Recent Commits to buku:master

08/09/2026 21:50

Merge pull request #903 from abyworkings-coder/add-llms-txt

Merge pull request #903 from abyworkings-coder/add-llms-txt

Add llms.txt for LLM/agent-readable project summary

08/09/2026 21:48

Merge pull request #900 from tkossak/fix/prompt-readline-markers

jarun

Merge pull request #900 from tkossak/fix/prompt-readline-markers

Fix interactive prompt: keep reverse-video escape inside readline non-printing markers

16/08/2026 1:31

Remove redundant workflows version declaration

jarun

Remove redundant workflows version declaration

04/08/2026 10:32

Merge pull request #905 from dertuxmalwieder/patch-4

jarun

Merge pull request #905 from dertuxmalwieder/patch-4

Support Vivaldi's test versions ("Vivaldi Internal") as well.

03/08/2026 19:26

Merge pull request #1 from dertuxmalwieder/patch-5

dertuxmalwieder

Merge pull request #1 from dertuxmalwieder/patch-5

updated docs

03/08/2026 11:11

Merge pull request #904 from mgorny/remove-py

jarun

Merge pull request #904 from mgorny/remove-py

Remove unnecessary `py` dependency

01/08/2026 13:18

Remove unnecessary `py` dependency

mgorny

Remove unnecessary `py` dependency

Remove the dependency on `py`, as it is not used anywhere.  `py` is
unmaintained (last release in 2021) and has known vulnerabilities.

Signed-off-by: Michał Górny <mgorny@gentoo.org>

27/07/2026 5:40

Add llms.txt for LLM/agent-readable project summary

Add llms.txt for LLM/agent-readable project summary

08/07/2026 14:22

Fix interactive prompt: keep reverse-video escape inside readline mar…

tkossak

Fix interactive prompt: keep reverse-video escape inside readline markers

The colored prompt brackets its ANSI escapes with RL_PROMPT_START_IGNORE
(\001) and RL_PROMPT_END_IGNORE (\002) so readline does not count them toward
the prompt width. In the reverse-video opener, \002 was placed before the
terminating 'm' of \x1b[7m, leaving 'm' outside the ignore region. readline
counted it as a visible column, making the prompt one column wider than it
renders. That off-by-one shifted readline's input-start position, so Backspace
could not delete the first typed character.

Move \002 to after the 'm' so the whole \x1b[7m sits inside the markers. This
fixes both PROMPTMSG (reverse-video prompt) and the per-DB prompt suffix.

03/07/2026 12:33

Merge pull request #898 from rtmongold/fix_id

jarun

Merge pull request #898 from rtmongold/fix_id

[jarun#894] fix: cannot append or remove tags for single record at pr…

02/07/2026 22:46

[jarun#894] fix: cannot append or remove tags for single record at pr…

rtmongold

[jarun#894] fix: cannot append or remove tags for single record at prompt

29/06/2026 16:21

Merge pull request #897 from rtmongold/fix_sort_order_v

LeXofLeviafan

Merge pull request #897 from rtmongold/fix_sort_order_v

[#895] fix: apply sort order in interactive prompt

29/06/2026 10:35

[jarun#895] fix: apply sort order in interactive prompt

rtmongold

[jarun#895] fix: apply sort order in interactive prompt

_ordering() provided by LeXofLeviafan

13/06/2026 23:12

Merge pull request #892 from LeXofLeviafan/update-functional-test

jarun

Merge pull request #892 from LeXofLeviafan/update-functional-test

updating a functional test to match behaviour changes made in Flask-Admin v2.1.0

13/06/2026 10:51

updated functional test to match behaviour changes made in Flask-Admi…

LeXofLeviafan

updated functional test to match behaviour changes made in Flask-Admin v2.1.0

10/06/2026 11:25

Merge pull request #890 from LeXofLeviafan/auto-import_firefox

jarun

Merge pull request #890 from LeXofLeviafan/auto-import_firefox

adding autoimport support for multiple/custom Firefox profile directories

19/04/2026 15:57

[jarun#882] added autoimport support for multiple/custom Firefox prof…

LeXofLeviafan

[jarun#882] added autoimport support for multiple/custom Firefox profile directories

27/03/2026 13:54

Merge pull request #888 from tranquac/fix/open-redirect-swap

jarun

Merge pull request #888 from tranquac/fix/open-redirect-swap

fix: prevent open redirect in bookmark swap endpoint

27/03/2026 13:37

fix: prevent open redirect in bookmark swap endpoint

tranquac

fix: prevent open redirect in bookmark swap endpoint

Signed-off-by: tranquac <tranquac@users.noreply.github.com>

22/02/2026 6:00

Update action demo link in README

jarun

Update action demo link in README

15/02/2026 13:28

Merge pull request #887 from BrookeYangRui/master

jarun

Merge pull request #887 from BrookeYangRui/master

fix(bukuserver): mitigate Host Name Poisoning via BUKUSERVER_SERVER_NAME

15/02/2026 13:04

fix(bukuserver): mitigate Host header poisoning via BUKUSERVER_SERVER…

BrookeYangRui

fix(bukuserver): mitigate Host header poisoning via BUKUSERVER_SERVER_NAME

Add BUKUSERVER_SERVER_NAME config. When set, Flask uses it for
url_for(_external=True) instead of client-supplied Host header.

Affected: bookmarklet URL. Recommended for production and reverse proxy.

