fallenbagel
8f2eceeaa5
fix(scanners): decline request when media resets to UNKNOWN ( #3578 )
2026-10-10 07:18:54 +08:00
fallenbagel
cd8aa1f0da
fix(jellyfin): handle season and episode items in recently added scan ( #3551 )
2026-09-28 15:13:54 +02:00
fallenbagel
9fda1c6270
Merge commit from fork
...
Media.getMedia() loads the requests and issues relations for GET /movie/:id and GET /tv/:id, and the
User relations hanging off them are eager, so every authenticated user could read any other user's
email and plexId out of mediaInfo. The same payload carried full issue contents, including comment
bodies, to viewers who are refused GET /issue. Media.filter() now strips the nested users and
withholds the issues from anyone lacking the perms that the endpoing requires, and drops the issue
fields nothing reads. Reported as a security advisory, GHSA-xc6j-6p6h-p799.
2026-09-28 07:06:44 +08:00
fallenbagel
53e77bf347
Merge commit from fork
...
User.settings is an eager relation, so it rode along into every response embedding a User, exposing
pushover, pushbullet, telegram, discord and PGP values through the request, issue, issue comment,
blocklist, and watchlist endpoints. It now omits it by using User.toJSON(). GET /auth/me builds
settings from seven non-credential fields the web app reads, so locale and region defaults keep
working. Reported as a security advisory, GHSA-8j73-j6rc-q8xh.
2026-09-28 07:06:04 +08:00
fallenbagel
4fd0da04e3
ci(duplicate-detector): switch embeddings to bge-small-en-v1.5 ( #3541 )
2026-09-26 18:19:41 +05:00
fallenbagel
68e01b98a3
fix(subscriber): keep issue comment lookups on the owning save's connection ( #3536 )
2026-09-25 15:15:05 +02:00
fallenbagel
b919443202
fix(override-rules): keep values set by advanced requesters ( #3539 )
2026-09-24 14:18:28 +05:00
fallenbagel
cc6f5c7631
fix(requests): serialize requests for the same title ( #3380 )
2026-09-23 14:17:54 +02:00
fallenbagel
10483e2c08
fix(requests): stop editing a request from re-requesting covered seasons ( #3379 )
2026-09-23 14:04:31 +02:00
fallenbagel
8f0a977de8
fix(requests): enforce the quota when editing a request ( #3378 )
2026-09-23 13:58:29 +02:00
fallenbagel
59d5947b4d
fix(webpush): resolve push subscription bugs for multi-device and shared browsers ( #3142 )
2026-09-16 14:09:44 +02:00
fallenbagel
2bebae8369
fix(db): remap leftover Overseerr DELETED status after migration ( #3510 )
2026-09-15 07:33:44 +02:00
fallenbagel
34b28d0aba
fix(scanner): confirm orphan candidates against the servers before declining ( #3399 )
2026-09-14 17:30:29 +02:00
fallenbagel
abe2f3bb80
test: block outbound HTTP in unit tests ( #3511 )
2026-09-14 14:36:57 +05:00
fallenbagel
d7dc7bdd34
fix(requests): serialize request creation per user ( #3377 )
2026-09-03 15:22:51 +05:00
fallenbagel
17fc4cc659
fix(requests): stop editing a request from stealing another's season ( #3376 )
2026-09-03 10:31:22 +02:00
fallenbagel
e73825b2f1
fix: fix empty discordId in comment webhooks ( #3467 )
2026-09-02 13:05:12 +05:00
fallenbagel
9f6403e14e
fix(requests): enforce pending and failed states on request routes ( #3385 )
