Block a user
Review follow-ups: PR #564 — fix(web/imports): resume lands on the step the seller left, and warns before a re-match wipes decisions
Review follow-ups: PR #561 — fix(web/imports): quiet the export-wide printing note; bound the busy-resolve retry per chunk
Review follow-ups: PR #560 — fix(web/imports): say why a row is flagged or set aside, and what accepting it does
Review follow-ups: PR #558 — fix(web/imports): honest error messages, resume once per batch, retry the busy resolve
Database transactions held open during external API calls
Shipped to prod 2026-09-24 02:45 UTC: GitHub PRs #555 + #556 (merge 1c8b0685, promote-prod green, /public/card 200). Covers the scan routes, the auth dependency (every authenticated request), and…
Review follow-ups: PR #557 — fix: accept sort=recent alias on GET /inventory/items (mobile home widget 422)
Review follow-ups: PR #556 — fix: release read transactions before external calls app-wide (Gitea #796 follow-up)
Review follow-ups: PR #554 — feature: inventory at 300k items — server-side paging, search indexes, stored sort metrics (stacked on #538)
Review follow-ups: PR #553 — fix: revoke JWTs on password change + logout-all (Gitea #795)
Invalidate JWTs when password is changed
Fix is up for review: https://github.com/Gambit-Inc/gambit/pull/553
Tokens now carry a per-user version (users.token_version, migration 0050). Changing, resetting or owner-setting a password…
Per-account rate limit on login/password endpoints (IP limit alone is bypassable)
Make get_current_user async and update DELETE /auth/me
Add missing timeouts for DB queries, transactions, and Celery tasks
Database transactions held open during external API calls
Invalidate JWTs when password is changed
Review follow-ups: PR #549 — fix(import): widen seller-typed import columns to TEXT (migration 0050)
Review follow-ups: PR #548 — feat(import): hidden and headerless sheets visible and mappable; header_rows pointer (W4-B2)
Review follow-ups: PR #544 — feature: shared private storage + volume copy for the R2 switch (Gitea #425)
Review follow-ups: PR #545 — fix: wipe vendor import spreadsheets on account deletion (audit Security #3)
Review follow-ups: PR #546 — feat(import): mapping screen shows what the adapter reads; overrides layer on top (W4-B1)