renovate[bot]
25f2c4226b
chore(deps): update dependency https-proxy-agent to v9
2026-10-05 15:18:03 +00:00
Ludovic Ortega
e00d685620
chore: add vulnerability report ( #3587 )
...
Signed-off-by: Ludovic Ortega <[email protected]
2026-10-05 10:20:49 +02:00
Ludovic Ortega
2cfbcf8940
docs: fix backups menu ( #3575 )
...
Signed-off-by: Ludovic Ortega <[email protected]
2026-10-03 15:06:42 +02:00
Bijaya Budhathoki and Bijaya Budhathoki
e9590629b8
fix(settings): allow trailing slash in YouTube URL ( #3557 )
...
Co-authored-by: Bijaya Budhathoki <[email protected]
2026-09-29 19:01:30 +08:00
Ludovic Ortega
fa58c30697
chore(helm): bump seerr to 3.5.0 ( #3556 )
...
Signed-off-by: Ludovic Ortega <[email protected]
2026-09-29 11:04:27 +08:00
fallenbagel
cd8aa1f0da
fix(jellyfin): handle season and episode items in recently added scan ( #3551 )
2026-09-28 15:13:54 +02:00
fallenbagel
9fda1c6270
Merge commit from fork
...
Media.getMedia() loads the requests and issues relations for GET /movie/:id and GET /tv/:id, and the
User relations hanging off them are eager, so every authenticated user could read any other user's
email and plexId out of mediaInfo. The same payload carried full issue contents, including comment
bodies, to viewers who are refused GET /issue. Media.filter() now strips the nested users and
withholds the issues from anyone lacking the perms that the endpoing requires, and drops the issue
fields nothing reads. Reported as a security advisory, GHSA-xc6j-6p6h-p799.
2026-09-28 07:06:44 +08:00
fallenbagel
53e77bf347
Merge commit from fork
...
User.settings is an eager relation, so it rode along into every response embedding a User, exposing
pushover, pushbullet, telegram, discord and PGP values through the request, issue, issue comment,
blocklist, and watchlist endpoints. It now omits it by using User.toJSON(). GET /auth/me builds
settings from seven non-credential fields the web app reads, so locale and region defaults keep
working. Reported as a security advisory, GHSA-8j73-j6rc-q8xh.
2026-09-28 07:06:04 +08:00
fallenbagel
4fd0da04e3
ci(duplicate-detector): switch embeddings to bge-small-en-v1.5 ( #3541 )
2026-09-26 18:19:41 +05:00
0xsysr3ll
103976d1b4
fix(plex): limit concurrent watchlist metadata requests ( #3251 )
2026-09-25 17:31:32 +02:00
fallenbagel
68e01b98a3
fix(subscriber): keep issue comment lookups on the owning save's connection ( #3536 )
2026-09-25 15:15:05 +02:00
fallenbagel
b919443202
fix(override-rules): keep values set by advanced requesters ( #3539 )
2026-09-24 14:18:28 +05:00
renovate[bot]
f92f44b314
chore(deps): update dependency @huggingface/transformers to v4 ( #2950 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-24 13:39:06 +08:00
fallenbagel
cc6f5c7631
fix(requests): serialize requests for the same title ( #3380 )
2026-09-23 14:17:54 +02:00
fallenbagel
10483e2c08
fix(requests): stop editing a request from re-requesting covered seasons ( #3379 )
2026-09-23 14:04:31 +02:00
fallenbagel
8f0a977de8
fix(requests): enforce the quota when editing a request ( #3378 )
2026-09-23 13:58:29 +02:00
Gauthier
794743a45f
feat(overriderules): apply override rules to advanced requests ( #2164 )
2026-09-22 02:59:56 +05:00
Gauthier
38581ca1c0
feat: add a demo feature ( #3017 )
2026-09-21 10:11:05 +02:00
Átila
7afbb2914f
docs(discord): document the Thread ID notification setting. ( #3481 )
2026-09-21 10:06:42 +02:00
fallenbagel
59d5947b4d
fix(webpush): resolve push subscription bugs for multi-device and shared browsers ( #3142 )
2026-09-16 14:09:44 +02:00
Ludovic Ortega
6fa7473dbb
ci: remove third party action dawidd6/action-download-artifact ( #3480 )
...
