v0.2.0

0.2.0 (2026-05-11)

Features

• 10-01: establish uv lockfile and Python 3.13 pin (b8d01ce)
• 10-02: uv sync smoke, py_compile, deprecate pip-first requirements (da084c9)
• 11-01: create jellyswipe package directory and init.py skeleton (a95caa6)
• 11-01: flatten media_provider modules into jellyswipe/ root (fdffd7e)
• 11-02: create Flask app in jellyswipe/init.py (182ae8e)
• 11-02: create jellyswipe/db.py with database functions (c366c00)
• 11-02: update app.py to import from jellyswipe (f640591)
• 11-03: configure Flask to find templates and static from jellyswipe package (f03ed91)
• 11-03: configure pyproject.toml to include templates and static in package data (80dfebd)
• 11-04: remove broken static volume mount from docker-compose.yml (39ad516)
• 11-04: update Dockerfile Gunicorn entry point to jellyswipe:app (574f429)
• 11-05: add gevent dependency to pyproject.toml and update lockfile (aa48bb2)
• 11-05: configure Gunicorn to use gevent workers in Dockerfile (872515a)
• 12-01: convert Dockerfile to multi-stage build with uv (86d4153)
• 12-02: add Development section to README with uv documentation (b0c9090)
• 13-01: delete Plex implementation files (aa15204)
• 13-01: remove Plex code and implement Jellyfin-only provider (694de5d)
• 13-01: remove Plex references from base.py docstrings (f22bd5b)
• 13-02: remove plexapi from dependencies (2940c25)
• 13-02: update database schema to use user_id (7445776)
• 13-02: update docker-compose.yml to Jellyfin-only (8b3420f)
• 13-02: update PROJECT.md to reflect Jellyfin-only support (f47c345)
• 13-02: update README to Jellyfin-only documentation (17dcffd)
• 18-01-01: harden identity resolution sources (6257114)
• 30-01: update Dockerfile CMD to Uvicorn; add Flask import guards for framework-agnostic imports (1623725)
• 31-01: rewrite Flask factory to FastAPI with full middleware stack (dd10393)
• 32-01: implement dependencies.py DI callables (3f356a9)
• 32-01: rewrite test_auth.py with FastAPI TestClient (dcee6cd)
• 33-01: create config.py and routers/init.py (73f786b)
• 33-01: extract auth, static, media, and proxy routers (4b54b07)
• 33-02: create rooms router with swipe transaction integrity (cda056d)
• 34-01: add sse-starlette>=3.4.1 to dependencies (631f455)
• 34-02: add async SSE route to rooms.py (8a14b24)
• 34-02: remove inline SSE block from init.py (158e572)
• 35-01: rewrite conftest.py with FastAPI TestClient infrastructure (10bb937)
• 35-01: wire SECRET_KEY into create_app() SessionMiddleware (ee3bc96)
• 35-02: migrate test_routes_room.py to FastAPI TestClient (c97e46e)
• 35-02: migrate test_routes_xss.py to FastAPI TestClient (c71af23)
• 35-03: migrate test_route_authorization.py to use client_real_auth (60797ef)
• 35-03: migrate test_routes_auth.py to use client_real_auth (9356587)
• 35-04: migrate test_routes_sse.py to FastAPI TestClient patterns (d75289f)
• add a favicon and serve it (0d09962)
• alembic (#38) (505aa64)
• commit some of phase 35 (d0cfbf2)
• EPIC-04: Harden outbound HTTP — TMDB auth, rate limiting, SSRF protection (#31) (37cd089)
• Jelly Swipe rebrand (defaults, Docker, manifests, LICENSE) (9d964d4)
• ORCH-001: add include_movies and include_tv_shows columns to Room model (#39) (3c1f4d1)
• ORCH-002: add hide_watched column to rooms table (#52) (b0fbc77)
• ORCH-003: rename movie_id to media_id in public API (#41) (8af3cdd)
• ORCH-004: add hide_watched parameter to provider interface (#56) (1be7fc4)
• ORCH-005: propagate hide_watched state through SSE stream (#58) (655c05c)
• ORCH-006: add session setup panel with media type toggles (#46) (a2c4a2a)
• ORCH-007: add media-type badge to swipe cards (#47) (75b0e23)
• ORCH-008: add Hide Watched toggle pill with SSE sync (#60) (77dcf9e)
• ORCH-008: carry media_type through matches, history, and deep-links (#48) (e2e5f1d)
• ORCH-014: replace release-ghcr.yml with multi-arch build and add docker-main workflow (#77) (25e404d)
• phase-01: provider env validation, lazy plexapi, operator docs (ddc5345)
• phase-02: media provider abstraction with executable plans (3621e65)
• phase-03: Jellyfin auth client and factory wiring (56ec757)
• phase-04: Jellyfin library deck, proxy images, and TMDB parity (aee809c)
• phase-05: add Jellyfin user parity and packaging plan artifacts (fc6068e)
• phase-09: Jellyfin delegate browser session and poster contain (d349ea5)
• Remove residual username/password auth code paths (#73) (c525f84)
• rewrite with FastAPI (#37) (6ebd9c3)
• SSE stream improvements (#68) (deb8855)
• update docker building (b6c3f60)
• v1.6 Plex Reference Cleanup + XSS Security (EPIC-08) (#28) (e089544)

