v2.1.2 - Security updates

Security updates

TrackWatch 2.1.2 includes the security fixes merged into develop:

• Fixes CVE-2026-68916 / GHSA-q8v8-jxg6-hpmj: the legacy All-in-One Docker deployment could expose the Spotify OAuth client_secret through the public /env.js runtime configuration. Browser-served runtime configuration is now restricted to public frontend flags; the OAuth secret remains server-side only.
• Updates the frontend dependency graph to patched versions of fast-uri, brace-expansion, and postcss.

Action required for installations up to 2.1.1

If you deployed TrackWatch up to 2.1.1 using the All-in-One Docker image with a real Spotify client secret, treat that secret as potentially exposed even if you have no evidence of misuse. Rotate or regenerate it in the Spotify Developer Dashboard, update the secret in the deployment environment, and redeploy the application. Do not reuse the old secret.

After upgrading, verify that /env.js contains only public runtime flags and never contains SPOTIFY_CLIENT_SECRET or VITE_SPOTIFY_CLIENT_SECRET.

v2.1.1 - Bug fixes

Bug Fixes

• RESEND_API_KEY no longer crashes the app — Email notifications are now fully optional. The app will silently skip sending emails when the API key is not configured, instead of crashing at startup.
• Spotify redirect URI requires explicit port — Updated all documentation and defaults to use http://127.0.0.1:80/callback (with :80), as Spotify's dashboard requires the port to be specified.

Documentation

• Clarified that Spotify only allows http:// for 127.0.0.1 — LAN IPs (e.g. 192.168.x.x) and custom domains require HTTPS.
• Updated redirect URI guidance across README, AiO docs, Manual Setup, Install page, docker-compose defaults, and .env examples.

2.1.0 - All-in-One Docker Image

Changelog

v2.1.0 — All-in-One Docker Image

✨ New Features

• All-in-One Docker Image: Deploy TrackWatch with a single docker run command. One container includes PostgreSQL, Nginx, Django, and the background scheduler — managed by supervisord.
• Pre-built Images: Available on GHCR and Docker Hub. No cloning or building required.
• Runtime Environment Injection: Pre-built images can be fully configured at startup via environment variables — no need to rebuild for different Spotify credentials or domains.
• Automated Publishing: GitHub Actions workflow builds and publishes the AiO image on every semver tag (e.g. 2.1.0) to both GHCR and Docker Hub.
• Configurable Email Domain: Self-hosters can now set EMAIL_DOMAIN to use their own Resend-verified domain for email notifications.
• Updated Install Page: The frontend /install page now features an AiO tab with copy-paste docker run commands for both GHCR and Docker Hub.

🔧 Improvements

• Background Processing: New releases update now runs in a background thread to prevent Gunicorn worker timeout.
• Hide Login Button: New VITE_HIDE_PUBLIC_LOGIN environment variable to hide the login button for public instance.
• Dependency Updates: Django 5.2.11, react-router-dom 7.

📦 Quick Start

docker run -d \
  --name trackwatch \
  -e SPOTIFY_CLIENT_ID=your-client-id \
  -e SPOTIFY_CLIENT_SECRET=your-client-secret \
  -e SECRET_KEY=your-secret-key \
  -v trackwatch_data:/var/lib/postgresql/data \
  -p 80:80 \
  --restart unless-stopped \
  ghcr.io/emlopezr/trackwatch:latest

Open http://127.0.0.1 and you're done.

For the full setup guide, see docs/DOCKER_AIO_SETUP.md.

⚠️ No Breaking Changes

The existing docker-compose.yml multi-container setup continues to work exactly as before. The AiO image is a new deployment option, not a replacement.

2.0.0 - Self-Hosted

🚀 Major Update: Fully Dockerized & Self-Hosted

TrackWatch has been re-architected to run entirely on your own infrastructure using Docker. No more "SaaS model" due to Spotify API policies.

✨ New Features

• Full Docker Support: Deploy with a single docker-compose up.
• Privacy First: All data (tokens, history) stays in your local PostgreSQL database.
• Internal Scheduler: No need for external cron jobs; the container manages background checks (7am, 2pm, 9pm).
• UI: Completely Dark Mode interface using React 18.
• Discography Generator: Tool to create playlists with an artist's entire catalog.
• Ghost Track Cleaner: Tool to remove unplayable tracks from your playlists.
• Email Notifications: Native support for English email alerts via Resend (optional).

🛠️ Breaking Changes

• Migration from "SaaS architecture" to Self-Hosted Docker architecture.

📦 Installation

See the README for the Quick Start guide.

v1.2.0 - Ghost Tracks Cleaner Feature

Merge pull request #30 from emlopezr/002-ghost-tracks

Add Ghost Tracks Cleaner feature

v1.1.0 - Generator feature

Remove frontend README.md

v1.0.0 - Official Release

Log error

v0.0.1 - POC

POC of core logic of app in Python - Run in terminal manually connecting Spotify account and adding artist names to list.