v1.5.0 - Backlog Reaper

[Doezer]

The biggest release since 1.4: a library that finds the games already on your disk, a Playing page, PostgreSQL support, and a lot of security hardening.

Before you upgrade

• Sign in again once. Sessions moved to httpOnly cookies, so the first page load asks for your password again.
• Plain-HTTP indexers and download clients. Credentials are only sent over HTTP when Allow insecure LAN is on. On SQLite, migration 0044 turns it on once for your existing HTTP connections, so nothing breaks; new connections start with it off. Release-candidate testers who deliberately turned it off should re-check it.
• Reverse proxy. Set TRUST_PROXY for your proxy hops or addresses (see the reverse proxy guide).
• Forgot your password in Docker? docker exec -it questarr su-exec questarr node dist/scripts/reset-password.js <username>

Highlights

Library

• Discover games already on disk: root folder scan, Library Import page, and manual matching of unmatched folders through IGDB search.
• New Playing status and page (journal notes, milestones, screenshots, Steam achievements), plus sidebar counters.
• Backlog roulette to pick your next game from Library or Playing.
• DLC tab, Time to Beat, crack status, installed version tracking, file categories, a Platforms setting, and more filters and sorting.

Downloads and import

• Pre-import security scanning with VirusTotal and ClamAV (optional). Downloads that cannot be fully scanned wait for manual review.
• Archives extract safely into an existing game folder without wiping installed files or saves.
• Better recovery: client outages and removed jobs no longer lose track of a download, and failures go to manual review instead of dead-ending.
• Experimental AI release analysis (TypeSafe/Jev, bring your own key), password-protected archive support, global release name blacklist.

Integrations and deployment

• Optional PostgreSQL backend (SQLite stays the default).
• Prowlarr sync defaults, authenticated Apprise servers, per-status update notification controls, RSS feeds refreshed automatically.
• Playnite integration, Steam wishlist auto-sync.
• Windows installer, Helm chart, Proxmox script, CasaOS, Umbrel and Cosmos Cloud definitions.

Fixes worth knowing

• Imports: FitGirl-style repacks, Wii U releases, hardlink fallback, SABnzbd and NZBGet path and category issues, Nintendo Switch releases, RAR extraction.
• Older qBittorrent versions and Prowlarr behind TLS proxies now work.
• A game marked Playing, Shelved or Completed is no longer overwritten by the download pipeline.
• Auto-search no longer drops every Usenet result when a minimum seeders rule is set.
• Blank page on reload of nested pages, API 404s now return JSON, placeholder cover art, ssl.redirectHttp now actually redirects.

Security

• Cookie-based auth with CSRF protection, default-deny API boundary, and an authenticated real-time channel with per-user notifications.
• Proxy headers are ignored unless TRUST_PROXY is set.
• Downloader SSRF and TLS-bypass fixes, archive extraction limits, scan and path hardening.
• 17 production dependency vulnerabilities fixed (including a critical proxy-addr IP spoofing issue), plus Docker base image patches.

Full details: see docs/CHANGELOG.md.

Download:

• set your Docker image tag to v1.5.0 or keep latest
• New: Windows package available in the release assets!

Full Changelog: v1.5.0-rc1...v1.5.0

---

This discussion was created from the release v1.5.0 - Backlog Reaper.