v0.16.1

Dependency update, no functional change.

Dependencies

• Go modules: 8 minor/patch updates (#11).
• Frontend npm packages: 11 minor/patch updates (#14).
• GitHub Actions: 7 updates, still pinned by commit (#9).
• Dependabot now runs monthly, groups Android updates and leaves npm major versions to manual upgrades (#19).

Upgrade notes

• None. No migration.

v0.16.0

Security release: fixes the findings of an external security audit, plus the groundwork for 1.0 (mobile apps on the public demo, store metadata). Upgrading is strongly recommended.

Security

• Settings that change sign-in or identity (OIDC, LDAP, Jellyfin API key, public address, dashboard API key) now require the admin role. Before, the delegable "Manage settings" permission was enough, which allowed a privilege escalation.
• Admin role follows Jellyfin and your SSO group: a user who loses admin there is demoted at the next sign-in or hourly check. Roles granted by hand in Tipsarr are kept.
• OIDC matching: configurable username claim (default preferred_username), exact match, no fallback to name/nickname, unverified e-mail refused.
• Login throttling is stored in the database, with an escalating lockout (up to 1 hour) and a short delay after each failure.
• Outbound webhooks can no longer reach loopback or link-local addresses, and reach private (LAN) addresses only when their host is listed in Admin > Webhooks > Allowed internal hosts. Checked at connection time, so DNS rebinding does not get around it.
• Secrets are encrypted at rest (AES-256-GCM): API keys, OIDC/LDAP secrets, webhook secrets and headers, relay key.
• Secrets are no longer sent back by the settings API (show/regenerate buttons instead); remote error messages and internal 5xx details are no longer shown to users; avatar images are size-checked before decoding; the stored Radarr/Sonarr key is not sent to a new host.
• Client IP taken from trusted proxies only (TIPSARR_TRUSTED_PROXIES); TIPSARR_COOKIE_SECURE=true now really forces the Secure flag; HTTP server timeouts, HSTS, and a CSP without unsafe-inline for scripts.
• Setup token required by default on a fresh install unless TIPSARR_JELLYFIN_URL is set. The ?token= form of the Jellyfin webhook URL is deprecated (use the X-Tipsarr-Token header).
• Supply chain: GitHub Actions pinned by commit, base images by digest, Dependabot; the image now ships an SBOM and provenance and is signed with cosign (see SECURITY.md to verify).

Also in this release

• The mobile apps can sign in to the public demo (https://tipsarr-demo.brebond.com, admin / demo or user / demo).
• Store listings and review material for the 1.0 apps; PRIVACY.md completed.

Upgrade notes

• Migration 031_auth_hardening runs automatically.
• Back up secret.key (created in the config folder at first start, or set TIPSARR_SECRET_KEY) together with the database. Without it the stored secrets have to be entered again. Going back to 0.15 needs a database restored from before the upgrade.
• Webhooks to LAN addresses (ntfy, Home Assistant…) fail until their host is added to Allowed internal hosts; the startup log lists them.
• OIDC usernames now match Jellyfin's exactly (case-sensitive).
• After upgrading, review the admin roles in Users (existing admins without a known origin are kept as manual admins, with a log warning).
• A reverse proxy on a public address must be added to TIPSARR_TRUSTED_PROXIES.
• New optional env vars: TIPSARR_SECRET_KEY, TIPSARR_TRUSTED_PROXIES, TIPSARR_SESSION_TTL, TIPSARR_SESSION_RECHECK_GRACE.

v0.15.0

Highlights

• Public demo: try Tipsarr at https://tipsarr-demo.brebond.com. Every visitor gets a private, throwaway sandbox (admin access included) that is wiped after 30 minutes of inactivity or 60 minutes in total.
• Demo mode (TIPSARR_DEMO_MODE=true): dry-run forced, every outbound connection limited to the demo gateway, webhook tests, push registration, LDAP, OIDC and trailer downloads disabled, one-click "Sign in as admin / user", banner with the remaining time.
• demo-gateway (backend/cmd/demo-gateway, Dockerfile.demo, deployments/demo/): pool of pre-warmed Tipsarr processes, one per session, per-IP session limit, shared TMDB caching proxy with a global rate limit (the TMDB key never reaches a sandbox). Run your own demo with the compose example.
• Documentation: new README, user docs in docs/ (installation, configuration, authentication, notifications, push notifications, mobile apps, demo, API, upgrading, FAQ, translations), plus CONTRIBUTING, SECURITY, PRIVACY and CODE_OF_CONDUCT, issue and PR templates.

Upgrade notes

• No migration. Nothing changes for a normal install: demo mode is off unless TIPSARR_DEMO_MODE=true.

v0.14.0

Highlights

• Webhooks v2: body and URL are now Liquid templates, with ready-made presets for Discord (embed with poster), ntfy, Gotify, Telegram, Slack, Pushover, Apprise and Home Assistant. An empty template still sends the original JSON envelope, so existing integrations keep working.
• In-app template help: the webhook editor lists every variable of the chosen event (description, example value, click to insert), plus a short Liquid cheatsheet and a live preview.
• Auth and headers per webhook: Bearer, Basic or custom headers, on top of the existing HMAC signature.
• Send once per recipient: a webhook can be delivered once per concerned user (requester, issue participants, admins) with notifyUser filled. Users can set their Discord user ID and Telegram chat ID in Profile > Settings, so personal alerts work without the mobile apps.
• New events: request.auto_approved, issue.reopened, test.
• Mobile push, one click: Admin > Connections > "Enable mobile notifications" registers your server with the public push relay (no key to ask for). Public keys have a daily quota (200 alerts) and always send generic alert texts.
• French translation review: informal "tu" everywhere, consistent terms ("Signalements", "Ma liste" instead of "À voir", "Réglages"), French typography.

Fixes

• A problem can no longer be reported on a title that is not in the library (web, iOS, Android; the server refuses it with not_in_library). Partially available series are still allowed.
• Reopening an issue that is already open no longer fires issue.reopened.

Upgrade notes

• Migrations 029_webhook_templates and 030_user_notify_ids run automatically at start.
• New setting Tipsarr public address (Admin > Webhooks): the base of {{ url }} links in webhooks. Empty = no links.
• If you used a hand-issued relay key, it keeps working unchanged. "Enable mobile notifications" replaces it with a public key (quota, no titles in alerts).

Apps

No minimum app version change. The new French strings reach iOS and Android with their next builds.