Releases: WhispersOfJ/media-stack
Releases · WhispersOfJ/media-stack
Release list
v11.19.3
11.19.3 (2026-08-26)
Bug Fixes
- author baseline PR as trusted user via release-please PAT (57858f4)
- correct landing page health checks and doc links (f1f0667)
- count CRITICAL package CVEs in baseline report (e20f28a)
- grant pull-requests write and always ensure baseline PR (3df982e)
- install trivy via apt in report job (e8827b1)
- land trivy baseline report via PR instead of direct push (0b2f5b2)
- only edit an OPEN baseline PR, create otherwise (cf491db)
v11.19.2
v11.19.1
11.19.1 (2026-08-26)
Bug Fixes
- correct SARIF merge logic in trivy-scan workflow (ccd5d99)
- downgrade pytest to 8.3.4 for pytest-httpx 0.36.2 compat (ad5539b)
- restore pytest==9.1.1 for pytest-httpx 0.36.2 compat (71fd9fb)
- rewrite trivy-scan workflow with Python SARIF merge (df68414)
- simplify trivy-scan to individual scans with CRITICAL gating (44987d8)
- upgrade pytest-httpx to 1.1.0 for pytest 9 compatibility (d30867a)
- write image list to file to avoid shell quoting issues (07ccbbd)
Performance Improvements
- add --scanners vuln to trivy for faster scans (af2db03)
v11.19.0
11.19.0 (2026-08-26)
Features
- add arr-dashboard alongside existing control panel (d9a48cd)
- add bearer-token auth to /api/v2/host/* destructive endpoints (40b8206)
- add landing page with service status dashboard (6af004f)
Bug Fixes
- add arr-dashboard to stacknet so it can resolve Arr hostnames (fe6a2f0)
- add whitenoise to CI test requirements (2795558)
- add workflow_dispatch and fix trivy-scan path triggers (8a39cb3)
- audit findings — dedup regex year-match, view permission comments (7552008)
- bump pytest-httpx for pytest 9 compatibility (2763d67)
- contain stale-image crashes in list_containers and image_check (7bdbeb9)
- correct hardcoded /home/daddybear/ path in stack-tmdb-audit (efd300f)
- correct Metacache ARR config env vars to match code expectations (854625b)
- remove cap_drop: [ALL] from all services to fix SIGABRT crash-loops (5b99139)
- repair fish function API paths after Django migration (fa353b8)
- scan Trivy images individually instead of as one string (fe73dcb)
v11.18.0
11.18.0 (2026-08-25)
Features
- add /api/v2/cleanuparr/{instances,strikes} (7886b3f)
- add /api/v2/host/{reboot,pacman-sync,pacman-upgrade} (0d9d725)
- add /api/v2/prowlarr/indexers (Task 3) (5e1ddfc)
- add /api/v2/radarr/exclude (Task 4) (1346ecf)
- add /api/v2/ratings/* (imdb, mdblist rating lookups) (ee9a3cd)
- add /api/v2/seerr/requests (b9be395)
- add /api/v2/sonarr/monitor-episodes-fix (9020911)
- add /healthz endpoint, close out Phase 1 with full test suite green (3d1a0f1)
- add auth_app login/logout views backed by core.models.User sessions (fe51698)
- add bootstrap management command for admin user and service api key (7a9207d)
- add catalog app (list/status/install/remove for Docker-SDK software catalog) (dbad096)
- add Django template + htmx browser UI, closing out Phase 3 (dc8d549)
- add DRF envelope base, session-only permission, and ported client modules (50b53e8)
- add DRF session-or-api-key authentication and permission class (0d280cc)
- add letterboxd app (7 endpoints, scraping + ORM + cross-arr) (d4b53af)
- add mdblist app (import-list, track/untrack, sync-tick for MDBList) (eff2936)
- add nzbdav app (queue, history, dedup-config-check, stats, delete-failures) (9c5bb32)
- add plex app (13 endpoints, complex diagnostics) (d888505)
- add posters app (10 endpoints, background threads + SSE) (c9e16d6)
- add queue app (cross-app download-queue aggregation) (2ab1fee)
- add toast feedback to all quick action buttons on htmx completion (02d40c5)
