Release Release v3.4.0 · seerr-team/seerr

3.4.0 - 2026-07-28

This release patches a path traversal vulnerability in the avatar image proxy.

Exploitation vectors:

A malicious or compromised Jellyfin/Emby media server returning a crafted HTTP response.
A man-in-the-middle attacker intercepting the connection to the media server, if it is configured over HTTP instead of HTTPS (the default setting).

Patch GHSA-mc6w-69r3-62h8 - Path Traversal leading to Remote Code Execution vulnerability (in seerr's ImageProxy) - (f484791)

(PlexImportModal) Add user details sync functionality (#2977) - (902b88e)
(api) Support userId when creating issues (#3100) - (5f2722d)
(external-links) Add Simkl media link (#3121) - (5ae70d0)
(notifications) Add Discord thread ID support (#3065) - (6e9ba06)
(requests) Allow admins to bypass user quota limits (#2026) - (72536da)
Allow to disable version check (#3137) - (73937c0)
Add jellyfin/emby quick connect authentication (#2212) - (74c8db4)

(availability-sync) Prevent false removals for merged-version Plex items (#3224) - (46d8033)
(discover) Use added sort in recent requests slider (#3202) - (8ccd0f6)
(email) Respect hosts file for SMTP connections (#3082) - (b660201)
(i18n) Fallback to server locale for "Default" user lang in notifs (#3190) - (ef9edc8)
(next) Add next-env.d.ts to .gitignore (#3282) - (3279393)
(notifications) Make the Discord IDs available even when the notification is disabled on Seerr (#3139) - (a8f1780)
(proxy) Proxy clients built before proxy init (#3196) - (8ad191f)
(scanners) Decline orphaned requests when media is removed from servarr (#3191) - (2e0e4ce)
(subscriber) Await request status updates (#3223) - (f481b56)
(ui) Revalidate request list after approving or declining a request (#3283) - (e810b98)
(webpush) Guard subscriptions request until user loads (#3113) - (6829850)
Support for IPv6 address literals in HOST env var (#2614) - (0adbf50)
Prevent cross-instance external ID collisions (#3203) - (8e02d92)
Close manage movie sidebar without back reopening (#2590) - (0a1f703)
Availability sync demotion and orphan season rollup edge cases (#3148) - (784faa9)

(blog) Rootless design and PUID/PGID rationale (#3105) - (bf5323f)
(blog) Fix "monitorNewItems" feature description and previous post author (#3103) - (4e7a227)
Update truenas migration section to include chown (#3143) - (ebac489)
Add TrueNAS migration guidance (#3107) - (8b062ed)

(actions) Update github actions (#3041) - (0438710)
(dev) Add devenv setup (#3138) - (d2ffe4f)
(i18n) Update translations from Weblate - (4b65ab5)
(i18n) Update translations from Weblate - (1926095)
(i18n) Update translations from Weblate - (d051deb)
(i18n) Update translations from Weblate - (8d351bc)
(i18n) Update translations from Weblate - (3f33842)
(i18n) Update translations from Weblate - (6c8527f)
(i18n) Update translations from Weblate - (ab26f06)
(i18n) Update translations from Weblate - (0a305f6)
(i18n) Update translations from Weblate - (32249f2)
(i18n) Update translations from Weblate - (2a249a8)
(release) Prepare v3.4.0 - (2dbe886)
(release) Prepare 3.4.0 release - (b21049a)