Release v0.28.0

✨ New Features

XC Catch-up (Timeshift) Support

• Dispatcharr now proxies catch-up / timeshift playback from Xtream Codes providers to IPTV clients, so viewers can watch recent programmes from supported channels. (Closes #133) - Thanks @cedric-marcoux:
  • Path-style (/timeshift/...) and query-style (/streaming/timeshift.php) catch-up URLs are both supported - Thanks @dillardblom
  • Catch-up sessions appear on the Stats page in dedicated connection cards (separate from live and VOD), with channel logo, programme preview, playback position, bitrate, and a stop button
  • Cards update in real time, advance to the next EPG programme when playback continues past the original show, and can notify you when sessions start or end
  • Channels and streams with catch-up show a history icon in the Channels and Streams tables (with archive days in the tooltip when known), plus an Only Catch-up filter
  • Multi-provider failover walks catch-up streams in channel order (like live playback), preferring archives that cover the requested programme age
  • Catch-up respects provider connection limits, per-channel access rules, and user stream limits
  • Guide output advertises catch-up availability (tv_archive / archive duration) and can auto-detect how many previous days to include in XMLTV (overridable per user or via URL)
  • Native apps can start, update playhead/pause state, and end catch-up sessions through a REST API that returns a playback URL suitable for headerless video players
• Enable Catchup can be turned off globally in System Settings, or per user on the Permissions tab, to block timeshift playback and stop advertising catch-up to XC clients while still showing catch-up indicators in the web UI

XZ-Compressed EPG and M3U Sources

• EPG sources and uploaded M3U playlists can now use .xz compression alongside .gz and .zip. Auto-import from /data/epgs also picks up .xz files. (Closes #1414) - Thanks @MotWakorb

🔄 Changes & Improvements

VOD Playback

• VOD playback now fails over across M3U accounts when the preferred account is at capacity, trying other accounts that carry the same title in priority order (matching live-channel behaviour). Previously a full account returned an error even when another account had free slots. (Closes #1385) - Thanks @francescodg89-crypto

Channels & URLs

• The channel list API paginates when only page_size is provided (page 1). Omitting both page and page_size still returns the full list for legacy clients and plugins
• Stream, M3U, and EPG URLs with Docker-style hostnames that include underscores (e.g. http://my_service/) are now accepted. - Thanks @recurst

Stats

• The Stats page loads live, VOD, and catch-up connection data from a single combined stats endpoint instead of separate requests

Performance

• System and proxy settings used on every stream request are cached so hot paths no longer hit the database on each call
• M3U and XC refreshes on large accounts are faster and use less memory: unchanged streams are touched lightly, filters compile once, playlists stream from disk, and workers reclaim memory after large jobs

Frontend Testing

• Unit test coverage was extended across table components, plugins, backups, settings, forms, modals, Connect, and Plugin Browse. - Thanks @nick4810

🐛 Bug Fixes

Live Streaming & Failover

• Fixed deleting a channel while it was playing leaving a hung proxy session or stuck provider connection. Manual delete can optionally leave playback running; auto-sync still stops sessions before removing channels. Stats stop still releases connection slots even if the channel row is already gone (Fixes #870)
• Fixed long output-profile and fMP4 remux/transcode sessions (over about an hour) losing Redis coordination keys and failing for late joiners or format/profile switches
• Fixed failed channel startups leaving ghost "initializing" sessions that blocked playback with a permanent connection-stalled error and never failed over
• Fixed live streaming paths that could exhaust per-worker database connections and cause unrelated pages (including XC/player_api) to hang under load (Fixes #1418)
• Fixed channels staying stuck on buffering in Stats after a buffering-timeout failover even after the new stream recovered (Fixes #1449)
• Fixed the default VLC stream profile not failing over when the upstream URL could not be opened (Fixes #1415)
• Fixed isolated provider disconnects hours apart exhausting the retry budget and switching streams unnecessarily. Retries now reset after 30 minutes of stable playback; three failures within that window still trigger failover
• Fixed failover jumping back to the first stream after a stable session on a backup. Rotation now continues in channel order (matching manual next-stream)
• Fixed preview/join failing with a server error when attaching to an active channel on a different worker while an output profile was starting
• Fixed stream switches in multi-worker setups reporting success or leaving status stuck on the old stream. Switches now wait for confirmation and update the active stream correctly (Fixes #1412)

