v1.1.1

[1.1.1] - 2026-07-20

Fixed

• SABnzbd categories now force Repair+Unpack+Delete (pp = 3). The seeded
  sabnzbd.ini left category pp blank, which SABnzbd treats as its own
  default (download + verify only) — archives were never unpacked, so
  multi-part .rar releases landed in completed/ unextracted.
  set-sab-config gained --category-pp, wired into ./setup alongside
  --category-script, so existing installs converge on ./update /
  ./setup the same way the staging layout did.

v1.1.0

[1.1.0] - 2026-07-10

Changed

• SABnzbd assembles jobs in a hidden staging folder and moves only finished
  content into the completed tree. Post-processing (par2 verify/repair,
  unpacking, renames) previously churned directly inside the completed
  folder, so an importer watching it could pick up half-extracted files
  under temporary names. Jobs now complete into completed/.staging/ — a
  reserved folder importers ignore — and a post-processing script
  (move-finished.sh, stack-managed, refreshed on every ./setup) moves
  each successful job into the completed tree in one atomic rename, dropping
  .par2/.sfv/.nzb recovery files on the way. Failed jobs stay in
  staging; delete them from SABnzbd's history with "delete files". Existing
  installs converge automatically on ./update.

v1.0.2

[1.0.2] - 2026-07-10

Fixed

• setup now stops the sabnzbd container before injecting the news-server
  credentials into sabnzbd.ini, so filling USENET_SERVER_* in .env and
  re-running ./setup on a live stack reliably takes effect. Previously
  SABnzbd (which reads the ini only at startup and rewrites it on shutdown)
  could overwrite the freshly-injected creds when Phase 9 force-recreated it,
  making the documented "add creds later, re-run setup" path unreliable.

v1.0.1

[1.0.1] - 2026-07-10

Fixed

• tests/restore.test stubs systemctl on PATH so the suite no longer targets
  the host's global --user prowlarr-stack unit. Previously, running
  ./scripts/test on a machine with a live install would stop the running
  stack (the real ./restore under test issued systemctl --user stop).
• ./backup no longer depends on the hostname binary (absent on some minimal
  installs, which printed hostname: command not found); it derives the short
  host name from uname -n.

v1.0.0

[1.0.0] - 2026-07-10

Added

• Usenet support via SABnzbd. A new sabnzbd service (WebUI on 8085,
  running direct like qBittorrent — usenet has no peer exposure) is pre-wired
  into Prowlarr as a download client, mirroring the qBittorrent treatment:
  seeded defaults/sabnzbd/sabnzbd.ini, a seeded Sabnzbd DownloadClients
  row, and migration 0003-add-sabnzbd-download-client for existing installs.
  setup generates a SABnzbd API key, injects it plus the news-server
  credentials (new .env block: USENET_SERVER_*, SABNZBD_API_KEY) into both
  SABnzbd and Prowlarr (scripts/set-sab-config, scripts/patch-prowlarr-sab).
  Provider account + Newznab indexer keys are user-supplied; the stack ships the
  plumbing ready. See docs/indexers.md.

v0.6.4

[0.6.4] - 2026-07-10

Changed

• Repo now uses plain git (dropped Jujutsu/jj). update dev-mode detection,
  scripts/release, and scripts/bump-images are git-only, and the docs no
  longer reference jj. (./backup still refuses to write a secrets-bearing
  tarball into a .git/ or .jj/ directory — that guard protects users on
  either VCS and is intentionally kept.)
• Docs: minor wording — "Cloudflare-protected" (not "FlareSolverr-protected")
  indexers; neutral version placeholder in the README rollback example.

v0.6.3

[0.6.3] - 2026-07-10

Added

• scripts/tag-cf-indexers: tests each enabled indexer and tags the
  Cloudflare-blocked ones with byparr (creating the tag if needed), so Prowlarr
  routes them through the solver. Idempotent; leaves working indexers untouched.
  Replaces doing this by hand against the API.
• scripts/release vX.Y.Z: cuts a release from the source repo — verifies the
  CHANGELOG section, runs release-checks, pushes main, tags, pushes the tag,
  and waits for CI to publish. --dry-run / --yes / --no-wait.

v0.6.2

[0.6.2] - 2026-07-09

Changed

• Documentation: rewrote the README ## Update section to describe the actual
  transactional upgrade (pre-flight backup → migrate → verify → auto-rollback)
  and the --enable-auto unattended timer, and added docs/upgrading.md
  covering the full operator procedure, all ./update flags, and the maintainer
  release flow.

v0.6.1

[0.6.1] - 2026-07-09

Fixed

• Corrected the FlareSolverr proxy tag model. v0.5.0–v0.6.0 assumed a proxy with
  no tags applies to all indexers, and therefore cleared the proxy's tag. In
  fact Prowlarr applies an indexer proxy only to indexers that share a tag with
  it, so a no-tag proxy is used by nothing — the solver never ran. The seed now
  ships a byparr tag on the FlareSolverr proxy, and a new migration
  0002-flaresolverr-ensure-proxy-tag restores a valid tag on existing installs
  whose proxy has none (superseding 0001, which is left in place but no longer
  the fix). Tag your Cloudflare-protected indexers with byparr to route
  them through the solver — and only those, since a tagged indexer sends all its
  searches through the slower browser solver. See docs/indexers.md.

v0.6.0

[0.6.0] - 2026-07-09

Changed

• Replaced FlareSolverr with byparr (ghcr.io/thephaseless/byparr:2.1.0), a
  maintained, FlareSolverr-API-compatible Cloudflare solver (same /v1 API on
  port 8191). The Prowlarr "FlareSolverr" indexer proxy works unchanged — byparr
  speaks that protocol. byparr drives a real browser (Camoufox), so the
  container gets shm_size: 512mb and uses noticeably more RAM than FlareSolverr.
  The solver container is renamed flaresolverr → byparr; the stack now starts
  with docker compose up -d --remove-orphans (safe: COMPOSE_FILE carries the
  full active set incl. the qbt-vpn overlay) so the old flaresolverr container
  is removed automatically on update.

  Caveat: the solver egresses through gluetun's commercial-VPN/datacenter IP,
  which 2026-era Cloudflare weights above browser fingerprint. byparr improves
  odds on easier sites but the hardest indexers (e.g. 1337x) can still time out —
  the real fix is a residential/mobile egress proxy (byparr PROXY_SERVER).