- add watchstate app (status, import, history proxy for WatchState) (292e9bd)
- complete control panel redesign — design system, component library, all pages rebuilt (e368adc)
- Complete UI redesign with modern dark theme and command palette (1e3e45c)
- confirmation modal, connection monitoring, inline editing, parallel overview (4c2cd1c)
- generate initial Django migration for core models (d7f1fb1)
- port argon2 password and sha256 api-key hashing to core.security (68b25fc)
- port host and arr apps, closing out Phase 2 (51 endpoints) (9a19606)
- port same-origin verification middleware (e94c6a5)
- port SQLAlchemy models to Django ORM in core app (b9a2941)
- rebuild Poster Sync page with masonry gallery and sync controls (32edcbf)
- scaffold Django project skeleton for control-panel migration (296c6ba)
- wire SSE streaming for log viewer — live logs instead of 3s polling (2935156)
Bug Fixes
- adapt NzbDAV config metrics to current API (dfcbede)
- add HTTP_HOST/REMOTE_ADDR to host_actions 403 tests (8124bbc)
- add rate limiting to all destructive host-level endpoints (67cb2f3)
- adversarial review — XSS in toasts, SSE resource leak, reconnect race (61be38c)
- align Speedtest Tracker catalog port (953af74)
- bump Django to 5.2.17 for Python 3.14 compatibility (40f5f6d)
- bump pytest for CVE-2025-71176, add rate-limit test, document secure cookie env var (687b77b)
- cleanuparr missing-db raises 502 ServiceError, matching router.py (206b3b7)
- control panel can reach Plex via host.docker.internal (60adf62)
- correct MDBList response shape and IMDb N/A handling in ratings app (31db35a)
- Django control panel Dockerfile, healthcheck, and static file serving (0186e9d)
- document Metacache compose variables (a668252)
- exercise real auth layer in watchstate import unauthenticated test (4cc90d4)
- harden exporter metrics and live log handling (ba98cff)
- harden Phase 1 findings from final review — secret key, session fixation, DRF defaults, gitignore (76960b1)
- harden security — rate limiting, cookie config, ALLOWED_HOSTS, Docker import fallback, privilege docs (fcdd57c)
- persist control-panel SQLite DB in mounted /data volume (acced04)
- replace slack-github-action with plain curl in Trivy scan workflow (8340898)
- restore server-side error logging in ServiceError/envelope handler (b7f2485)
- Task 4 findings - idempotent exclusion + test fidelity (d559024)
- UI redesign bug fixes and security improvements (0ec2800)
- VerifySameOriginMiddleware host check + pytest.ini testpaths (9195d73)
- wire sparkline data binding so ApexCharts shows live CPU/RAM/queue history (1af83b1)
- wrap Plex httpx errors in posters list_libraries/gallery (ba503b6)
v11.17.0
11.17.0 (2026-08-21)
Features
- add Discord alert integration for Grafana/Loki (4a54c46)
- add Task 2 & 3 automation (upstream monitoring + weekly CVE scans) (3a1a7f6)
- create Grafana dashboards for Loki (Logs Overview + Import Pipeline) (519bb14)
- deploy Stage 1 logging (Loki 2.5.0 + Promtail + Grafana) (7213249)
- deploy Stage 4 (Trivy image CVE scanning + remediation plan) (0e648b7)
- distroless control-panel image for maximum hardening (3f2772d)
- upgrade control-panel to Python 3.13 with uvicorn 0.52.4 (17fe4f8)
Bug Fixes
- add missing Grafana admin credentials to .env.example (5db9724)
- Discord webhook integration - remove broken alert-rules YAML (cb840a6)
- remove unused variables from trivy scripts (shellcheck SC2034) (7f45a00)
- resolve port collision between Grafana (3001) and Uptime Kuma catalog entry (538fed8)
- revert distroless, keep Python 3.13-slim with shell-free healthcheck (bc0a989)
v11.16.0
11.16.0 (2026-08-20)
