From d16cc7e025821f9aee5c7b87dd93cef6bf3de9d2 Mon Sep 17 00:00:00 2001
From: Martin Varga <martin.varga@lutraconsulting.co.uk>
Date: Fri, 9 Oct 2026 16:42:54 +0200
Subject: [PATCH 1/2] Chore: Add .tool-versions and handle .envs for local
 development

---
 .gitignore     |  3 +++
 .tool-versions |  2 ++
 development.md | 19 ++++++++++++++++---
 3 files changed, 21 insertions(+), 3 deletions(-)
 create mode 100644 .tool-versions

diff --git a/.gitignore b/.gitignore
index 285ccd36..59e5ee15 100644
--- a/.gitignore
+++ b/.gitignore
@@ -40,3 +40,6 @@ docker-compose.local.yml
 CLAUDE.md
 # Local Claude Code skills
 .claude/commands/
+
+# local dev server settings, see development.md
+server/.dev.env
diff --git a/.tool-versions b/.tool-versions
new file mode 100644
index 00000000..1f5e3edf
--- /dev/null
+++ b/.tool-versions
@@ -0,0 +1,2 @@
+python 3.12.15
+nodejs 22.23.3
diff --git a/development.md b/development.md
index 18bf11b5..f2958c93 100644
--- a/development.md
+++ b/development.md
@@ -6,6 +6,15 @@ This page contains useful information for those who wish to develop Mergin.
 ## Running locally (for dev)
 Install dependencies and run services:
 
+### Python and Node.js
+
+Required versions are pinned in `.tool-versions` in the repository root. With [asdf](https://asdf-vm.com) or [mise](https://mise.jdx.dev) installed, run in the repository root:
+
+```shell
+$ asdf install  # or: mise install
+$ corepack enable  # provides yarn
+```
+
 ### Postgres and Redis
 
 ```shell
@@ -24,8 +33,9 @@ $ pipenv install --dev
 $ pipenv install --categories telemetry
 $ pipenv run pre-commit install
 $ pipenv run pre-commit run --all-files
-# pipenv loads server/.env automatically; secrets and salts have no defaults
-$ cat > .env <<EOF
+# dev settings, secrets and salts have no defaults
+# not named .env on purpose: pipenv and flask would load it automatically, also into tests
+$ cat > .dev.env <<EOF
 FLASK_APP=application
 COLLECT_STATISTICS=0
 SECRET_KEY=$(python3 -c 'import secrets;print(secrets.token_hex(32))')
@@ -36,6 +46,8 @@ SECURITY_UNLOCK_SALT=$(python3 -c 'import secrets;print(secrets.token_hex(16))')
 MAIL_DEFAULT_SENDER=dev@localhost
 MERGIN_BASE_URL=http://localhost:8080
 EOF
+# let pipenv load it for commands in this shell
+$ export PIPENV_DOTENV_LOCATION=$PWD/.dev.env
 # folder for project files (LOCAL_PROJECTS default)
 $ mkdir -p ../projects
 $ pipenv run flask init-db
@@ -123,5 +135,6 @@ To launch the unit tests run:
 $ docker run -d --rm --name testing_pg -p 5435:5432 -e POSTGRES_PASSWORD=postgres postgres:14
 $ cd server
 $ pipenv install --dev --sequential --verbose
-$ pipenv run pytest -v --cov=mergin mergin/tests
+# tests use .test.env only, do not load dev settings (e.g. exported PIPENV_DOTENV_LOCATION)
+$ PIPENV_DONT_LOAD_ENV=1 pipenv run pytest -v --cov=mergin mergin/tests
 ```

From d68108119b2223048100cdd2d57c79b5b0c68154 Mon Sep 17 00:00:00 2001
From: Martin Varga <martin.varga@lutraconsulting.co.uk>
Date: Fri, 9 Oct 2026 16:44:08 +0200
Subject: [PATCH 2/2] Fix mimetypes handling for both Ubuntu 24 and 26 versions

---
 server/mergin/sync/utils.py       | 10 +++++++++-
 server/mergin/tests/test_utils.py | 17 +++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/server/mergin/sync/utils.py b/server/mergin/sync/utils.py
index 38150db2..584ca28d 100644
--- a/server/mergin/sync/utils.py
+++ b/server/mergin/sync/utils.py
@@ -468,9 +468,17 @@ def is_supported_type(filepath) -> bool:
     return mime_type.startswith("image/") or mime_type not in FORBIDDEN_MIME_TYPES
 
 
+# libmagic >= 5.46 (e.g. Ubuntu 26.04) reports some types differently than older versions,
+# map them to the older names to keep responses stable regardless of the system libmagic
+MIME_TYPE_ALIASES = {
+    "application/geopackage+sqlite3": "application/vnd.sqlite3",
+}
+
+
 def get_mimetype(filepath: str) -> str:
     """Identifies file types by checking their headers"""
-    return magic.from_file(filepath, mime=True)
+    mime_type = magic.from_file(filepath, mime=True)
+    return MIME_TYPE_ALIASES.get(mime_type, mime_type)
 
 
 def get_x_accel_uri(*url_parts):
diff --git a/server/mergin/tests/test_utils.py b/server/mergin/tests/test_utils.py
index 288577b0..4037d327 100644
--- a/server/mergin/tests/test_utils.py
+++ b/server/mergin/tests/test_utils.py
@@ -24,6 +24,7 @@
     check_filename,
     is_supported_extension,
     is_supported_type,
+    get_mimetype,
     is_valid_path,
     get_x_accel_uri,
     Checkpoint,
@@ -404,6 +405,22 @@ def test_mime_type_validation_skip():
         assert not is_supported_type("other.js")
 
 
+@pytest.mark.parametrize(
+    "detected,expected",
+    [
+        # libmagic < 5.46 (Ubuntu 24.04)
+        ("application/vnd.sqlite3", "application/vnd.sqlite3"),
+        # libmagic >= 5.46 (Ubuntu 26.04)
+        ("application/geopackage+sqlite3", "application/vnd.sqlite3"),
+        ("image/png", "image/png"),
+    ],
+)
+def test_get_mimetype_aliases(detected, expected):
+    """Mime type is the same regardless of libmagic version"""
+    with patch("mergin.sync.utils.magic.from_file", return_value=detected):
+        assert get_mimetype("base.gpkg") == expected
+
+
 def test_allowed_extensions_override():
     """Extensions in UPLOAD_EXTENSIONS_WHITELIST are accepted even though they are in FORBIDDEN_EXTENSIONS."""
     with patch(