of the ipx server that called, and a trace a refresher round with a span a feed (#213).
 
-[unreleased]: https://git.sdf1.net/rays/ipx/compare/directory-v1.3.0...main
+[unreleased]: https://git.sdf1.net/rays/ipx/compare/directory-v1.4.0...main
+[1.4.0]: https://git.sdf1.net/rays/ipx/compare/directory-v1.3.0...directory-v1.4.0
 [1.3.0]: https://git.sdf1.net/rays/ipx/compare/directory-v1.2.0...directory-v1.3.0
 [1.2.0]: https://git.sdf1.net/rays/ipx/compare/directory-v1.1.1...directory-v1.2.0
 [1.1.1]: https://git.sdf1.net/rays/ipx/compare/directory-v1.1.0...directory-v1.1.1

crates/directory/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ipx-directory"
-version = "1.3.1-dev"
+version = "1.4.0"
 edition.workspace = true
 publish = false
 

crates/ipx/CHANGELOG.md

@@ -12,14 +12,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.5.0] - 2026-10-23
+
 ### Changed
 
 - Traces show more of where a request's time goes: a page of items' query and its files apart, artwork's cache, check and fetch, the status counts, and each part of changing or leaving a feed (#350).
 - A page of items finds its files by feed as well as item: it read every file's row in the database, about a quarter of a second a page (#344).
 - A page of items asks for its count beside the items, and the feed list asks its five questions at once, where each waited for the one before (#346).
-- A Signal's count of items and of unread ones are worked out in one pass, not two (#348).
+- A Signal's counts of items and of unread ones are worked out in one pass, not two (#348).
 - Artwork kept on disk is read and written off the threads that answer requests, and two requests for the same missing artwork fetch it once (#345, #349).
-- Unread lists and counts read a feed's items from each person's oldest unread one on, which the daily cleanup works out, not the whole back catalogue, and unread counts are worked out feed by feed, without reading everything you have read (#347, #352).
+- Unread lists and counts start from each person's oldest unread item in each feed, which the daily cleanup works out, instead of reading the whole back catalogue and everything you have read (#347, #352).
 
 ### Fixed
 
@@ -921,7 +923,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Torrent enclosures through librqbit, seeding to a ratio or a time, with a stall timeout.
 - `ipx import` and `ipx export` for OPML, and systemd units in `contrib/`.
 
-[unreleased]: https://git.sdf1.net/rays/ipx/compare/v1.4.0...main
+[unreleased]: https://git.sdf1.net/rays/ipx/compare/v1.5.0...main
+[1.5.0]: https://git.sdf1.net/rays/ipx/compare/v1.4.0...v1.5.0
 [1.4.0]: https://git.sdf1.net/rays/ipx/compare/v1.3.0...v1.4.0
 [1.3.0]: https://git.sdf1.net/rays/ipx/compare/v1.2.0...v1.3.0
 [1.2.0]: https://git.sdf1.net/rays/ipx/compare/v1.1.0...v1.2.0

crates/ipx/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "ipx"
-version = "1.4.1-dev"
+version = "1.5.0"
 edition.workspace = true
 publish = false
 

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "ipx-web",
-  "version": "1.2.1-dev",
+  "version": "1.3.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "ipx-web",
-      "version": "1.2.1-dev",
+      "version": "1.3.0",
       "dependencies": {
         "@fortawesome/fontawesome-free": "7.3.1",
         "@swc/core": "^1.16.2",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "ipx-web",
-  "version": "1.2.1-dev",
+  "version": "1.3.0",
   "private": true,
   "description": "Builds the ipx web pages from web/src (web/build.mjs, run by build.rs) and tests them. The Rust tests cover the server.",
   "scripts": {

web/CHANGELOG.md

@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-10-23
+
 ### Fixed
 
 - An item opens from the keyboard and with a screen reader: its title is a button. The feed list's rows and the Directory's shows are links to a screen reader, the open one marked current (#298).
@@ -111,7 +113,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - On a phone, the Subscribe button on a Directory feed's page is full size again, not squashed to a sliver (#212).
 
-[unreleased]: https://git.sdf1.net/rays/ipx/compare/web-v1.2.0...main
+[unreleased]: https://git.sdf1.net/rays/ipx/compare/web-v1.3.0...main
+[1.3.0]: https://git.sdf1.net/rays/ipx/compare/web-v1.2.0...web-v1.3.0
 [1.2.0]: https://git.sdf1.net/rays/ipx/compare/web-v1.1.0...web-v1.2.0
 [1.1.0]: https://git.sdf1.net/rays/ipx/compare/web-v1.0.2...web-v1.1.0
 [1.0.2]: https://git.sdf1.net/rays/ipx/compare/web-v1.0.1...web-v1.0.2