Features
- add Browser Games category to catalog (3 verified entries) (6368a00)
- add collapsible environment/volume details to catalog cards (d713736)
- add diagonal-hatch texture layer to page background (fdc0954)
- add Media category to catalog (8 verified entries) (4b2ae62)
- add per-group CPU sparkline history to Fleet rail (7e3c7cd)
- add RetroArch Emulation category to catalog (12 verified entries) (f8a9a87)
- add shared logger + 108 tests for control-panel/core/ (f1cb35e)
- default control-panel theme to amber Pip-Boy palette (9965440)
- give each rail a distinct accent hue (d4ee752)
- include environment and volumes in catalog list response (560bb41)
- Plan 3 severe consolidation — remove 7 services, merge anime into base Radarr/Sonarr (517978a)
- promote poster sync to top rail, remove software catalog rail (dc9f4c1)
- replace dark/light theme with amber/green Pip-Boy CRT palette (3129195)
- wire amber/green theme switch, delete software catalog module (0c701f5)
- wire InfiniDysk Prowlarr pull-sync now that v1.1.0+ is stable (b746438)
Bug Fixes
- address final-review findings (theme PATCH schema, dead CSS, fragile selector) (475c078)
- catalog details panel display:flex overrode [hidden], never collapsed (ff650a6)
- clear ruff lint errors blocking Validate Compose CI (dc27428)
- declare FUSE-mount dependency chain, add rclone healthcheck (a02163a)
- diverge --rail-plex-health from --bad to avoid error-color collision (d4e4ab0)
- guard unhandled Cleanuparr seeker fetch, add 23 script tests (10ce1d1)
- isolate router-import failures instead of crashing all of boot (10f545f)
- log silent excepts, justify automation routes, add 35 router tests (0df6ac1)
- remove dangling env vars for services deleted in consolidation (922831c)
- remove dead sparkline CSS rules, diverge rail-fleet/rail-catalog from status colors (113d38c)
- remove stale extras profile refs, fix dangling app.py COPY (7eb9af6)
- restore RAM sparkline green color and fill styling (9c070b3)
- update control-panel unit tests for amber/green theme default (56840a0)
Performance Improvements
- bump nzbdav queue worker count from 3 to 6 (718bcbe)
v11.15.0
v11.14.0
11.14.0 (2026-08-14)
Features
- --anime/--sonarr-anime flags across fish CLI, new mdblist tracking commands (fee0098)
- add curated software catalog (Phase 02 of the v3 design treatment) (22d00cb)
- add disk health, live host resources, and backup UI (Phase 03) (321a8be)
- add GAPS-2 (collection/franchise gap detection for movies and TV) (3e7eee1)
- add host-privileged-action helper (reboot, pacman sync/upgrade) (c627a61)
- add Letterboxd cache, tracked-list, and sync-log models (a20bfa6)
- add news.newshosting.com as tertiary nzbdav usenet provider (ed790b0)
- add ntfy (shared push-notification sink for Radarr/Sonarr/Prowlarr) (2b70fae)
- add Organizr (single landing dashboard for the whole stack) (7981026)
- add persisted settings and rack-console redesign to control-panel (8822d7b)
- add plex-marked-deleted-db-contention diagnosis skill (72dd457)
- add PlexAniSync (Phase 7) - anime watch state from Plex to AniList (c5bb824)
- add Poster Studio gallery, before/after preview, quality scan (Phase 04) (95c5cec)
- add Scrutiny (SMART trending + failure prediction for the host disk) (01f2967)
- add Speedtest Tracker (hourly ISP link monitoring + history) (43ed2fb)
- add stack-plex-butler-all fish function (691ac83)
- add WatchState (Phase 6) - Plex watch-state sync via import + webhook (ff651a9)
- anime Radarr/Sonarr support in Letterboxd import routes (bb9a5c9)
- attach scraped Letterboxd tags as Radarr tags on add (62ec168)