Bug Fixes

• 04: close jellyfin trailer/cast 500 gap (cfbfae1)
• 10x the ratelimits (5e2a455)
• 13-01: add Optional import for type hint (bb58577)
• 13-03: update SQL statements to use user_id instead of plex_id (82d5d39)
• 31: CR-01 fix database connection leak by using get_db_closing() (07b66e5)
• 31: CR-02 extend vault TTL to 14 days to match cookie max_age (36daeaa)
• 31: CR-03 validate movie_id is present before using it (fa996d1)
• 31: CR-04 fix path traversal by using StaticFiles mount instead of FileResponse (32ee473)
• 31: CR-05 fix broken manual transaction by using single BEGIN IMMEDIATE block (19785ab)
• 31: WR-01 use XSSSafeJSONResponse instead of JSONResponse for XSS protection (01b2197)
• 31: WR-02 URL-encode user data in TMDB URLs to prevent malformed requests (b7d8f74)
• 31: WR-03 handle ValueError on page parameter with proper error response (c21a3c4)
• 31: WR-04 add authentication to room status and stream endpoints (278d477)
• 31: WR-05 use secrets for pairing code with collision detection (2480a6d)
• 31: WR-06 capture validated JELLYFIN_URL at module level to prevent SSRF bypass (18c4723)
• 33-02: update boot validation test to check config.py after Phase 33 extraction (963d31a)
• 35-05: apply three surgical fixes to test_routes_proxy.py (55a919d)
• 35-05: migrate test_error_handling.py to FastAPI TestClient (0055399)
• auth: enforce verified identity across protected routes (33b785b)
• default SQLite path to project data/ for local dev (fd0e11b)
• EPIC-09: route test coverage + CSP compliance (v1.5) (#26) (f5c193d)
• EPIC-10: cleanup data bind mount usage (#22) (5a2924b)
• issue 33 and 32 (#34) (08be1ec)
• jellyfin: support API-key mode user-id fallback (10b3b6e)
• resolve ruff E402/F401 errors; add pre-commit config (b2bb87b)

