I didn’t have a sec to fix it yet, but I gave Claude an investigation task on this:
StashNotifications False Update Bug — Root Cause Analysis
## Summary
The stashNotifications plugin shows false update notifications for scrapers/plugins that are already at their latest version. The root cause is **not in the plugin itself** — it’s in how `build_site.sh` generates version identifiers for the package index.
## The Bug
`build_site.sh` generates version strings using git’s abbreviated commit hash format:
```bash
# CommunityScrapers - build_site.sh line 36
version=$(git log -n 1 --pretty=format:%h – “$versionFile”)
# CommunityScripts - build_site.sh line 32
version=$(git log -n 1 --pretty=format:%h – “$dir”/*)
```
The `%h` format produces a **short hash whose length is not stable over time**. Git uses the minimum number of hex characters needed to uniquely identify a commit within the repository. As the repo grows (more commits are added), git may need more characters to maintain uniqueness.
## How It Manifests
1. User installs a scraper when the index lists version `3f254b5` (7 chars). This gets saved to their local manifest.
2. More commits are added to the repo. The index is regenerated (e.g., because a different scraper was updated).
3. Git now produces `3f254b51` (8 chars) for the **exact same commit** — it needs the extra character for uniqueness in the larger repo.
4. Stash fetches the new index: `source_package.version = “3f254b51”`, compares to local `manifest.version = “3f254b5”` — strict string mismatch.
5. Both stashNotifications and Stash’s own package manager UI show a false update notification.
## Why It Wasn’t Always Broken
This is a progressive issue. The short hash length only changes when enough new commits accumulate to create potential ambiguity. Repos that are small or slow-growing may never hit it. But CommunityScrapers/CommunityScripts have enough activity that the abbreviated hash length has shifted over time.
## Where the Fix Belongs
The fix needs to happen in `build_site.sh` in both repositories:
- `stashapp/CommunityScrapers/build_site.sh` (line 36)
- `stashapp/CommunityScripts/build_site.sh` (line 32)
The version generation needs to produce a stable identifier that doesn’t change based on repo size.
## Data Flow Reference
For context, here’s how the version flows through the system:
1. `build_site.sh` writes `version: ` to `index.yml` (the remote package index)
2. Stash fetches `index.yml` via `pkg/pkg/repository_http.go` → populates `RemotePackage.Version`
3. At install time, `pkg/pkg/manager.go` copies `RemotePackage.PackageVersion` directly to `Manifest.PackageVersion` and saves it locally
4. Later, `internal/api/resolver_query_package.go` serves both values via GraphQL: `pkg.version` (from local manifest) and `pkg.source_package.version` (from fresh remote index)
5. The stashNotifications plugin compares these with strict equality (`!==`) — which is a perfectly reasonable comparison; the data it receives is just inconsistent