- cache Letterboxd slug->TMDb id lookups to skip re-fetching known slugs (6ad02e2)
- control-panel: Phase 1 of evolved backend - scaffolding + auth (ef98a82)
- control-panel: Phase 2 of evolved backend - fleet + settings (50a3cff)
- control-panel: Phase 3 of evolved backend - Radarr/Sonarr/Prowlarr/Bazarr (90bd869)
- control-panel: Phase 4 part 1 - Plex router (c3a5191)
- control-panel: Phase 4 part 13 - new-apps health/backup sweep router (307c152)
- control-panel: Phase 4 part 14 - poster-sync router (final Phase 4 service) (f277078)
- control-panel: Phase 4 part 2 - NzbDAV router (5aeff6f)
- control-panel: Phase 4 part 3 - host diagnostics (4924fa8)
- control-panel: Phase 4 part 4 - backups router (dd2a973)
- control-panel: Phase 4 part 5 - Tautulli router (894dd23)
- control-panel: Phase 4 part 6 - Wrapperr router (18223e5)
- control-panel: Phase 4 part 8 - Maintainerr router (29fe5e6)
- control-panel: Phase 4 part 9 - Checkrr router (bcf89ff)
- control-panel: Phase 4 parts 10-12 - Prefetcharr/Lingarr/Kometa routers (b7403c2)
- control-panel: Phase 5 cutover - flip live backend from app.py to main.py (8ad0e89)
- control-panel: redesign as a piping-and-instrumentation diagram (699cac1)
- control-panel: register radarr-anime instance (core/arr_client.py, core/docker_client.py) (c56feed)
- cross over TMDb-unmatched Letterboxd titles to Sonarr via series lookup (3f9f22f)
- cut fish functions over to symlinks, drop restic orphans (Phase 8a) (610926c)
- cut GAPS-2 to Movies/Shows and wire its Radarr/Sonarr (da052cf)
- dashboard panel for tracked Letterboxd lists + sync history (d09d9be)
- detect and auto-clear Radarr/Sonarr import starvation (860e27e)
- enable InfiniDysk repair, streaming perf, and safety settings (17db2d3)
- fish CLI commands for Letterboxd tracked-list sync + history (217e833)
- MDBList as its own package, with anime Radarr/Sonarr routing (c6ab624)
- nightly systemd-scheduled sync for tracked Letterboxd lists (d552ae6)
- plex: mount anime-movies path for the new Anime Movies library (b4b8b54)
- radarr-anime: add dedicated Radarr instance for anime movies (5be2982)
- radarr: add Criterion Collection custom format (d667f50)
- raise usenet provider max connections to 50 (dcef798)
- rating-aware quality-profile mapping for Letterboxd list adds (bfa89cd)
- re-add news.newshosting.com as tertiary nzbdav usenet provider (8fe471f)
- reconcile Radarr/Sonarr file lists against Plex by exact path (f6ad170)
- record + surface Letterboxd sync telemetry (GET /api/arr/letterboxd/history) (d6dec04)
- register radarr-anime across fleet-tracking skill scripts (db3347c)
- remove restic backup system entirely (cd841d6)
- script to remove Radarr-orphaned empty movie folders (55abc4f)
- stand up sonarr-anime as a full peer instance to radarr-anime (bb8b3e5)
- symlink installer for fish functions (Phase 8a) ([6fb8212](6fb82120c5c0548bc...
v11.13.0
11.13.0 (2026-08-02)
Features
- add loop remediation toolkit for manual unmonitor/exclude (9b9a697)
- promote queue-monitoring loop to stack-queue-autofix endpoint (a6359f4)
Bug Fixes
- add rclone timeout tuning to nzbdav_rclone mount, adopt larger cache (9d6e93d)
- cap usenet provider connections at 25 each (a05e09c)
- confirm Plex stalled_suspected over multiple polls before flagging (ad12ad1)
- docker-compose-manager cascade uses force-recreate, verifies mount (77a95c2)
- fall back to direct API lookup when queue item's embedded monitored status is null (1b05e3c)
- remove stale/phantom service references from control panel (e1fc188)
- skip re-search for unmonitored items in queue-autofix (f959f3f)
- tolerate benign 404/timeout on queue-autofix blocklist delete (0be5cb3)