Skip to content

v0.8.0 — Plugin self-update, generic storage, indexer + download-client connector pack

Choose a tag to compare

View all tags
@Arediss Arediss released this 08 May 17:38
v0.8.0
7433444

Highlights

Plugins now self-update from inside Oscarr with a permission diff and a reload/reboot split — no more SSH dance for routine bumps. They also gain a generic isolated storage API (KV + SQLite, gated by storage:plugin), so plugin state lives next to the plugin and is wiped with it. On the integrations side, a connector pack lands: Prowlarr (indexer) plus four torrent/Usenet clients (NZBGet, SABnzbd, Transmission, Deluge) — connection-test only for now, the action layer will ship as separate plugins.

Features

  • In-app plugin update flow with permission diff. Plugins self-update from inside Oscarr without SSH — the admin sees the upcoming version, the diff of requested permissions, and chooses between a hot reload (no downtime) and a full reboot (required when manifest perms or native deps changed). Reload vs reboot is decided by the engine, not guessed by the user.
  • Generic plugin storage API (KV + SQLite). Two isolated primitives — a key/value store and a per-plugin SQLite database — exposed via PluginContext.storage and gated by the new storage:plugin permission. State is scoped to the plugin and removed with it, so the core schema doesn't leak plugin concerns.
  • Indexer + download-client connector pack (Prowlarr, NZBGet, SABnzbd, Transmission, Deluge). Five new service connectors land on the Services tab — connection testing only. Actions (queue/history/pause/etc.) will be exposed by separate plugins talking to these connectors. Each ships with a typed test() that distinguishes auth failures from network errors and surfaces protocol-specific cases like Deluge's daemon-detached state and Transmission's CSRF challenge.
  • Searchable service-type picker with provider icons + 'Untested' badge. The service-creation modal now opens a Headless UI Combobox instead of a native <select>, with a search input, provider icons rendered inline, and an amber 'Untested' pill on connectors that haven't been validated against a real instance yet. Picking an untested connector shows a one-click GitHub feedback link prefilled with the connector name — the badge is removed in the same commit that confirms the integration works.
  • Support module extracted to a standalone plugin. The legacy in-core Support module is now shipped as Oscarr-Plugin-Support, removable like any other plugin. The migration carries an export of existing tickets so admins can install the plugin and keep their data, while keeping the core lean and aligned with the plugin-first vision.

Fixes

  • SonarCloud reliability sweep — 53 bugs cleared. Three refactor tiers landed in this cycle (mechanical sweep, cosmetic batch, redundant cast removal). Pure code-health work — no behavioural change expected.
  • Log injection sanitizer hardened. CodeQL was failing to recognise the log sanitizer; rewriting it as explicit per-channel branches with separate replace() calls satisfies the static analyzer and removes the dead suppression. Closes part of the security code-scanning queue (#182).

Other

  • Faster multi-arch (amd64 + arm64) release builds. The release pipeline now produces both linux/amd64 and linux/arm64 images noticeably faster. The lockfile's platform-native deps were also restored so installs on distroless / musl images stop failing.

Full changelog: v0.7.8...v0.8.0

Upgrading

```
docker pull ghcr.io/arediss/oscarr:0.8.0
```

Assets 2
Loading