v1.9.0

v1.9.0: Statistics drilldowns and playback reliability

Statistics results now lead directly to the History plays behind them. Select a title, user, client, playback type or Total Plays to open the matching rows. Jellydash carries the selected Statistics period into History and keeps it through totals, pagination, CSV preview and export.

History also has exact client and playback-method filters for Direct Play, Direct Stream, Transcode and non-transcoded direct playback. Anonymous activity stays separate from an account literally named Unknown user. On desktop, the browser Back button returns to the previous position in Statistics after opening a drilldown.

Playback and background work

• Now Playing keeps each card stable while it refreshes, preserves focused controls and shows unavailable or stale data instead of silently replacing it with zero.
• Playback recording continues when Jellyfin metadata is temporarily unavailable. Missing runtimes, dashed Jellyfin IDs and literal Unknown user values are handled consistently.
• Library and worker caches keep their last complete result after a failed refresh, then retry with a bounded delay.
• History imports commit in bounded batches and keep progress available if the dialog is closed. CSV exports use the same filters and can be reopened while the export is running.
• Statistics and History now share duration formatting, percentages and playback categories.

Access and browser notifications

When optional login is enabled, owners and administrators manage shared settings, imports, History repair, all notification devices and server-wide notification tests. Regular users can manage their own browser notification devices. Guests have read-only access.

Browser notification subscriptions are now tied to the account that enrolled them. Older subscriptions created before this ownership information existed remain stored, but they are paused while login is enabled until the same browser signs in and enables notifications again. They continue to work when login is disabled. Signing out explicitly removes the current browser registration.

An installation stores up to 100 browser notification devices by default, with up to 10 per signed-in account. These limits can be changed with PUSH_MAX_SUBSCRIPTIONS and PUSH_MAX_SUBSCRIPTIONS_PER_ACCOUNT. Jellydash now accepts the push-service hosts used by Firefox, Chromium browsers, Safari and Edge, and rejects other endpoint hosts.

Login throttling now applies both to an account and to the request source. Reverse-proxy client and HTTPS headers are trusted only from addresses listed in TRUSTED_PROXIES. If you enable FORCE_HTTPS, APP_URL must contain the working canonical HTTPS address. Invalid proxy or forced-HTTPS configuration returns 503 until it is corrected.

Container and maintenance

The Docker image now uses PHP 8.3.33 and has a local application health check. Release builds use updated, immutable GitHub Action versions and build both amd64 and arm64 images. Uploads still serve normal files, while Apache rejects uploaded PHP scripts.

Database changes are applied automatically on first use. No manual database import is needed.

Update

docker compose pull && docker compose up -d