v2.13.2

Bug Fixes

• ci: put every unpublished version's notes in the GitHub release body
• ui: image sizing
• ui: stat card icon spacing
• ui: stop What's New from listing a breaking change twice

2.13.1 (2026-10-20)

2.13.0 (2026-10-19)

Features

• db-fleet: store the client URL path as an encrypted credential (thanks @vasilvestre)
• trackers: add TR4KER and its platform adapter (thanks @vasilvestre)
• trackers: name bonus points the way each tracker does (thanks @Avamander)

Bug Fixes

• backups: match restored trackers to the registry before polling restarts
• ci: keep knip, security-audit and tracker-validation working on fork pull requests (#224)
• db-fleet: size the qBittorrent response cap to the largest library the sync store holds
• trackers: check a pasted API token for characters a request header cannot carry
• trackers: leave an unparseable AvistaZ date unset instead of writing Invalid Date
• trackers: list skipped debug calls and let a cached user id drive the second one
• trackers: name a Cloudflare challenge on the card instead of reading it as Poll failed
• trackers: name an off-site or looping redirect on the card instead of Poll failed
• trackers: read a non-JSON 200 as an unexpected response instead of a raw parser error
• trackers: read petabyte byte totals instead of failing the poll
• trackers: run the poll's own checks in the debug view and keep the body under its error
• trackers: show the body BTN and Nebulance actually sent in the debug view
• trackers: stop reading a TorrentLeech login 429, 5xx or Cloudflare page as bad credentials
• trackers: stop sanitizing scraper status errors twice, which turned each one into Poll failed
• trackers: store an absent user class as null instead of a made-up label
• trackers: store an infinite Hawke ratio when nothing has been downloaded
• trackers: store the Nebulance ratio unrounded so a minimum check sees the real figure
• trackers: word unreadable scraper pages so the card reads them as an unexpected response
• trackers: write Gazelle meta on every poll so a failed profile call cannot leave stale ranks
• user-proxy: arm the deadline after the request exists so a refused header leaves no timer
• user-proxy: decode a compressed response on the proxied path (thanks @Ian-Costa18)

2.12.1 (2026-10-16)

MyAnonamouse seeding and leeching counts read 0 from about 2026-09-23 until this release, after MAM moved those figures in its API response. This release reads the new location; the zeros already recorded for that period stay in the charts. The Mousehole card now needs Mousehole v0.5.0 or newer with MOUSEHOLE_AUTH_TOKEN set, and the token entered in the MAM tracker's settings.

⚠ BREAKING CHANGES

• trackers: require Mousehole v0.5.0 or newer and its own API token

Features

• dashboard: add a Hit & Runs card to the Ecosystem section
• dashboard: add a Ranks section with a class stack per tracker
• trackers: add DreadVault (thanks @thund3rcracker)
• trackers: add InfinityHD and RocketHD (thanks @mwallace02-dev)
• trackers: add Retro Movies Club and refresh OldToons (thanks @LocalBoomer)
• trackers: add SeedCore (thanks @thund3rcracker and @vasilvestre)
• trackers: add the retrotoon adapter
• trackers: backfill the registry slug once at startup and carry it through backup restore
• trackers: mark which registry classes sit outside the earned ladder
• trackers: record each tracker's registry entry by slug and stop deriving it from the URL
• trackers: rewrite the Redacted class ladder from the site wiki

Bug Fixes

• api: store base URLs without a trailing slash and drop a vestigial debug log
• backups: restore each row the way it was saved
• backups: restore the seven tracker and snapshot columns the inserts never named
• charts: render percentile ranks with the correct ordinal suffix
• ci: make lint errors block, mirror the ladder rules into the validator and pin the audit checks
• ci: silence dotenv in the playwright config
• dashboard: give each rank stack one tooltip and a spoken class name
• dashboard: keep an infinite-ratio account from voiding the fleet ratio change
• dashboard: stop offering an older release as an update
• db-fleet: cap every qBittorrent read, carry the deadline into login and fix the sync store cap
• db-fleet: the qBittorrent transport no longer copies a header-validation TypeError
• scheduler: bound a proxied request and the poll cycle so a stalled proxy cannot stop polling
• security: bumped next and sharp
• security: bumped next and sharp again
• security: cancel a download client request when its deadline passes
• security: close the audit blind spot that left download-clients unscanned
• security: forbid framing with frame-ancestors as well as X-Frame-Options (thanks @Ian-Costa18)
• security: keep undici's header-validation message out of tracker errors and logs
• security: reject control characters in a pasted cookie header
• security: reject every control character in DigitalCore's uid and pass cookies
• security: remove a dead public route prefix
• security: require a real character class in the cookie injection guard check
• security: stop leaking API tokens through the auth probe and the debug view
• security: stop the connection test passing on a credential it never sent
• security: stop the qBittorrent login following a redirect that replays the password
• security: validate the MAM session cookie like every other pasted cookie
• security: validate what the download client host sends before it reaches the store
• sidebar: vertically centre the infinite-ratio sign
• tracker-adapters: derive the GGn ratio when the reported one will not parse
• tracker-adapters: make fetchRaw and error classification match what fetchStats does
• tracker-adapters: make the error wording an interface rather than prose
• tracker-adapters: parse every bonus figure through the shared count helper
• tracker-adapters: parse the binary byte units the shared helper silently dropped
• tracker-adapters: refuse a blank BTN byte total instead of recording it as zero
• tracker-adapters: refuse a byte total a scraper could not read instead of storing zero
• tracker-adapters: refuse a byte total the API omitted instead of recording it as zero
• tracker-adapters: report a figure UNIT3D omits as unknown rather than zero
• tracker-adapters: report an absent count as unknown instead of zero
• tracker-adapters: stop a DigitalCore maintenance page reading as invalid credentials
• tracker-adapters: stop adapters asserting what the tracker never reported
• tracker-adapters: surface failed fetches and bad credentials instead of healthy data
• tracker-adapters: tell an absent figure apart from a measured zero
• trackers: check pasted credentials evenly and match the registry entry by hostname
• trackers: correct the session cache, permission flags and platformMeta clearing
• trackers: dim classes outside the ladder and read a missing hit & run count as unknown
• trackers: fail a RetroToon poll on a dead session and list its awarded ranks above the ladder
• trackers: keep a bare join date on the day the tracker reported it
• trackers: move the Mousehole integration to its current API
• trackers: order rank changes by rung, not list position (thanks @Avamander)
• trackers: read MAM snatch counts from snatch_summary (thanks @Avamander)
• trackers: remove the URL edit from the settings sheet and the PATCH route
• trackers: require Mousehole v0.5.0 or newer and its own API token
• trackers: stop prefixing "Profile" to the IPTorrents username (thanks @Ian-Costa18)
• trackers: store an infinite GGn ratio when nothing has been downloaded (thanks @Avamander)
• trackers: test the base URL the save will store
• ui: label the tracker settings credential section Credentials instead of API Key
• webhooks: persist the download disabled notification toggle

