v1.4.0 - Post-processing, New Downloaders, Import History, Mobile Improvements, and Major Security Hardening

[Doezer]

Questarr v1.4.0 introduces a major set of improvements across post-processing, downloader support, observability, mobile experience, and security.

An easter egg has been added to Questarr; shouldn't be too hard to find if you think about the very famous easter eggs in gaming! Let me know what you think.

Migration note:

• The PORT variable in docker-compose.yml has been split into two: HOST_SIDE_PORT (host-side binding, default 5000) and CONTAINER_INTERNAL_SIDE_PORT (internal container port, default 5000). If you had PORT set in your .env to customize the host port, rename it to HOST_SIDE_PORT.
• With Post-processing, don't forget to add your volume mapping to the docker compose file.

Added

• Post-Processing Pipeline: Added an automated post-processing pipeline that handles unpacking and organizing files after a download completes (Add post processing pipeline to Questarr #583)
  • Files can be unpacked automatically by setting auto-unpack setting
  • An import modal is displayed via an alert in the library when the system cannot find the input or output path.
• Import History: New page listing import tasks (game claims, post-processing imports, Steam syncs) with a retention purge cron job to keep the history tidy (feat(import-history): new page displaying list of import tasks (claim game, post processing import, steam sync.) new retention purge cron #714).
• Deluge Support: Added Deluge as a supported downloader (feat: Add Deluge downloader support #697).
• Synology Download Station: Added support for Synology's built-in Download Station as a downloader (Add support for Synology Download Station #567).
• Apprise Notifications: Added Apprise API and CLI notification modes. Use API mode with a remote Apprise server or CLI mode with the local apprise binary from Questarr settings. Bundled Python and Apprise in the default image so CLI mode works without a separate image split.
• Personal Notes: Added the ability to attach personal notes to a game.
• Shelved Status: Added a "shelved" status for games (Add shelved status feature #645).
• Real-Time Logs: Added a real-time log streaming page with configurable detail level and truncation for large payloads.
• Send Logs: Added the ability to send logs directly from the app for troubleshooting (Add send logs #648).
• Search Improvements: Added a date filter and infinite scroll to search, plus the ability to delete a result from the library directly from search (feat(search): date filter, infinite scroll, and library delete #673).
• Library Ratings: Added a user rating filter and inline rating in the library's list view; the Stats page now shows average user rating.
• Favorite groups: Added favorite release groups for auto downloading releases, in the settings.
• G4U as indexer: Added g4u.to as an indexer type, using their VIP API (Add g4u.to as a searchable download source #689).
• Vite Base Path: Added support for deploying behind a custom base path (fix #629 add vite base support #630).
• Code of Conduct: Added Contributor Covenant Code of Conduct.
• Downloaders Compatibility doc: Added a document detailing compatibility for supported downloaders.

Security

• SSRF: Hardened outbound fetches with DNS rebinding protection (fix(ssrf): harden outbound fetches with DNS rebinding protection #698).
• Dependency Vulnerabilities: Fixed 3 known vulnerabilities in esbuild, form-data, and ws (Fix 3 dependency vulnerabilities (esbuild, form-data, ws) #734).
• CI Hardening: Applied StepSecurity best practices, added a blocking Semgrep SAST gate and secretlint scanning, and added automatic SBOM generation to the Docker release pipeline.
• OpenSSF: passed baseline 1, 2 and 3 security self-eval (ongoing for 'passing' check). Update to current checks and new ones for hardened security. New policies. See SECURITY.md on GitHub.

Changed

• Dashboard: Consolidated the Dashboard into the Library component, removing the separate Library page.
• Docker:
  • Refactoring of the entrypoint script.
  • SQLITE_DB_PATH is now optional and exported with a default of /app/data/sqlite.db.
  • The PORT variable in docker-compose.yml has been split into two: HOST_SIDE_PORT (host-side binding, default 5000) and CONTAINER_INTERNAL_SIDE_PORT (internal container port, default 5000). If you had PORT set in your .env to customize the host port, rename it to HOST_SIDE_PORT.
• Dependencies: Node 22 to 26. Removed duplicate @types/multer entry from package.json; updated Radix UI, semver, and other minor dependencies; upgraded codecov/codecov-action from v5 to v7; updated numerous packages via Dependabot including lucide-react, recharts, framer-motion, jsdom, express, express-rate-limit, @tanstack/react-query, react-hook-form, and GitHub Actions.
• Performance: Optimized the Add Game modal's collection-status check with a Set lookup (⚡ Bolt: optimize AddGameModal collection status lookups #677); the downloads page now polls every 30 seconds.
• Downloaders Module: Refactored downloaders.ts into smaller modules for easier maintenance (refacto: modularization of downloaders.ts for easier maintenance #627).
• Notifications Behaviour: the notifications now trigger only once per event, instead of once per cron job.
• Genres & Platforms Display: Overflow-safe tag list for genres and platforms on game cards (feat: overflow-safe genres & platforms display with TagList #680).
• Aborted Downloads: Definitive downloader failures are now surfaced as "Aborted" instead of an unclear stuck state.
• List View: Removed the ultra-compact view in favor of an updated column-based row view.
• Date display: year-only release dates now display in full.
• Release Date Sorting when adding a game: IGDB results are not sorted by release date.
• Mobile Experience: Significant improvements to mobile layout and navigation (Enhance mobile layout and navigation #644).
• Downloader/Indexer Version Logging: Periodic logging of downloader and indexer versions to aid troubleshooting (Add periodic downloader and indexer version logging #649).