2026-08-31 18:37:47 +05:00
fallenbagel
5f4cb1ea45
fix(db): drop stale auth unique on sqlite push subscriptions ( #3391 )
2026-08-31 17:16:57 +05:00
fallenbagel
7997f7564b
fix(tv): prevent phantom specials from blocking season request ( #3351 )
2026-08-31 14:15:40 +02:00
fallenbagel
46d5915d6c
refactor(ui): use the Radio component instead of RadioGroup.Option ( #3454 )
2026-08-31 20:10:49 +08:00
fallenbagel
aa8e0de04c
refactor(ui): use headlessui flat named exports ( #3453 )
2026-08-31 17:00:51 +05:00
fallenbagel
df743f4638
fix(ui): stop the slideover backdrop flashing back on close ( #3451 )
2026-08-31 17:00:34 +05:00
fallenbagel
1cc2f116a2
chore(deps): upgrade @headlessui/react to 2.2.10 ( #3450 )
2026-08-31 16:58:27 +05:00
fallenbagel
d7b08bddc0
fix(datasource): break import cycle mistyping postgres timestamps ( #3449 )
2026-08-31 09:13:03 +02:00
fallenbagel
da4b555ca8
fix(ui): stop appear leaking onto the DOM in Modal and SlideOver ( #3446 )
2026-08-31 07:41:23 +02:00
fallenbagel
0f79ee663c
fix(datasource): register entities and subscribers explicitly ( #3375 )
2026-08-31 05:23:12 +05:00
fallenbagel
2759058aeb
fix(discover): fix tv title sorting and validate sortBy per media type ( #3305 )
2026-08-28 15:19:07 +02:00
fallenbagel
5af32cb27a
fix(settings): mutate the query-string status key for modal immediately ( #3432 )
2026-08-27 17:15:17 +02:00
fallenbagel
59ad5f1916
perf: bound tmdb cache & split scan lookups into their own tier ( #3367 )
2026-08-27 18:09:14 +05:00
fallenbagel
059008cbb2
fix(subscriber): keep request status updates on the owning save's connection ( #3366 )
2026-08-18 07:32:47 +02:00
fallenbagel
4d17e08b91
fix: stop masking connection failures across media server sync and login ( #3324 )
2026-08-16 18:31:44 +05:00
fallenbagel
c9f2ac58be
fix: keep library settings when renamed on media server ( #3323 )
2026-08-16 18:31:44 +05:00
fallenbagel
985ddef3f0
fix(api): stop library reads from resetting enabled flags ( #3321 )
2026-08-16 18:31:43 +05:00
fallenbagel
39ff48c650
test(cypress): stop dirty restartRequired flag cascading across specs ( #3368 )
2026-08-11 15:10:30 +02:00
fallenbagel
d103787a8f
fix(login): hide quick connect button for emby servers ( #3369 )
2026-08-11 15:23:39 +05:00
fallenbagel
dea596056a
docs: clarify ai disclosure policy further ( #3358 )
2026-08-09 17:44:32 +02:00
fallenbagel
42bee2aa10
fix(sonarr): apply configured series type to non-anime requests ( #3329 )
2026-08-02 01:49:20 +05:00
fallenbagel
93c0b6a6d6
fix(sonarr): decouple anime root folder routing from seriesType ( #3328 )
2026-08-02 01:49:20 +05:00
fallenbagel
1fd35f9a5d
fix(request): render anime notice alert in a div instead of a p ( #3331 )
2026-08-01 22:06:17 +02:00
fallenbagel
3ee6f9200c
fix: don't delete requests when removing media from arr ( #3288 )
2026-07-30 00:49:56 +05:00
fallenbagel
8ea0c174ea
fix: handle already-removed media in radarr/sonarr delete ( #3209 )
2026-07-30 00:49:55 +05:00
fallenbagel
669a58a61b
fix(airdatebadge): anchor day diff to UTC midnight instead of raw ms delta
...