Refactoring

• tracker-adapters: build each request once and take the auth spelling from the registry
• tracker-adapters: derive the TorrentLeech session key with scrypt
• tracker-adapters: enforce the adapter rules in the types and one shared test
• tracker-adapters: enforce the source-text rules and fix what they flagged
• tracker-adapters: extract FileList's text helpers into a shared module
• tracker-adapters: keep the adapters folder holding only adapters
• tracker-adapters: key the session retry on an error type instead of its message
• tracker-adapters: move the shared helpers into their own folder
• tracker-adapters: promote one count parser and retire the four private ones
• trackers: move the platform vocabulary into the data layer
• trackers: move the poll-result types out of the adapter module
• trackers: put the cookie-header validator in the credentials module
• ui: drop the group role from the stat tile
• ui: move the Add Tracker credential fields onto a per-platform table
• ui: move the tracker settings credential fields onto the shared table

2.11.0 (2026-08-31)

Features

• tracker-adapters: store an optional browser User-Agent for DigitalCore
• trackers: add an API key expiry card
• trackers: add filelist platform groundwork
• trackers: add the filelist adapter
• trackers: add the TorrentLeech logo
• trackers: judge tracker health against each tracker's required ratio
• trackers: let a tracker state an either/or seeding requirement
• trackers: support TorrentLeech's Alt 2FA Token

Bug Fixes

• api: send a User-Agent when proxying avatar fetches
• ci: deploy hangs
• ci: healthcheck now probes 127.0.0.1 instead of localhost
• ci: make the security test count check able to fail
• dashboard: exclude the cross-seed sentinel from category ratio averages
• dashboard: respect the retention choice after the first-run prompt
• dashboard: update the retention banner the moment the prompt is answered
• db-fleet: coerce a missing qBittorrent seeding time to zero
• db-fleet: drop garbage numerics from qBittorrent delta updates
• db-fleet: log dropped delta fields at debug
• security: drop vulnerable Go binaries from the runtime image
• tracker-adapters: pass the shared timeout through the proxy path
• tracker-adapters: simplify DigitalCore userAgent validation and cover both writers
• trackers: correct six wrong figures in the TorrentLeech profile parser
• trackers: count only the stated routes when combining satisfaction
• trackers: owe the full requirement when seed time is unreadable
• trackers: send the TorrentLeech login through the configured proxy
• trackers: stop trusting TorrentLeech's cookies on a refused login
• trackers: surface UNIT3D shape errors instead of a trim crash (#214)
• trackers: tighten the TorrentLeech login and error reporting
• trackers: treat a non-finite seed time as no progress
• ui: align the credential info icons with their field titles
• ui: clear pasted iptorrents cookies on close
• ui: clear TorrentLeech secrets on close and cover the add dialog
• ui: crisp overlay elevation for dialogs and sheets
• ui: describe the middle health tier by its ratio band
• ui: float popovers and visible field focus
• ui: inputs now have a labeled tooltip option
• ui: lit lip keeps field corners defined
• ui: overlays no longer wedge in hidden tabs
• ui: parse both bullet markers in the whats-new changelog
• ui: render the infinite-ratio sentinel as infinity
• ui: show cross-seed ratios as infinity in every torrent table
• user-proxy: guard the User-Agent version against a missing minor
• user-proxy: send a User-Agent on proxied tracker requests
• user-proxy: shorten the User-Agent to major.minor and mark the module server-only
• webhooks: distinguish a failed poll from an unreachable tracker

Refactoring

• tracker-adapters: add adapterRequest helper that returns non-2xx
• tracker-adapters: parse optional credential fields in one place
• tracker-adapters: route digitalcore through adapterRequest
• tracker-adapters: route nebulance through adapterRequest
• ui: collapse the duplicated remaining-ratio branches
• ui: reuse remainingSeedSeconds in the remaining column
• user-proxy: drop User-Agent policy from proxyFetch

2.10.1 (2026-08-19)

Bug Fixes

• release: port changelog template to writer 9 function form
• tracker-adapters: api responses now parsed as either strings or ints