Signed-off-by: Ludovic Ortega <[email protected]
2026-09-15 08:37:46 +02:00
fallenbagel
2bebae8369
fix(db): remap leftover Overseerr DELETED status after migration ( #3510 )
2026-09-15 07:33:44 +02:00
fallenbagel
34b28d0aba
fix(scanner): confirm orphan candidates against the servers before declining ( #3399 )
2026-09-14 17:30:29 +02:00
Austin Rikley
b2116523f7
refactor(avatarproxy): remove unused auth header from avatarproxy ( #3503 )
2026-09-14 16:11:17 +05:00
Austin Rikley
d4eeea85be
fix(auth): refresh avatar on Quick Connect login ( #3504 )
2026-09-14 18:45:46 +08:00
fallenbagel
abe2f3bb80
test: block outbound HTTP in unit tests ( #3511 )
2026-09-14 14:36:57 +05:00
Austin Rikley
a53f49bdc3
fix(server): respond instead of hanging on proxy route errors ( #3501 )
2026-09-14 00:41:03 +05:00
Michael Thomas
7a76142ae3
test: add scanner update rate override for testing ( #3241 )
2026-09-13 07:32:51 +08:00
Austin Rikley
de57e7ac6c
fix(jellyfin-api): update Authorization headers for Jellyfin ( #3502 )
2026-09-12 14:18:37 +02:00
Ludovic Ortega
4fc265b60b
docs(helm): fix documentation regarding chart signature verification ( #3420 )
...
Signed-off-by: Ludovic Ortega <[email protected]
2026-09-11 16:35:32 +02:00
Harsh Abasaheb Chavan and Xyerophyte
1dbf19b803
fix(requests): skip seasons with no episodes when requesting all seasons ( #2698 )
...
Co-authored-by: Xyerophyte <[email protected]
2026-09-11 10:20:38 +02:00
68c5bc8c7d
chore(i18n): update translations from Weblate
...
Co-authored-by: Serhiy <[email protected] [email protected] [email protected]
2026-09-10 00:26:00 +05:00
0xsysr3ll
6f5a17735d
feat(settings): hide already requested media ( #1855 )
...
Signed-off-by: 0xsysr3ll <[email protected]
2026-09-08 03:43:27 +05:00
Weblate and Kisnov
5f9722758c
chore(i18n): update translations from Weblate
...
Co-authored-by: Kisnov <[email protected] [email protected]
2026-09-07 16:25:52 +02:00
renovate[bot]
a3dbbd94a6
ci(actions): update github actions ( #3478 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-06 04:37:40 +05:00
renovate[bot]
979978fc32
chore(deps): update database ( #3458 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-06 01:25:59 +02:00
renovate[bot]
6bf3d0484f
ci(actions): update github actions (major) ( #3471 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-09-06 01:24:44 +02:00
0xsysr3ll
c604bccc00
fix(requests): scope download status to requested seasons on request cards ( #3412 )
2026-09-05 09:33:21 +02:00
Ludovic Ortega
a4f5eaa21e
docs(docker): add cap-drop and security-opt to docker command ( #3472 )
2026-09-04 08:07:30 +02:00
fallenbagel
d7dc7bdd34
fix(requests): serialize request creation per user ( #3377 )
2026-09-03 15:22:51 +05:00
fallenbagel
17fc4cc659
fix(requests): stop editing a request from stealing another's season ( #3376 )
2026-09-03 10:31:22 +02:00
Dor Peled
970bb54571
fix(requests): reset orphaned season statuses when a request is deleted ( #3279 )
2026-09-02 17:13:18 +05:00
fallenbagel
e73825b2f1
fix: fix empty discordId in comment webhooks ( #3467 )
2026-09-02 13:05:12 +05:00
+4
5c04640b63
chore(i18n): update translations from Weblate
...
Co-authored-by: Bas Trebus <[email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
2026-08-31 21:18:49 +05:00
renovate[bot]
5a5f059001
ci(actions): update github actions ( #3306 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
2026-08-31 16:38:53 +02:00
fallenbagel
9f6403e14e
fix(requests): enforce pending and failed states on request routes ( #3385 )
2026-08-31 18:37:47 +05:00
fallenbagel
5f4cb1ea45
fix(db): drop stale auth unique on sqlite push subscriptions ( #3391 )
2026-08-31 17:16:57 +05:00
fallenbagel
7997f7564b
fix(tv): prevent phantom specials from blocking season request ( #3351 )
2026-08-31 14:15:40 +02:00
fallenbagel
46d5915d6c
refactor(ui): use the Radio component instead of RadioGroup.Option ( #3454 )
2026-08-31 20:10:49 +08:00
fallenbagel
aa8e0de04c
refactor(ui): use headlessui flat named exports ( #3453 )
2026-08-31 17:00:51 +05:00
renovate[bot]