Skip to content

NodeCast TV Plus v2.3.0

Choose a tag to compare

View all tags
@MikaelKW MikaelKW released this 16 Jul 11:45
v2.3.0
4e5c9b2
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

NodeCast TV Plus v2.3.0

NodeCast TV Plus v2.3.0 adds secure optional authenticator-app two-factor authentication for local accounts and improves the first-run experience after adding content sources.

Highlights

  • Automatically synchronize newly added M3U, standalone EPG, and Xtream sources with visible progress and retry handling by @MikaelKW in #158.
  • Prevent repeated source submission while the initial source request is still being processed by @MikaelKW in #158.
  • Add guided authenticator-app enrollment, server-side sign-in challenges, replay protection, rate limits, and single-use recovery codes by @MikaelKW in #165.
  • Encrypt TOTP secrets at rest and store recovery codes only as keyed hashes by @MikaelKW in #165.
  • Provide protected recovery-code regeneration, self-service disable, and administrator reset controls by @MikaelKW in #165.
  • Consolidate Account security and Logout beneath a username-initial menu with desktop and mobile scrolling corrections by @MikaelKW in #165.

Upgrade from v2.2.2

Back up the existing /app/data volume, pull the release image, and recreate the container with the same volume and deployment secrets:

docker pull ghcr.io/mikaelkw/nodecast-tv-plus:2.3.0

No manual database migration is required. Keep the existing strong, distinct JWT_SECRET and SESSION_SECRET values.

To make authenticator-app 2FA available to local accounts, generate a third independent strong secret and provide it as TOTP_ENCRYPTION_KEY. This setting is optional, but once accounts enroll it must be preserved across upgrades and backed up securely alongside the deployment configuration. Losing or changing it makes existing TOTP enrollments unusable.

Available stable image tags after publication:

  • 2.3.0 — this exact release
  • 2.3 — newest compatible 2.3 patch release
  • latest — newest stable release

To roll back, stop the upgraded container, restore the pre-upgrade data backup, and recreate the container with 2.2.2 and the existing deployment secrets.

Validation

  • Application, authentication, TOTP security, dependency, browser/media, mobile WebKit, reverse-proxy subpath, Docker, release-metadata, and migration checks passed.
  • The automated release gate verified supported upstream v2.1.1 and 2.1.4 migrations and an upgrade from the published Plus v2.2.2 image, preserving accounts, provider configuration, settings, content records, favorites, history, hidden items, and authentication state.
  • Controlled source testing verified successful delayed synchronization, visible failure and retry handling, and duplicate-submission prevention.
  • Hands-on desktop and physical-iPhone Safari testing verified QR enrollment, invalid-code recovery, authenticator login, single-use recovery login, recovery-code counts, Account Security controls, navigation, scrolling, and portrait/landscape behavior.

See the full changelog for complete change, security, and upgrade details.

Contributors

MikaelKW
Assets 2
Loading