v0.7.5

0.7.5 (2026-11-08)

Features

• auth: throttle login attempts per account in addition to per IP (94cd451)
• console: add selftest command and load new commands lazily (b13f3dc)
• health: add unauthenticated /healthz endpoint (100e293)
• security: prune security bookkeeping and stop storing plaintext login IPs (a0348ae)
• ui: navigation state, home CTA and empty library state (3e3f1cf)
• ui: self-host Bootstrap Icons and share one layout head (bfeb96e)

Bug Fixes

• 2fa: keep TOTP codes as strings so codes with a leading zero verify (191bf50)
• a11y: accessible rating input, poster dialog and form labels (4a03feb)
• a11y: single token layer with AA contrast and one gold focus ring (e789f40)
• auth: revoke other sessions on the legacy settings password change (b7431d9)
• auth: store session tokens hashed only and revoke sessions on password change (2aa8c42)
• auth: treat sessions of users without 2FA as anonymous on the API (487e72d)
• csrf: protect admin settings API, state-changing GETs and the setup wizard (4ded64c)
• db: refuse to roll back the initial schema migration (79ffba2)
• deps: close 18 security advisories across 6 packages (9160e37)
• deps: update symfony/config and symfony/filesystem (4415ce2)
• docker: pin PHP 8.4.27 for CVE-2026-109618/-109619 (b897254)
• docker: pin PHP 8.4.27 for CVE-2026-109618/-109619 (10f690e)
• language: reject protocol-relative redirect targets after a language switch (2bc6108)
• login: let users without 2FA log in to enroll, make the login a real form (9bbb4d8)
• profile: clamp the security events limit to 1..100 (89fd2aa)
• rate-limit: declare the rate limit bucket per route instead of by path substring (23af18c)
• resolve findings of PHPStan 2.3 (6d6de38)
• review findings (auth, ops, frontend) and functional self-tests (36c88da)
• run composer audit against the lock file (1fea550)
• security: authenticate stored secrets and never replace an existing key (b22745d)
• security: derive client IP and https only from trusted server variables (121c9ee)
• security: render untrusted text without innerHTML (b42655f)
• settings: stop rendering the stored SMTP password into the page (b510a6e)
• ui: drop jsDelivr from the CSP and the removed login background script (58aaa20)
• users: validate admin user updates, keep the last admin, revoke sessions on reset (8eb2bc7)

Performance Improvements

• batch home page movie stats and cache compiled Twig templates (c1b866f)
• oauth: run OAuth monitoring from cron instead of every web request (5088bb7)

v0.7.4

0.7.4 (2026-07-07)

Bug Fixes

• sync: cron used a hardcoded /usr/bin/php absent from the prod image (94a1aa1)
• sync: cron used a hardcoded /usr/bin/php absent from the prod image (f52c8c0)

v0.7.3

0.7.3 (2026-07-07)

Bug Fixes

• sync: scheduled cron sync ran against an empty SQLite DB (5b2514f)
• sync: scheduled cron sync ran against an empty SQLite DB (2bf4851)

v0.7.2

0.7.2 (2026-07-07)

Features

• admin: export security events as JSON for a chosen time range (fa56b8f)
• admin: real rating counts per user and view counts per location (a8302d2)
• admin: redesign the admin panel (shell + all 5 tabs) (230333f)
• admin: redesign the admin panel (shell + all 5 tabs) to the pds design (2ae271a)

Bug Fixes

• admin: real DOM+JS rebuild of the server tab to the compact design (4f8a04a)
• admin: short tab labels via i18n, no tab icons, 'Admin' header (c0d10b3)
• admin: stop the events 'Details' button being clipped (ad621b5)
• admin: stop the right bulk-op card being offset by the sibling margin (f41c664)
• release: tag releases as v* instead of pathary-v* (f4a7a1e)
• release: tag releases as v* so the versioned Docker build triggers (202d124)
• ui: dark-default login page + slimmer admin event rows (e4b7273)
• ui: stale theme.css cache (toggle), i18n-broken security tab loader, profile spacing (c96ce85)
• ui: stale theme.css cache, i18n-broken security tab loader, profile top spacing (06c1c24)

Pathary v0.7.0

0.7.0 (2026-07-06)

Features

• Security: two-factor authentication is now mandatory for every account and cannot be disabled; accounts without 2FA are forced to set it up at login, and 2FA can be re-initialised on a new device.
• Security: the API token endpoint enforces 2FA (no token for accounts without 2FA), login has persistent IP-based brute-force rate limiting (HTTP 429), and the SMTP password is encrypted at rest.
• i18n: the whole UI is available in German and English with a per-user language setting in the profile (default German).
• Design: card-based redesign of the profile settings and the All Movies page; refreshed home landing; neutral/gold palette with a sun/moon theme toggle.
• Movies: live client-side filtering and sorting on the All Movies page (no reload), uniform cropped poster tiles, and a staggered reveal animation on load and page navigation.

Bug Fixes

• Movies: partial OMDb responses no longer overwrite stored IMDb/Rotten Tomatoes ratings with null.
• Build: the release version is now baked into the image (APPLICATION_VERSION) instead of showing "unknown".

