chore(release): add the late fixes to the v1.39.0 changelog

CHANGELOG.md

@@ -4,13 +4,13 @@ All notable changes to Bindery are documented here. Format loosely follows
 [Keep a Changelog](https://keepachangelog.com) and versions follow
 [Semantic Versioning](https://semver.org).
 
-## [v1.39.0] - 2026-09-29
+## [v1.39.0] - 2026-10-01
 
 Calibre that never misses a book, a pull mode for desktop Calibre, and fixes for series volumes and wrong author grabs
 
 Books bound for Calibre now wait in a queue instead of being pushed once and forgotten, so anything imported while Calibre is closed arrives when it comes back, failures retry on their own, and the Calibre tab shows what is waiting and why something failed. Every ebook format of a book now lands on the same Calibre record, and a desktop Calibre can fetch books from Bindery itself with the Bindery Bridge plugin 0.8.0, which needs no shared drive, path remap or open port. A new Windows runbook walks through both setups.
 
-Adding or scanning one volume of a numbered series no longer attaches another volume's file, and a release that names a different author after a series label is no longer grabbed. That author check now runs on every automatic and interactive search, not just a fallback path. Transmission downloads survive a daemon restart, a folder import stops offering files already in your library, and switching metadata providers no longer offers still valid books for removal. This release adds one database migration, additive, which runs on its own at startup.
+Adding or scanning one volume of a numbered series no longer attaches another volume's file, and a release that names a different author after a series label is no longer grabbed. That author check now runs on every automatic and interactive search, not just a fallback path. Transmission downloads survive a daemon restart, rdt-client and other qBittorrent stand ins import automatically again, a folder import stops offering files already in your library, adopting a file suggests every book by its author, and switching metadata providers no longer offers still valid books for removal. This release adds one database migration, additive, which runs on its own at startup.
 
 ### Added
 - **Every ebook format of a book now reaches the same Calibre record with the Bindery Bridge plugin 0.7.0 or later** (#2832). A book with an EPUB and a PDF used to get only one of them into Calibre. Now the preferred format makes the record (EPUB, then KEPUB, AZW3, MOBI, PDF, then the rest) and the others are added to it, from an import and from Push all to Calibre alike. With an older plugin, or in calibredb mode, the extra formats are skipped with a reason telling you to update the plugin, and once you do Bindery delivers them on its own.
@@ -34,6 +34,11 @@ Adding or scanning one volume of a numbered series no longer attaches another vo
 - **A library scan no longer attaches one volume of a series to another** (#2860): the scan matched untracked files to wanted books by how alike the titles look, and two volumes of a numbered series look almost identical. An untracked `Defiance of the Fall 01` folder was attached to a wanted "Defiance of the Fall 17", which was then marked owned with the wrong file and never searched. The scan now compares volume numbers first, whether they appear in the title or only in the book folder, using the same rule as adding a book since #2810. The file goes to the volume it really is, or waits under Import, In your library, where the other volume is no longer suggested for it. Numbers that are part of a title, like Fahrenheit 451 or Catch-22, part numbers on a split audiobook and track numbers inside a numbered folder are not mistaken for volumes. Thanks magrhino for the report.
 - **A series label no longer hides a release's author** (#2863): a release like "Heart of Glass, Skye Druids (03) by Donna Grant EPUB" was grabbed for Jennifer Hillier's "Heart of Glass", because the author check only read "by <author>" when it came straight after the title. It now also reads it after a series name and number, so a same titled book by someone else is dropped, while the right author, an initial ("J. Hillier"), surname first order, or a coauthor still match. Narrator and translator credits are still ignored, and a release with no author at all is kept as before. The check also now runs on automatic and interactive searches, not only on the fallback path. Thanks dallyboytx for the report and the diagnosis.
 - **Manual import scan with a symlinked library folder** (#2868): files already in your library no longer show up as importable when the library folder is reached through a symlink and the file was offline when Bindery last indexed it or has been edited since. The scan tests now pass on macOS and the macOS lint run is clean again. Thanks magrhino for the report.
+- **Automatic import finds files from rdt-client and similar qBittorrent-compatible clients** (#2878): real qBittorrent lists a torrent's files with the release folder in front ("Release/book.m4b"), but rdt-client and other clients that emulate its API list them without it ("book.m4b"). Bindery joined those names onto the save path, looked one folder too high, found nothing, and the import failed even though Manual Import of the same folder worked. When a file is not where the save path says, Bindery now also looks under the torrent's content path, with your path remap applied. Real qBittorrent and single file torrents behave exactly as before. Thanks pmillar80 for the report and the API output that pinned it down.
+- **Import suggestions now offer every book by the matched author** (#2879): an untracked "The Matsumoto - Sarah K. L. Wilson.epub" was offered three other books by her instead of "The Matsumoto", because suggestions on **Import, In your library** only came from books still waiting for a file. A book you had skipped, or one already imported with a file somewhere else, was never offered, however exact the title. Suggestions now come from all of the author's books, an exact title comes first, and each suggestion shows its status. The scan still only attaches files on its own to books that are wanted or missing a file, so nothing changes without you choosing it. A book that already has its files or was skipped is never a one click Confirm, and adopting into a book that already has a file adds the new one alongside it and says so. The author's spelling with or without a space between initials was already treated as the same name. Thanks bhaveman for the report.
+
+### Security
+- **Updated brace-expansion in the web build tooling** to clear GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 and GHSA-6j4f-fj2g-mc7p, denial of service bugs in brace pattern expansion. It is only used by the lint and build tools, not shipped in the app.
 
 ### Docs
 - **The Calibre on Windows runbook now leads with pull mode** (#2834). Pull needs no shared drive, path remap, inbound firewall rule or fixed PC address, so it is the recommended way to connect a desktop Calibre, with push kept for Calibre in a container or on a server. The Calibre docs and the quick answers now describe the delivery queue (books wait while Calibre is closed, failures retry with backoff, Retry failed instead of rerunning Push all), multi format delivery, how to keep the pull key safe, and the plugin status messages seen in a real setup, including why a `localhost` Bindery URL can make every request take about 20 seconds on Windows.