v0.28.1

What's Changed

Changed

• CI: all workflow jobs run on the pinned ubuntu-26.04 runner image instead of ubuntu-latest.

Full Changelog: v0.28.0...v0.28.1

v0.28.0

What's Changed

Added

• auth -a logout (v3, no -v4): invalidates the cached v3 session at TMDB and deletes the session and account cache files; errors if no session is cached. The result is written as auth_logout_v3.json. auth -v4 -a logout is unchanged.

Changed

• The cached v3 session, account, guest-session and v4 access-token files are now written owner-only (0600), and an existing world-readable file is tightened on the next write.

Fixed

• Output files no longer overwrite each other: search, discover, changes and watch-providers now append the flags you set (e.g. -year, -with-genres, -start-date) to the file name, and a query with accents, CJK or punctuation, or an overlong name, gets a short hash suffix. File names for runs without extra flags or special characters are unchanged.
• tv-seasons and tv-episodes now require -s (and -e) instead of silently defaulting to season 0 / episode 0, so a forgotten flag no longer returns the Specials season. -s 0 still works.
• add-rating (movies, tv, tv-episodes) now rejects a -value outside 0.5 to 10.0 in 0.5 steps before any login or API call.
• account with a missing or unknown -a no longer starts the browser login flow before reporting the error.
• A 401 on a -v4 account or lists call no longer triggers the v3 login flow (which could not fix it); the error now suggests auth -v4 -a login.
• When the automatic re-login after a 401 fails, the error now includes why, instead of only the original 401.
• pages_limit = 0 in the config file now means "all pages", as documented, instead of being ignored in favour of the default of 10. A negative pages_limit is rejected with an error.
• output_dir now expands a leading ~, instead of creating a directory literally named ~. ~other/... is no longer rewritten to <home>/other/... in any config path.
• Login no longer fails on a fresh machine: the parent directory of the session, account, guest-session and access-token cache files is created if missing.
• API client: response bodies of failed (non-2xx) requests are now closed, so failed calls no longer leak connections.
• A 429 error no longer prints the request URL with the api_key query parameter in clear.
• A 429 with a Retry-After header now arms the client's rate-limit guard, so later requests in the same run stop instead of hammering the API.
• Error responses with a non-JSON body (e.g. a proxy's HTML page) now keep their HTTP status code, so a 401 still triggers the session re-login.
• v4 requests made with a user access token no longer require read_access_token in the config.

Full Changelog: v0.27.0...v0.28.0

v0.27.0

What's Changed

Added

• account -v4 (needs -v4, read_access_token and a cached user token from auth -v4 -a login; no v3 session and no -i): -a lists, favorite-movies, favorite-tv, rated-movies, rated-tv, watchlist-movies, watchlist-tv, and the v4-only recommended-movies and recommended-tv. Results are written as account_<action>_v4.json.
• account -v4 accepts -language <code> (favorites, rated, recommended, watchlist) and -sort-by created_at.asc|created_at.desc (favorites, rated, watchlist); using one where the endpoint doesn't take it, or without -v4, is an error.
• lists -v4 (needs -v4 and read_access_token; everything except details also needs a cached user token from auth -v4 -a login): -a details (walks every item page, -language, -sort-by, -pages-limit), item-status (-media-type movie|tv, -media-id), and 🔒 create (-name, -language, -country, -description, -public), update (-name, -description, -public[=false], -sort-by, -backdrop-path), delete, clear, and the batch actions add-items, update-items (comment per item) and remove-items, which take repeatable -item movie:<id> / -item tv:<id>[:<comment>]. Results are written as lists_<action>_..._v4.json.

Changed

• Internal refactor, no behavior change: the v4 auth service methods, tests and types now live in the v3 auth files (Client.Auth.*V4, str.RequestTokenV4/AccessTokenV4) instead of separate *_v4 files, matching how v4 account is laid out.

Full Changelog: v0.26.0...v0.27.0

v0.26.0

What's Changed

Added

• auth module (v4 only, needs -v4 and read_access_token): -a request-token, -a access-token -request-token <token>, -a login (browser approval flow), and -a logout. The user access token and v4 account_id are cached (mode 0600) at the new access_token_path config key (default ~/.config/tmdb-sync/access_token.json), never in output_dir.
• v4 client plumbing: NewRequestV4 targets https://api.themoviedb.org/4/ with the bearer token only (no api_key), and shared -v3/-v4 flag resolution for the upcoming v4 account/lists.

Full Changelog: v0.25.0...v0.26.0

v0.25.0

What's Changed

Added

• -d/-debug now also prints the outgoing request headers (sorted, with the Authorization value redacted).
• movies, tv, and tv-episodes -a add-rating accept a new -guest flag that rates as the guest session cached by guest-sessions -a create, ignoring any account session; errors when no guest session is cached.

Changed

• -d/-debug request URL line now includes the api_key query parameter, shown as REDACTED.

Full Changelog: v0.24.0...v0.25.0

v0.24.0

What's Changed

Added

• -d/-debug CLI flags and debug config option: print the full resolved request URL (before the API key is appended) to stdout for each outbound API call.
• movies, tv, and tv-episodes -a add-rating accept a new -guest-session-id flag, sending TMDB's guest_session_id query parameter instead of session_id so a rating can be attached to a guest session; falls back to the id cached by guest-sessions -a create when no account session is configured.

Fixed

• guest-sessions -a rated-movies/rated-tv/rated-tv-episodes always returned a 404, since there was no way to actually record a rating against a guest session (rating endpoints only ever sent session_id, never guest_session_id).

Full Changelog: v0.23.0...v0.24.0

v0.23.0

What's Changed

Added

• guest-sessions module: create, rated-movies, rated-tv, rated-tv-episodes.

Changed

• authentication's CreateGuestSession is now wired in via guest-sessions -a create, which caches the returned id to ~/.config/tmdb-sync/guest_session.json (guest_session_path in config); -i is now optional on guest-sessions' rated-* actions, falling back to that cache.

Full Changelog: v0.22.0...v0.23.0

v0.22.0

What's Changed

Added

• watch-providers module: available-regions, movie-providers, tv-providers.

Full Changelog: v0.21.0...v0.22.0

v0.21.0

What's Changed

Added

• tv-episode-groups module: details.

Full Changelog: v0.20.0...v0.21.0

v0.20.0

What's Changed

Added

• tv-episodes module: details, account-states, credits, external-ids, images, translations, videos, add-rating, delete-rating.

Full Changelog: v0.19.0...v0.20.0