Chores

• Cleared the pre-existing static-analysis debt (phpcs/phpstan/psalm) to green the CI gate.

pathary: v0.7.1

0.7.1 (2026-07-06)

Features

• faq: add an FAQ page with the popcorn rating scale, footer link and help icon (1aab116)
• i18n: add DE/EN translation foundation and language switcher (#54) (879fd11)
• i18n: move the DE/EN language switcher into profile settings (#58) (3230af8)
• i18n: persist language preference per user (#55) (bceb5d7)
• i18n: translate browse, core and account-settings pages (wave 1) (#56) (9d1dd30)
• i18n: translate home, admin, integrations, server & auth pages (wave 2) (#57) (53acf30)
• movie detail redesign + TMDB facts + FAQ page (b2f4b4d)
• movie: redesign the detail page and add TMDB facts (budget, revenue, status, original title) (adcc9ce)
• movies: card-sidebar redesign of the All Movies page (#62) (84d3a47)
• movies: staggered "Pop" reveal on load and page navigation (#63) (96e0e14)
• profile: card-based profile settings redesign (#60) (c5c1858)
• search: redesign the search page with a unified library + TMDB view (1ed286d)
• search: unified library + TMDB search page redesign (6f5b00d)
• showcase landing + app-wide design alignment + mandatory 2FA (#49) (c6de31e)
• ui: sun/moon icon inside the theme toggle knob (#61) (39fe8c5)

Bug Fixes

• api: enforce mandatory 2FA on API token creation (#51) (1ea6929)
• auth: add persistent brute-force rate limiting to login (GH #44) (#52) (f04ddaf)
• email: encrypt SMTP password at rest (GH #15) (#53) (c570980)
• movie: full-width facts grid + always-shown facts with 'Nicht verfügbar' + translated status (f041e22)
• movie: full-width TMDB facts grid, always show every fact, translate status (1113b31)
• omdb: stop partial OMDb responses from wiping stored IMDb/RT ratings (#50) (054033c)
• profile: give the language setting its own separated section (#59) (9fe9a78)

v0.6.1-beta - Fix Automated Scheduled Sync

What's Changed

This release fixes the automated nightly CRON job that syncs TMDB metadata and OMDb ratings. Previously, the job was failing silently due to missing Docker environment variables in the cron context.

Bug Fixes

• Fixed CRON environment isolation: Created wrapper script (run-scheduled-sync.sh) that explicitly exports all required environment variables (TMDB_API_KEY, DATABASE_*, OMDB_API_KEY, TZ) to the cron context
• Fixed duplicate execution: Eliminated duplicate cron jobs by using only user crontab (removed /etc/cron.d/ configuration)
• Fixed Docker logs visibility: Added supervisord sync-log-tail process to stream sync output to Docker logs
• Fixed timezone alignment: Updated DateTime.php to respect the TZ environment variable instead of using hardcoded timezone

Improvements

• Dual logging: Sync output now appears in both Docker logs and file logs (storage/logs/scheduled-sync.log)
• Added OMDB_API_KEY: Environment variable is now properly passed to container for OMDb ratings sync
• Better error visibility: Wrapper script logs start/completion messages with timestamps to Docker logs

Technical Details

New Files:

• build/scripts/run-scheduled-sync.sh - Wrapper script with environment variable exports

Modified Files:

• build/Dockerfile - Install wrapper script as user crontab only
• build/config/supervisord.conf - Add sync-log-tail process
• docker-compose.yml - Add OMDB_API_KEY environment variable
• docker/cron/pathary-sync - Update crontab schedule to 2:00 AM
• src/ValueObject/DateTime.php - Use TZ environment variable
• build/scripts/entrypoint.sh - Update info message

Verification

The automated sync now:

• ✅ Runs successfully at scheduled time (2:00 AM)
• ✅ Syncs both TMDB metadata and OMDb ratings
• ✅ Uses consistent timezone (respects TZ environment variable)
• ✅ Executes only once per schedule (no duplicates)
• ✅ Outputs visible in Docker logs: docker compose logs app

Full Changelog: v0.6.0-beta...v0.6.1-beta

Pathary v0.6.0-beta 🎬

Pathary v0.6.0-beta 🎬

Major feature release with UI enhancements, new integrations, and improved security.

✨ New Features

Movie Poster Lightbox

• Click any movie poster to view full-size overlay
• Close via X button, backdrop click, or Escape key
• Smooth animations and responsive design
• Works on both authenticated and public pages

Rating Filters

• Filter movies by TMDB ratings (0-10)
• Filter by IMDB ratings (0-10)
• Filter by Rotten Tomatoes scores (0-100)
• Available on home page and all movies page

OMDb API Integration

• Automatic IMDb and Rotten Tomatoes ratings sync
• Scheduled daily updates via cron
• Enhanced movie metadata with external ratings

Web-Based Setup Wizard (/init)

• Browser-based initial setup (no terminal required)
• Database configuration and migration
• Admin account creation with 2FA setup
• Guided onboarding experience

