v1.1.0

BitPlay is back under active development. This release rolls up everything since v1.0.0.

New:

• MKV playback. Files the browser can't demux are remuxed on the fly with ffmpeg, no re-encoding. Multi-audio files get a track picker, and seeking works on remuxed streams. If a codec truly can't play in your browser, BitPlay names it and hands you the stream URL for VLC or mpv.
• Upload your own .srt/.vtt subtitles during playback.
• Optional basic auth for public instances (BITPLAY_AUTH_USERNAME / BITPLAY_AUTH_PASSWORD).
• Maintenance tab in settings: active sessions, server logs, and a cache purge button. Nothing cleaned up torrent-data before, so run a purge after updating.
• Configurable search timeout and a TLS verification toggle for self-signed Prowlarr/Jackett instances.

Fixed:

• Torrent uploads and magnet playback on Firefox. A synthetic form submit reloaded the page mid-request; verified fixed on real Firefox.
• API keys are no longer sent to the browser, and settings.json is written with tighter permissions. Rotate your keys if your instance was reachable publicly.
• XSS in search results, wrong MIME types on streams, subtitle conversion choking on BOMs, long plays getting their session reaped mid-movie, and a handful of smaller bugs.
• Dependencies refreshed past CVE-2025-49140. Built on Go 1.26 with video.js 8.24.0.

Notes:

• The Docker image now includes ffmpeg and is around 100MB larger.
• Images from this release are tagged latest, 1.1, and 1.1.0. The main tag still tracks the branch.