Repository navigation
Releases
v2.3.1
Full Changelog: v2.3.0...v2.3.1
v2.3.0 - Prevent Session Expiration Race Conditions
This release resolves WebSocket session validation race conditions in the Web UI. By only rotating/regenerating tokens when they have less than 30 minutes of validity remaining (instead of on every single message), the application is now completely immune to concurrent connection/request expiration loops.
v2.2.9 - Fix WebSocket Session Expiration and Reloop Error
This release resolves a critical authentication issue where logging into the webUI would immediately trigger a 'session has expired' alert and infinite reload loop. The 'Token' cookie has been set to HttpOnly: false, enabling JavaScript to read it and correctly authenticate WebSocket connections.
v2.2.8 - Fix Startup Permission Verification Crash
This release resolves a critical startup bug where the service would crash on launch. The permission check now correctly ensures that the temporary directory and its UUID-based subfolder are created on disk before verifying file writing capabilities.
v2.2.7 - Update Mechanism & Plex Restreaming Fix
This release fixes the self-update mechanism to correctly query GitHub releases and pull the corresponding platform assets, adds a manual Update button to the settings UI, and resolves the Plex/FFmpeg restreaming issue by removing content-length restriction in buffering mode.
v2.2.6 - Comprehensive Codebase Review
Security Fixes
- Critical: Fixed SHA256 salt parameter being ignored in authentication - passwords are now properly salted
- Added backward-compatible hash migration for existing users (auto-migrates on next login)
- Added HttpOnly, SameSite=Lax, and Path attributes to authentication cookies
Dependency Updates
- gorilla/websocket v1.4.2 → v1.5.3
- go-ssdp v0.0.2 → v0.9.0
- golang.org/x/net v0.52.0 → v0.55.0
- golang.org/x/sys v0.42.0 → v0.45.0
Code Quality
- Fixed deprecated websocket API usage
- Removed all invalid JSON struct tag options
- Removed unused dead code functions
- Fixed error string conventions per Go standards
- Replaced numeric HTTP status codes with constants
- Removed redundant returns and unnecessary fmt.Sprintf calls
- Fixed error handling for file permission changes
- Fixed typo in timeout error string
- All staticcheck, go vet, and go build pass cleanly with zero warnings
v2.2.5 — Fix restreaming mode for Plex DVR
Bug Fixes
- Remove
Content-Length: 0header that caused Plex DVR (and other clients) to treat the buffered/restreamed response as empty, breaking restreaming mode entirely - Fix content type detection — default
application/octet-streamtovideo/mp2tso Plex correctly identifies MPEG transport streams
Details
Passthrough mode (direct stream URL to client) was unaffected. The issue only manifested in buffering/restreaming mode where xTeVe proxies the stream — both with the built-in streamer and with ffmpeg. The root cause was two Content-Length: 0 headers telling clients the response body was empty, plus incorrect content-type sniffing for transport stream data.