(#3273 )
2026-07-23 16:54:31 +02:00
fallenbagel
8ccd0f6245
fix(discover): use added sort in recent requests slider ( #3202 )
2026-07-22 16:46:59 +02:00
fallenbagel
bf5323faf4
docs(blog): rootless design and PUID/PGID rationale ( #3105 )
2026-07-21 16:38:25 +02:00
fallenbagel
46d8033599
fix(availability-sync): prevent false removals for merged-version Plex items ( #3224 )
2026-07-21 08:15:43 +08:00
fallenbagel
f481b56a7a
fix(subscriber): await request status updates ( #3223 )
2026-07-21 02:14:34 +02:00
fallenbagel
8e02d927df
fix: prevent cross-instance external ID collisions ( #3203 )
2026-07-03 22:04:55 +02:00
fallenbagel
2e0e4ceb2a
fix(scanners): decline orphaned requests when media is removed from servarr ( #3191 )
2026-07-03 21:39:14 +08:00
fallenbagel
74c8db42a6
feat: add jellyfin/emby quick connect authentication ( #2212 )
2026-07-03 13:32:20 +02:00
fallenbagel
8ad191f42b
fix(proxy): proxy clients built before proxy init ( #3196 )
2026-06-25 01:49:58 +02:00
fallenbagel
ef9edc832f
fix(i18n): fallback to server locale for "Default" user lang in notifs ( #3190 )
2026-06-23 17:07:34 +08:00
fallenbagel
784faa9f84
fix: availability sync demotion and orphan season rollup edge cases ( #3148 )
2026-06-12 00:04:36 +02:00
fallenbagel
ff88d528e5
fix(request): restore media status correctly when deleting requests ( #3064 )
2026-05-25 22:31:03 +02:00
fallenbagel
2588e49ac6
fix(watchlistsync): re-request deleted media from watchlist ( #3072 )
2026-05-25 20:15:04 +02:00
fallenbagel
ee915b93a9
fix(media): clean up watchlist on error card delete ( #3073 )
2026-05-25 20:07:28 +02:00
fallenbagel
08b7bd4f46
refactor(docs): move REST API docs to navbar and dedicated sidebar ( #3040 )
2026-05-16 12:12:49 +02:00
fallenbagel
df105b81e3
fix(docs): enable trailingSlash to prevent 404 flash on direct navigation ( #3039 )
2026-05-16 15:04:05 +08:00
fallenbagel
d88242fd62
fix(docs): switch to SWC minimizer to fix broken runtime bundle
...
Terser emits digit-prefixed hex chunk-name keys unquoted in webpack's runtime, producing an invalid
object literal that crashes hydration. SWC quotes them correctly.
fix #3035
2026-05-16 14:17:29 +08:00
fallenbagel
9c34864ce6
fix(availability-sync): detect deleted seasons when media server retains empty season metadata ( #2850 )
2026-05-03 17:22:55 +02:00
fallenbagel
198e4e5953
fix(scanners): reset orphaned processing media from deleted Radarr/Sonarr entries ( #2757 )
2026-05-02 22:51:39 +02:00
fallenbagel
ce51f6a83c
fix(scanners): ignore unknown seasons in availability rollup and skip empty placeholder seasons ( #2958 )
2026-05-03 04:37:41 +08:00
fallenbagel
ba6ed6c181
chore: cleanup intl polyfills and dev config ( #2965 )
2026-04-29 13:12:43 +02:00
fallenbagel
d426e1ee37
fix: send availability notification if media is available before approval ( #2819 )
2026-04-22 13:47:37 +02:00
fallenbagel
2dfea0cc7e
fix(media-request): remove cascade from modifiedBy to prevent user column wipe ( #2911 )
2026-04-20 12:09:54 +08:00
fallenbagel
5fdedb1591
fix(override-rules): use find() instead of index lookup for service resolution ( #2903 )
2026-04-19 16:11:36 +08:00
fallenbagel
cd257bad2a
feat(i18n): add server-side i18n for notification agents ( #2731 )
2026-04-17 19:39:59 +08:00
fallenbagel
7861db4941
fix(imdbRadarrProxy): pass headers and nodeCache as options instead of params ( #2900 )
2026-04-17 12:57:27 +02:00
fallenbagel
85bfdb2be3
ci(create-tag): add gh token to avoid api rate limit in tag version retrieval ( #2886 )
2026-04-16 04:29:35 +08:00
fallenbagel
66130beded
fix(settings): persist new settings defaults to disk on startup ( #2884 )
2026-04-15 16:42:36 +02:00
fallenbagel
aef2481722
fix: improve local login UX ( #2849 )
2026-04-15 16:24:22 +08:00
fallenbagel
43eff257e1
fix(overseerr-merge): sanitise corrupt quota values during overseerr migration ( #2863 )
2026-04-12 17:37:32 +02:00
fallenbagel
20ccd4bd38
fix(request): record modifiedBy on retry and add route tests ( #2824 )
2026-04-12 16:52:45 +02:00