Documentation

• 01: capture phase context (4f6ecec)
• 01: execute phase 1 — add plan summaries (CFG-01..03 verified) (76d333c)
• 02: capture phase context (6eef476)
• 03: capture phase 3 discuss context (a266a2a)
• 03: execute phase — summaries + README recovery step + JAUTH traceability (a184772)
• 03: plan phase — RESEARCH + PLAN-01/02 (Jellyfin auth) (cd76fb0)
• 03: remove superseded 03-PLAN-*.md filenames from git index (a81bae2)
• 03: rename plans to 03-NN-PLAN.md for GSD phase-plan-index (42bf3b2)
• 04: add remaining plan + sync state and roadmap (d7cff21)
• 04: capture phase 4 discuss context (9d817ee)
• 04: execute phase — summaries + context alignment + JLIB traceability (f3ee30b)
• 05: add root causes from diagnosis (1a4c258)
• 05: capture phase 5 discuss context (5a113c4)
• 06: add phase research validation and plans (193dba6)
• 06: capture phase context (5ac6a4a)
• 07: capture phase context (aaa7218)
• 08-01: add Jellyfin-forward operator E2E narrative (08-E2E.md) (10c7809)
• 08-01: add plan summary (48b6a97)
• 08-02: add 03-VALIDATION and complete 01-VALIDATION (task 08-02-01) (4ca0543)
• 08-02: add 04-VALIDATION; complete 02 and 05 validation (task 08-02-02) (c96f06e)
• 08-02: add plan summary (46069d1)
• 08-03: add plan summary (0f72c87)
• 08-03: refresh milestone audit, complete 08-VALIDATION, trace Phase 8 in REQUIREMENTS (44f798c)
• 08: add code review skip and phase verification (bf2c1f0)
• 08: capture phase context (dfd5a4e)
• 09: plan phase — context, UI-SPEC, research, validation, patterns, plans (d122136)
• 10-01: add plan summary (59f18a1)
• 10-02: add plan summary (aabe67d)
• 10: add phase plans (uv lockfile) (0f0a4bc)
• 10: align py_compile action with acceptance (f8502bc)
• 10: capture phase context (e016ba3)
• 10: clarify py_compile includes init (ec58124)
• 11-01: complete package structure plan (05487c8)
• 11-02: complete database module and Flask app migration plan (f21227d)
• 11-03: complete templates and static assets package data plan (1d11051)
• 11-04: complete package layout migration plan (a130aaf)
• 11: complete phase 11 - jellyswipe package layout (f61cf1b)
• 11: create gap closure plan for SSE stream gevent workers (3f735c3)
• 11: create phase plan - jellyswipe package layout (7ee2588)
• 12: capture phase context (080c0aa)
• 12: complete docker-maintainer-docs phase (a571488)
• 12: create phase plan - Docker & maintainer docs (a23fd85)
• 12: research phase domain and validation plan (02b0753)
• 13-03: complete plan 13-03 verification (f3a71ea)
• 13-03: record plan 13-01 and 13-02 completion (4cee56b)
• 13: create phase plans to remove Plex support (21337f0)
• 18-01: record execution summary (9dcf711)
• 18: add phase research and validation strategy (62dc8ab)
• 18: capture phase context (92ca410)
• 18: create execution plan (c0d56ed)
• 19: add research and executable plan (d9e1d61)
• 19: capture phase context (c283acb)
• 19: record execution summary and phase completion (2a18f40)
• 20: add research and executable plan (74590d1)
• 20: capture phase context (9864361)
• 20: mark security regression phase complete (de29992)
• 30-01: complete package-deployment-infrastructure plan — FastAPI/Uvicorn stack (048f560)
• 30: add code review report (bb4a6cd)
• 30: capture phase context (b96e18a)
• 30: create phase plan — package and deployment infrastructure (fb6ea37)
• 30: create phase plan — swap Flask/Gunicorn for FastAPI/Uvicorn stack (3d9f6b2)
• 31-01: complete FastAPI app factory and session middleware plan summary (d487040)
• 31: add code review report (4ac4a83)
• 31: add code review report (6fe4494)
• 31: add decision coverage to plan must_haves (6f883a1)
• 31: add UI design contract for FastAPI app factory phase (67b0593)
• 31: capture phase context (1aa6c00)
• 31: create phase plan (df23236)
• 32-01: complete auth rewrite and dependency injection layer plan (11e563c)
• 32: add code review report (44efadb)
• 32: add code review report (f02dd66)
• 32: capture phase context (21a922f)
• 32: create phase plan — auth rewrite and dependency injection layer (b991505)
• 32: research auth rewrite and DI layer (624b8f7)
• 33-01: complete [create config.py and extract routers] plan (ac5dd24)
• 33-02: complete [rooms router and thin app factory] plan (ea6d8b6)
• 33: add code review report (e65aa74)
• 33: capture phase context (8d22a98)
• 33: create phase plan — 2 plans for router extraction (4c64915)
• 34: capture phase context (f715525)
• 34: complete Phase 34 - SSE Route Migration (651514e)
• 35-01: complete test suite foundation plan (494c5d2)
• 35-02: complete room and XSS test migration plan (854f8a2)
• 35-03: complete Migrate Real-Auth Test Files plan (c8c89a2)