03/01/2026 3:55

Merge pull request #883 from branchv/fix

jarun

Merge pull request #883 from branchv/fix

fix type error and missing apidocs

10/12/2025 3:44

Merge pull request #881 from LeXofLeviafan/sec-fetch-mode

jarun

Merge pull request #881 from LeXofLeviafan/sec-fetch-mode

adding Sec-Fetch-Mode header

01/12/2025 10:53

Merge pull request #878 from branchvincent/docs

jarun

Merge pull request #878 from branchvincent/docs

Fix readthedocs (again)

29/11/2025 0:16

[jarun#879] added Sec-Fetch-Mode header for fetch_data() requests

LeXofLeviafan

[jarun#879] added Sec-Fetch-Mode header for fetch_data() requests

26/11/2025 2:09

Merge pull request #877 from branchvincent/docs

jarun

Merge pull request #877 from branchvincent/docs

Fix readthedocs

25/11/2025 14:10

Add myst-parser as an installable for readthedocs

jarun

Add myst-parser as an installable for readthedocs

23/11/2025 12:14

Add myst-parser as an installable for readthedocs

jarun

Add myst-parser as an installable for readthedocs

21/11/2025 14:33

Update readthedocs python required version

jarun

Update readthedocs python required version

21/11/2025 10:20

Merge pull request #876 from branchvincent/manpage

jarun

Merge pull request #876 from branchvincent/manpage

Install manpage and migrate to pyproject.toml

16/11/2025 6:17

update license, adopt dependency-groups

branchvincent

update license, adopt dependency-groups

PEP 639 introduced a new license metadata form and deprecated the old: https://packaging.python.org/en/latest/guides/writing-pyproject-toml/#license-and-license-files

PEP 735 introduced dependency groups, which are dev-only extras: https://packaging.python.org/en/latest/specifications/dependency-groups/

16/11/2025 6:17

Merge pull request #872 from LeXofLeviafan/flask-admin-v2

jarun

Merge pull request #872 from LeXofLeviafan/flask-admin-v2

migrating to Flask-Admin v2

06/11/2025 12:33

Merge pull request #874 from LeXofLeviafan/rename-main-file

jarun

Merge pull request #874 from LeXofLeviafan/rename-main-file

renaming mentions of main file

06/11/2025 10:30

Merge pull request #873 from LeXofLeviafan/rename-main-file

jarun

Merge pull request #873 from LeXofLeviafan/rename-main-file

renaming the main file

02/11/2025 17:20

Merge pull request #871 from meonkeys/https-if-missing-scheme

jarun

Merge pull request #871 from meonkeys/https-if-missing-scheme

support default uri scheme customization

01/11/2025 21:03

[jarun#753] migrate to Flask-Admin v2

LeXofLeviafan

[jarun#753] migrate to Flask-Admin v2

01/11/2025 1:52

Merge pull request #773 from LeXofLeviafan/bootstrap4

jarun

Merge pull request #773 from LeXofLeviafan/bootstrap4

migrate to Bootstrap v4

31/10/2025 22:36

support default scheme customization

meonkeys

support default scheme customization

This allows the user to specify a scheme that should be used to try to open a bookmark if the bookmark is missing a scheme. E.g. `www.example.com` will be changed to `http://www.example.com` or `https://www.example.com` automatically before an open/browse is attempted.

Originally this patch simply forced opening with https, but it has since been modified to default to either http or https, at the user's preference. The default scheme will continue to be http, for now.

Forcing https by default was a suggestion based mainly on my own use case. I have 3,678 bookmarks. 3,670 use https and 7 use http. Of those 7, at least a couple are dead links and a couple are http-only to prove a point.

I keep "https only" on in my daily driver browser (Firefox) and my alternate browser (Chromium). I can still view http sites if I click through the warning.

I did a few lazyweb searches and found a presentation from the 26th USENIX in 2017:

https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/felt

In the video on that page they cover how https is more often available, used, and even defaulted to for many websites, somewhere around 50-90% depending on how you measure it and where you get your data (and this is back in 2017).

That presentation is about a paper by Felt et al titled "Measuring HTTPS Adoption on the Web":

https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-felt.pdf

One of their data sources is MAWI, so I just peeked at MAWI's latest charts:

https://mawi.wide.ad.jp/mawi/samplepoint-F/2025/202510241400.html

I did some super simple math. I can't say if this is at all valid, but I just compared the first two numbers where I saw http and https and found http is 14.4% of the total and https is 85.6%. Looks like I was comparing ip.tcp.http packets vs. ip.tcp.https packets. So that's something there to look at, I guess.

(83894509 ip https packets + 14072651 ip http packets ) = 97967160 total packets

14072651 ÷ 97967160 = 0.144 = 14.4% http packets

83894509 ÷ 97967160 = 0.856 = 85.6% https packets

MAWI data snippet:

```
Protocol Breakdown

protocol packets bytes bytes/pkt
------------------------------------------------------------------------
total 334771299 (100.00%) 364013578524 (100.00%) 1087.35
ip 288108851 ( 86.06%) 307918329080 ( 84.59%) 1068.76
tcp 125995157 ( 37.64%) 190503802981 ( 52.33%) 1511.99
http 14072651 ( 4.20%) 24776980541 ( 6.81%) 1760.65
https 83894509 ( 25.06%) 150210613012 ( 41.27%) 1790.47
...✂️...
```

Anyway, sorry for all this noise, it's really just breadcrumbs in case someone wants to do actual research.

Also I'm really enjoying buku so far. Thank you for sharing it!

Unit tests pass locally.

No part of this commit log message was AI-generated.

---

add --default-scheme to manpage

---

pass default_scheme into browse() as a keyword arg

Tags: ⭐️

26/10/2025 13:14

[jarun#753] migrate to Bootstrap v4

LeXofLeviafan

[jarun#753] migrate to Bootstrap v4

26/10/2025 10:29

Merge pull request #867 from LeXofLeviafan/improve-bukucrypt

jarun

Merge pull request #867 from LeXofLeviafan/improve-bukucrypt

[API] BukuCrypt improvements

Recent Commits to buku:master (4)