Removed

• Removed the HLTB integration from Questarr (no API or stable service).

Fixed

• Fixed status switcher UI and badge positioning in game details (Fix status switcher UI and badge positioning in game details #764).
• Fixed handling of the stoppedDL state in qBittorrent v5+.
• Fixed an error when adding a torrent via qBittorrent.
• Fixed a scrolling issue in the claim modal.
• Fixed Torznab/Prowlarr download URL rewriting so proxied URLs are no longer double-wrapped on host aliases (Fix Torznab/Prowlarr download URL rewrite to avoid proxy double-wrapping on host aliases #647).
• Fixed the files view and missing seed/leech numbers in download details.
• Hardened download status checks and migrated the Steam logger.
• Addressed edge cases in auto-search download rules
• Fixed the "Has results" badge that would create an offset in the game card.
• Fixed the Home Assistant add-on: moved to the repo root and corrected /data permissions on fresh installs (Fix HA add-on: move to repo root and fix /data permissions on fresh install #696). See [../questarr/README.md]

Vulnerabilities Addressed

• js-yaml 4.1.1 → 5.2.1 — fixes CVE-2026-53550 (GHSA-h67p-54hq-rp68, MODERATE) — quadratic-complexity DoS in merge-key handling via repeated aliases.
• multer 2.1.1 → 2.2.0 — fixes the 2 CVEs left open in the v1.3.0
  • CVE-2026-5038 (GHSA-3p4h-7m6x-2hcm, MODERATE) — DoS via incomplete cleanup of aborted uploads
  • CVE-2026-5079 (GHSA-72gw-mp4g-v24j, HIGH) — DoS via deeply nested field names
• form-data (transitive, resolved 4.0.5 → 4.0.6) — fixes CVE-2026-12143 (GHSA-hmw2-7cc7-3qxx, HIGH) — CRLF injection via unescaped multipart field names/filenames.
• ws (transitive, resolved 8.18.3 → 8.21.0) — fixes 2 CVEs:
  • CVE-2026-45736 (GHSA-58qx-3vcg-4xpx, MODERATE) — uninitialized memory disclosure
  • CVE-2026-48779 (GHSA-96hv-2xvq-fx4p, HIGH) — memory exhaustion DoS from tiny fragments/data chunks
• esbuild (devDep) 0.28.0 → 0.28.1 — fixes GHSA-g7r4-m6w7-qqqr (no CVE assigned) — the Windows dev-server arbitrary-file-read issue flagged as still-open in the v1.2.1/v1.3.0 entries is now fixed.
• esbuild, nested copy — the new npm overrides entry (@esbuild-kit/core-utils → esbuild ^0.25.0) bumps that dependency's bundled esbuild from 0.18.20 to 0.25.12, fixing GHSA-67mh-4wv8-2f99 (no CVE, MODERATE — dev server accepts arbitrary cross-origin requests). Separately, tsx's own duplicate nested esbuild copy (0.27.7, carrying the same GHSA-g7r4-m6w7-qqqr as above) was deduped away entirely by this bump round rather than upgraded.
• vite (devDep) 8.0.12 → 8.1.3 — fixes both issues left open in the v1.3.0:
  • CVE-2026-53571 (GHSA-fx2h-pf6j-xcff) — server.fs.deny bypass
  • CVE-2026-53632 (GHSA-v6wh-96g9-6wx3) — launch-editor NTLMv2 hash disclosure via UNC path on Windows

Download: set your Docker image tag to v1.4.0 or latest

• GitHub Container Registry

Full Changelog: v1.3.1...v1.4.0

---

This discussion was created from the release v1.4.0 - Post-processing, New Downloaders, Import History, Mobile Improvements, and Major Security Hardening.