• 35-04: complete test_routes_sse.py migration plan (71f8392)
• 35-05: complete plan 05 - migrate test_routes_proxy.py and test_error_handling.py (5ad5dbc)
• 35: capture phase context (2f869ee)
• 35: create phase plan — test suite migration and full validation (b381e3d)
• 35: research phase domain (347cddf)
• add ADR and PRD for next task (2adc0d8)
• add andrewthetechie as a contributor for code, and ideas (#25) (803e0de)
• add Bergasha as a contributor for code, and ideas (#24) (d42a7f0)
• add Jellyfin milestone research (86924f2)
• add roadmap, state, stack research, and GSD Cursor rules (7d7eeac)
• clarify phase 2 success criteria for Jellyfin mode (9910d9f)
• clear previous phase artifacts for v1.4 (c4fb982)
• codebase: refresh architecture map post-EPIC-05/06 (6d97aa6)
• create milestone v1.2 roadmap (3 phases) (b0d0c8d)
• create milestone v1.4 roadmap (3 phases) (28e5153)
• create milestone v2.0 roadmap (6 phases, 9 requirements) (8cc1b95)
• defer incomplete Phase 1/3/4 items to backlog (1b4b590)
• define milestone v1.2 requirements (5a8ac15)
• define milestone v1.4 requirements (339214e)
• define milestone v2.0 requirements (9 requirements, Pydantic deferred to v2.1) (a2ee9ad)
• fix milestone audit link in archived v1.0 REQUIREMENTS (c99940b)
• fix STATE focus after phase 08; mark Phase 8 complete in ROADMAP (6377c04)
• initialize GSD project for Jellyfin milestone (6954ec8)
• map existing codebase (bbbd0bf)
• phase-06-01: add Phase 1 CFG verification artifact (649fc73)
• phase-06-02: add Phase 2 ARC verification artifact (01fc38a)
• phase-06-03: Phase 6 closure index and REQUIREMENTS sync (f725ca9)
• phase-06: mark Phase 6 complete in ROADMAP and STATE (fef95ee)
• phase-06: skip code review (planning-only changes) (04fbced)
• phase-08: add research, Nyquist validation strategy, and three executable plans (50e1748)
• phase-08: complete phase execution (bc46955)
• phase-08: evolve PROJECT.md after phase completion (cb99ce0)
• phase-10: verification, review, PROJECT/STATE after phase complete (a7567fa)
• phase-18: complete phase execution (fed01e5)
• phase-18: evolve PROJECT.md after phase completion (fe587a0)
• phase-30: complete phase execution (ce58cd4)
• phase-31: complete phase execution (9d1404e)
• phase-31: update tracking after wave 1 (592477e)
• phase-33: complete phase execution (4984b5d)
• phase-33: evolve PROJECT.md after phase completion (423fe6f)
• phase-33: update tracking after wave 2 (280fcd5)
• phase-34: create SSE route migration plan (2 plans, 2 waves) (bb36b1c)
• phase-35: create phase plan (31a79d4)
• roadmap: add gap closure phases 6-8 (cf323b7)
• roadmap: check off backlog item 999.3 planning artifact (c223471)
• roadmap: check off Phase 999.1 Phase 1 summary debt (ca08abe)
• roadmap: Phase 9 goal and plan breakdown after plan-phase (6b2765e)
• start milestone v1.2 uv and jellyswipe package layout (edacbd9)
• start milestone v1.4 Authorization Hardening (190475d)
• start milestone v2.0 Flask → FastAPI + MVC Refactor (0ac0a67)
• state: advance to phase 5 after gsd-next (564ed6d)
• state: align focus after phase 3 discuss chain (eb2471f)
• state: align resume file with phase 2 context (91f585e)
• state: fix frontmatter after phase 10 plan (78617ba)
• state: mark phase 18 planned (8234d03)
• state: mark phase 19 planned (291f938)
• state: mark phase 20 planned (5ec808b)
• state: Phase 01 complete — point next step at 999.2 / plan-phase 3 (fbb2ba9)
• state: Phase 03 planned — sync STATE + roadmap 999.2 (72632c0)
• state: point resume to phase 07 context (0cda91a)
• state: record phase 07 context session (f61a075)
• state: record phase 08 context session (8c2b358)
• state: record phase 1 discuss session (59428ec)
• state: record phase 10 context session (f55dac9)
• state: record phase 12 context session (57b501a)
• state: record phase 18 context session (4cbe039)
• state: record phase 19 context session (199e48d)
• state: record phase 2 context session (2a9df10)
• state: record phase 20 context session (18d84a3)
• state: record phase 3 context session (b11a56f)
• state: record phase 30 context session (b16651f)
• state: record phase 31 context session (c083856)
• state: record phase 32 context session (783b654)
• state: record phase 33 context session (c3293d7)
• state: record phase 34 context session (7c60991)
• state: record phase 35 context session (ca9c327)
• state: record phase 6 context session (0691ac3)
• update STATE.md session continuity for v2.0 milestone init complete (a9982b5)
• v1.2: complete milestone v1.2 - uv + jellyswipe package + Docker-only + Plex removal (ca51b7e)
• v2.0 Flask->FastAPI migration research complete (8f94b4c)