v0.9.8
Your server connection is now verified
Until now, every request to your Jellyfin server skipped TLS certificate verification — fine for the typical http:// home setup (no TLS involved at all), but an https server got none of the protection https promises. Verification is now on by default, pointed at the CA bundle that ships with the MiSTer image.
If your server is https with a self-signed certificate: after this update MiSTerFin will stop connecting until you add a line containing just INSECURE_TLS to jellyfin.conf — the app tells you exactly this on screen when it happens, so there's nothing to remember. Plain http:// servers (the common case) are unaffected, and https with a real certificate (e.g. Let's Encrypt) now simply works and is verified.
Updates you can actually see
Until now a new release was only discovered by someone who happened to open the About screen. The home carousel now shows a quiet "START:update available" hint under the title whenever a newer release exists — press START and install from About, same as always. Hidden while a download runs and gone once you're up to date. The list view stays clean.
Also in this release
- Transport hardening — curl is invoked by absolute path, a single response is capped at 32 MB, and POST bodies use unpredictable temp-file names
- Zaparoo native-video detection survives updates — the dual-mode menu core is now recognized by comparing file content against the installed Zaparoo copy instead of a hardcoded byte size, verified live on hardware. It also correctly stays off under the standalone interlaced menu core, where it only burned CPU on a path that core never reads
- Internal code hygiene — cleanup and reorganization under the hood; no behavior changes, verified on real hardware
- New docs/THIRD_PARTY.md lists every piece of third-party work the project builds on, with licences