fallenbagel
061121c326
fix(generate-password): await setPassword to fix race condition ( #2845 )
2026-04-09 21:32:28 +08:00
fallenbagel
fe2c0416ef
fix(emby): use static version in auth header for emby only ( #2821 )
2026-04-07 23:12:54 +02:00
fallenbagel
0b8f872828
fix(entities): replace MySQL-only onUpdate with @UpdateDateColumn ( #2823 )
2026-04-05 21:53:30 +08:00
fallenbagel
6f9b743ea9
docs(contributing-guide): fix a typo ( #2807 )
2026-04-02 14:03:28 +02:00
fallenbagel
58514ec5cf
ci(pr-validation): make checklist box detection case-insensitive ( #2802 )
2026-04-02 10:39:37 +02:00
fallenbagel
986761f61f
ci(pr-validation): update pull request permissions to write for validation jobs ( #2800 )
2026-04-02 14:23:15 +08:00
fallenbagel
67e27d5b79
ci(pr-validation): disable package manager cache in nodejs setup ( #2799 )
2026-04-02 14:12:04 +08:00
fallenbagel
772e83d104
chore: add PR validation workflow and update contributing guidelines ( #2777 )
2026-04-02 13:59:51 +08:00
fallenbagel
685cb449b1
refactor(watchlistsync): log media request creation after success instead of before ( #2790 )
2026-04-01 15:07:34 +02:00
fallenbagel
036d000f26
refactor(imageproxy): reduce noisy image cache logging ( #2789 )
2026-04-01 14:40:14 +02:00
fallenbagel
735ec47b1e
fix(login): resolve stuck transition when switching login forms ( #2779 )
2026-03-30 15:34:32 +02:00
fallenbagel
be5799756a
fix(override-rules): remove users from useEffect dependency array ( #2771 )
2026-03-30 12:59:39 +02:00
fallenbagel
6c52a2f3ad
fix(settings): serialize settings writes and prevent partial overwrites ( #2696 )
2026-03-16 11:29:41 +01:00
fallenbagel
0be18968b4
fix: disambiguate tmdb ids by media type across lookups ( #2577 )
2026-03-14 23:47:21 +05:00
fallenbagel
1dc51542aa
fix(setup): fix Plex login not proceeding after authentication ( #2596 )
2026-03-04 03:22:01 +05:00
fallenbagel
9ec3d585d1
fix(email): correctly classify final MIME header in PGP email encryption ( #2618 )
2026-03-04 03:17:56 +05:00
fallenbagel
a16d0464a6
fix(issues): update issue timestamp when adding comments ( #2616 )
2026-03-02 12:35:18 +01:00
fallenbagel
835e9176c0
fix(email): preserve newlines in PGP key textarea fields ( #2617 )
2026-03-02 16:33:11 +05:00
fallenbagel
61e0377361
feat(notifications): add priority setting for ntfy agent ( #2306 )
2026-03-02 04:37:57 +05:00
fallenbagel
5c34c91257
feat(sonarr): add monitorNewItems option to sonarr settings & modal ( #2071 )
2026-02-28 02:08:44 +05:00
fallenbagel
720a75b58d
docs(blog): release notes for seerr v3.1.0 addressing critical security vulnerabilities [skip ci] ( #2594 )
2026-02-27 19:56:52 +01:00
fallenbagel
687f18b6b8
ci(create-tag): correct quote style in commit message for tag preparation ( #2593 )
2026-02-28 02:00:37 +08:00
fallenbagel
4f089b29d0
Merge commit from fork
...
Add ownership check to GET /api/v1/user/:id so the full user object(including eager-loaded settings
with notification credentials) is onlyreturned to the user themselves or MANAGE_USERS admins. All
otherauthenticated users receive a stripped response (which is the intended behaviour as
https://github.com/sct/overseerr/pull/3695#issuecomment-1817827774 ). Also expands
User.filteredFields to strip sensitive fileds to prevent leaking credentials
2026-02-28 00:58:28 +08:00
fallenbagel
4ae2068409
Merge commit from fork
...
Fix a logic flaw in the jellyfin auth guard that allowed unauthenticated users to register accounts
on Plex-configured instances by authenticating against an attacker-controlled Jellyfin server.
2026-02-28 00:36:17 +08:00
fallenbagel
3bcb4da1e5
feat(servarr-api): make Servarr API request timeout configurable ( #2556 )
2026-02-23 00:32:31 +01:00
fallenbagel
5013d1d54d
fix(sonarr): use configured metadata provider for season filtering ( #2516 )
2026-02-22 18:13:39 +01:00
fallenbagel
68f56d2035
fix(jellyfin-scanner): include unmatched seasons in processable seasons ( #2538 )
2026-02-21 06:51:02 +05:00
fallenbagel