Skip to content

v1.4.0 - Post-processing, New Downloaders, Import History, Mobile Improvements, and Major Security Hardening

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 16 Jul 15:15
v1.4.0
fcede1d

Questarr v1.4.0 introduces a major set of improvements across post-processing, downloader support, observability, mobile experience, and security.

An easter egg has been added to Questarr; shouldn't be too hard to find if you think about the very famous easter eggs in gaming! Let me know what you think.

Migration note:

  • The PORT variable in docker-compose.yml has been split into two: HOST_SIDE_PORT (host-side binding, default 5000) and CONTAINER_INTERNAL_SIDE_PORT (internal container port, default 5000). If you had PORT set in your .env to customize the host port, rename it to HOST_SIDE_PORT.
  • With Post-processing, don't forget to add your volume mapping to the docker compose file.

Added

  • Post-Processing Pipeline: Added an automated post-processing pipeline that handles unpacking and organizing files after a download completes (#583)
    • Files can be unpacked automatically by setting auto-unpack setting
    • An import modal is displayed via an alert in the library when the system cannot find the input or output path.
  • Import History: New page listing import tasks (game claims, post-processing imports, Steam syncs) with a retention purge cron job to keep the history tidy (#714).
  • Deluge Support: Added Deluge as a supported downloader (#697).
  • Synology Download Station: Added support for Synology's built-in Download Station as a downloader (#567).
  • Apprise Notifications: Added Apprise API and CLI notification modes. Use API mode with a remote Apprise server or CLI mode with the local apprise binary from Questarr settings. Bundled Python and Apprise in the default image so CLI mode works without a separate image split.
  • Personal Notes: Added the ability to attach personal notes to a game.
  • Shelved Status: Added a "shelved" status for games (#645).
  • Real-Time Logs: Added a real-time log streaming page with configurable detail level and truncation for large payloads.
  • Send Logs: Added the ability to send logs directly from the app for troubleshooting (#648).
  • Search Improvements: Added a date filter and infinite scroll to search, plus the ability to delete a result from the library directly from search (#673).
  • Library Ratings: Added a user rating filter and inline rating in the library's list view; the Stats page now shows average user rating.
  • Favorite groups: Added favorite release groups for auto downloading releases, in the settings.
  • G4U as indexer: Added g4u.to as an indexer type, using their VIP API (#689).
  • Vite Base Path: Added support for deploying behind a custom base path (#630).
  • Code of Conduct: Added Contributor Covenant Code of Conduct.
  • Downloaders Compatibility doc: Added a document detailing compatibility for supported downloaders.

Security

  • SSRF: Hardened outbound fetches with DNS rebinding protection (#698).
  • Dependency Vulnerabilities: Fixed 3 known vulnerabilities in esbuild, form-data, and ws (#734).
  • CI Hardening: Applied StepSecurity best practices, added a blocking Semgrep SAST gate and secretlint scanning, and added automatic SBOM generation to the Docker release pipeline.
  • OpenSSF: passed baseline 1, 2 and 3 security self-eval (ongoing for 'passing' check). Update to current checks and new ones for hardened security. New policies. See SECURITY.md on GitHub.

Changed

  • Dashboard: Consolidated the Dashboard into the Library component, removing the separate Library page.
  • Docker:
    • Refactoring of the entrypoint script.
    • SQLITE_DB_PATH is now optional and exported with a default of /app/data/sqlite.db.
    • The PORT variable in docker-compose.yml has been split into two: HOST_SIDE_PORT (host-side binding, default 5000) and CONTAINER_INTERNAL_SIDE_PORT (internal container port, default 5000). If you had PORT set in your .env to customize the host port, rename it to HOST_SIDE_PORT.
  • Dependencies: Node 22 to 26. Removed duplicate @types/multer entry from package.json; updated Radix UI, semver, and other minor dependencies; upgraded codecov/codecov-action from v5 to v7; updated numerous packages via Dependabot including lucide-react, recharts, framer-motion, jsdom, express, express-rate-limit, @tanstack/react-query, react-hook-form, and GitHub Actions.
  • Performance: Optimized the Add Game modal's collection-status check with a Set lookup (#677); the downloads page now polls every 30 seconds.
  • Downloaders Module: Refactored downloaders.ts into smaller modules for easier maintenance (#627).
  • Notifications Behaviour: the notifications now trigger only once per event, instead of once per cron job.
  • Genres & Platforms Display: Overflow-safe tag list for genres and platforms on game cards (#680).
  • Aborted Downloads: Definitive downloader failures are now surfaced as "Aborted" instead of an unclear stuck state.
  • List View: Removed the ultra-compact view in favor of an updated column-based row view.
  • Date display: year-only release dates now display in full.
  • Release Date Sorting when adding a game: IGDB results are not sorted by release date.
  • Mobile Experience: Significant improvements to mobile layout and navigation (#644).
  • Downloader/Indexer Version Logging: Periodic logging of downloader and indexer versions to aid troubleshooting (#649).

Removed

  • Removed the HLTB integration from Questarr (no API or stable service).

Fixed

  • Fixed status switcher UI and badge positioning in game details (#764).
  • Fixed handling of the stoppedDL state in qBittorrent v5+.
  • Fixed an error when adding a torrent via qBittorrent.
  • Fixed a scrolling issue in the claim modal.
  • Fixed Torznab/Prowlarr download URL rewriting so proxied URLs are no longer double-wrapped on host aliases (#647).
  • Fixed the files view and missing seed/leech numbers in download details.
  • Hardened download status checks and migrated the Steam logger.
  • Addressed edge cases in auto-search download rules
  • Fixed the "Has results" badge that would create an offset in the game card.
  • Fixed the Home Assistant add-on: moved to the repo root and corrected /data permissions on fresh installs (#696). See [../questarr/README.md]

Vulnerabilities Addressed

  • js-yaml 4.1.1 → 5.2.1 — fixes CVE-2026-53550 (GHSA-h67p-54hq-rp68, MODERATE) — quadratic-complexity DoS in merge-key handling via repeated aliases.
  • multer 2.1.1 → 2.2.0 — fixes the 2 CVEs left open in the v1.3.0
  • form-data (transitive, resolved 4.0.5 → 4.0.6) — fixes CVE-2026-12143 (GHSA-hmw2-7cc7-3qxx, HIGH) — CRLF injection via unescaped multipart field names/filenames.
  • ws (transitive, resolved 8.18.3 → 8.21.0) — fixes 2 CVEs:
  • esbuild (devDep) 0.28.0 → 0.28.1 — fixes GHSA-g7r4-m6w7-qqqr (no CVE assigned) — the Windows dev-server arbitrary-file-read issue flagged as still-open in the v1.2.1/v1.3.0 entries is now fixed.
  • esbuild, nested copy — the new npm overrides entry (@esbuild-kit/core-utils → esbuild ^0.25.0) bumps that dependency's bundled esbuild from 0.18.20 to 0.25.12, fixing GHSA-67mh-4wv8-2f99 (no CVE, MODERATE — dev server accepts arbitrary cross-origin requests). Separately, tsx's own duplicate nested esbuild copy (0.27.7, carrying the same GHSA-g7r4-m6w7-qqqr as above) was deduped away entirely by this bump round rather than upgraded.
  • vite (devDep) 8.0.12 → 8.1.3 — fixes both issues left open in the v1.3.0:

Download: set your Docker image tag to v1.4.0 or latest

Full Changelog: v1.3.1...v1.4.0

Assets 2
Loading
0 Join discussion