VOD

• Fixed VOD sessions (especially Jellyfin/FFmpeg clients using concurrent byte-range requests) leaving provider connection slots occupied until restart (Fixes #1426)

Channels & UI

• Fixed Copy URL on the Channels table including web-player output profile parameters. Copied links are now plain stream URLs suitable for external players; Watch still applies player preferences
• Fixed API error toasts dumping raw HTML error pages when the backend returned a 500/502/504. Errors now show a short, readable message (Fixes #1261) - Thanks @nagelm
• Fixed the cron builder's every-6-hours / every-12-hours presets saving the wrong expression (e.g. once daily at hour 6 instead of every 6 hours). Hourly schedules now include an Interval control so step patterns are preserved (Fixes #1320)
• Fixed Auto Channel Sync Find and Replace preview showing literal $1 instead of the substituted capture group, and previewing changes the sync would skip. Preview and rename now match (Fixes #1332) - Thanks @CodeBormen
• Fixed bulk channel delete, drag reorder, and inline channel-number edits clearing selection or continuing before the table finished refreshing. - Thanks @nick4810
• Fixed Backup Manager timestamps not updating when date/time display preferences change until the page was reloaded

EPG & Guides

• Fixed programme times shifting in XMLTV output when PostgreSQL's server timezone was not UTC (common with certain Docker timezone mounts). (Fixes #651) - Thanks @nagelm
• Fixed EPG channel parsing progress showing values over 100% when the guide grew larger than the previous import
• Fixed full EPG refreshes racing with per-channel parses, which could wipe or skip guide data for channels matched during a refresh
• Fixed a failed per-channel EPG parse wiping the previous guide for that channel. Failed parses now leave the existing programmes in place
• Fixed cold EPG output rebuilds freezing login, API, and HDHomeRun requests on the same worker until the rebuild finished (Fixes #1396)

M3U, XC & VOD Refresh

• Fixed XC refreshes that returned no live streams (transient provider failure or empty categories) deleting the entire auto-created channel lineup. Empty results now abort safely and keep the existing channels (Fixes #1377) - Thanks @Jacob-Lasky
• Fixed VOD refreshes that returned an empty category list wiping group selections and movie relations, leaving all VOD groups unselected after a later successful refresh
• Fixed M3U refresh completion counts treating every existing stream as "updated". Counts now reflect real metadata changes, and reports include streams marked stale versus removed
• Fixed M3U group processing failing the whole refresh after a single poisoned database connection instead of retrying once
• Fixed XC live streams, panel API, and authenticated XMLTV export crashing when a visible channel had no channel number. Those channels now receive a free number in output

Plugins & Background Workers

• Fixed plugin discovery in multi-worker setups repeatedly reloading every plugin on connect/disconnect events, leaking background threads and degrading workers until restart (Fixes #1452)
• Fixed Celery background workers sharing the web process database pool, which could corrupt Postgres sessions under concurrent tasks (e.g. M3U/EPG refreshes failing with transaction errors) (Fixes #1404)
• Fixed worker startup paths holding a database connection permanently from process boot, reducing available connections for streaming and API traffic

API Documentation

• Fixed Swagger/OpenAPI schema generation failing or hanging when multiple requests hit the schema endpoint at once (for example opening Swagger UI)

🔒 Security

• Hardened authentication and file-serving boundaries:
  • Logo and VOD logo cache endpoints no longer allow path traversal outside /data/logos; empty logo URLs return 404 instead of fetching remotely
  • EPG source file upload API is admin-only and rejects filenames that escape the uploads directory
  • M3U account passwords are omitted from API responses for non-admin users
  • Channel bulk rename, EPG apply actions, channel reorder/cleanup, recording control actions, and Connect integration APIs now require admin
  • Creating or modifying system notifications requires admin; users can still list and dismiss notifications visible to them
  • Unused unauthenticated legacy stream routes were removed; live playback continues via the standard proxy stream URL