Dashboard Statistics

• Enhanced homepage with rating statistics
• Recently added movies section
• Highest and lowest rated movies
• Visual rating distribution

Email Health Monitoring

• Provider-specific health status boxes
• OAuth connection status tracking
• SMTP configuration validation
• Real-time error detection

🔒 Security Improvements

• Fix user enumeration vulnerability
• Add token hashing for authentication
• Improve CSRF protection
• Add APPLICATION_URL validation on startup
• User-friendly error messages (no information leakage)

🐛 Bug Fixes

• Fix API key badge alignment in admin panel
• Fix init wizard popcorn animation
• Fix setup completion detection
• Improve SMTP error messages
• Fix user creation rollback issues
• Fix migration conflicts
• Fix GitHub Pages deployment timeout

🎨 UI/UX Improvements

• Better admin panel layout
• Improved OAuth email configuration UX
• Enhanced error messaging
• Login page logo size increase
• Responsive design improvements

🛠️ Technical Changes

• Database migrations cleanup (movary → pathary)
• Docker volume renamed to pathary-storage
• Alpine-based development Dockerfile with cron
• MySQL schema export improvements
• Code quality and CI improvements

📦 What's Changed Since v0.5.0-beta.1

Over 70 commits with major features, security fixes, and quality improvements. See full changelog on GitHub.

---

Full Changelog: v0.5.0-beta.1...v0.6.0-beta

🤖 Generated with Claude Code

Pathary v0.5.0-beta.1 🎉

Pathary v0.5.0-beta.1 🎉

First Beta Release - January 3, 2026

Welcome to the first beta release of Pathary! This release brings major improvements to user experience, security, and administration.

---

✨ What's New for Users

📧 Modern Email Authentication

• No more SMTP passwords! Connect with Gmail or Microsoft 365 using OAuth
• Secure, encrypted email setup
• Automatic token refresh - set it and forget it

🎬 Enhanced Movie Tracking

• Popcorn Rating System - Rate movies on a 1-7 scale
• Location Tracking - Mark where you watched (Cinema, At Home, Other)
• Flexible Watch Dates - Track year, month, or exact day
• Profile Images - Upload your own avatar

👥 Improved User Management

• Invitation System - Admins can invite new users via email
• Streamlined Setup - New users create their own password via secure link
• Activity Tracking - See your recent security events

🎨 Better User Interface

• Dark Mode Improvements - Consistent theming across all pages
• Mobile Friendly - Fixed navigation on phones and tablets
• Collapsible Settings - Cleaner admin panel layout
• Accessibility - Better color contrast and semantic links

---

🔒 Security Highlights

• Enterprise-Grade Protection - CSRF protection on all forms
• Rate Limiting - Prevents spam and brute-force attacks
• Audit Logging - Track important account events

---

🎛️ Admin Features

New Admin Panel

• User Management - Create, edit, and manage users with invitations
• Email Settings - Configure OAuth or SMTP with diagnostics
• System Health - Monitor service status at a glance
• Activity Logs - View security events and user actions

Integration Management

• Centralized configuration for Plex, Jellyfin, Trakt, and more
• Test connections before saving
• Clear status indicators

---

🐛 Notable Fixes

• Email configuration now persists correctly
• Password change workflow works reliably
• Mobile navbar displays properly
• Dark mode colors consistent everywhere

---

📊 By the Numbers

• 139 commits of improvements
• 15+ bug fixes
• 10+ new features

---

🚀 Getting Started

New Installation

git clone https://github.com/benjaminmue/pathary.git
cd pathary
docker compose up -d

Upgrading from Alpha

git pull origin main
docker compose down
docker compose up -d --build
make app_database_migrate

---

📚 Documentation

• Setup Guide: See README.md
• OAuth Email Setup: Check the Wiki (coming soon!)
• For Nerds: Technical deep-dive in Wiki

---

🙏 Credits

Built with assistance from Claude Code (Anthropic) and the community.
Forked from Movary by Lee Peuker.

---

🔮 What's Next

• Comprehensive feature documentation
• Additional integrations
• Performance improvements
• Your suggestions! Open an issue

---

Full Changelog: v0.1.0-alpha.1...v0.5.0-beta.1

v0.1.0-alpha.1 – First public preview

Summary
Early preview of the Movary fork with the new public group movie view and UI changes. This release is for testing and feedback.

What is included
1. Public home page with poster grid (latest 20 movies first)
2. Public movie detail page with global rating and individual ratings
3. Popcorn rating scale 1–7 with filled and grey icons
4. Login persists via cookie until cookies are cleared
5. Search local first, TMDB fallback, add movie to local library
6. Rating and comment can be updated later (one rating per user per movie)

Upgrade and setup notes
1. Pull latest main and checkout the tag
2. Run DB migrations
3. Ensure required env variables are set (TMDB key, DB settings)
4. Clear application cache if used by the project

Known limits
1. This is a pre-release. UI and data model may still change.
2. Report issues with exact steps and screenshots.

Verification
1. Open /
2. Open a movie detail page and verify global + individual ratings
3. Login, restart browser, verify you stay logged in
4. Search a movie not in the library, add it from TMDB, rate it