v1.4.0

[1.4.0] - 2026-09-11

Security

• Bot-flow condition expressions are no longer template-interpolated before evaluation, so untrusted event data (e.g. chat text) cannot alter expr-eval syntax (adapted from DomeNinchen/ts6forkmanager)

Fixed

• Sidecar compose mounts now share music-data with the backend so pre-downloaded videos are readable by ffmpeg
• On-demand video downloads no longer loop forever; streams auto-stop after the probed clip duration
• Sidecar A/V pacing clamps anomalous RTP latency spikes that previously overflowed RTP queues
• SSH query client teardown is awaited on shutdown, and in-flight connect() aborts cleanly if destroy() races it (avoids nickname-in-use / already-member errors on fast restart)
• Video stream start/source API calls use a 120s client timeout so long downloads no longer falsely fail at 15s

Changed

• Sidecar VP8 encode uses multi-threaded libvpx (-threads / -row-mt), default -cpu-used 4, and bitrate-scaled -bufsize
• Channels shows ServerQuery clients with a distinct Query badge (useful for spotting leftover query sessions)
• WebUI video preview supports mute/unmute while keeping autoplay-safe default mute
• Extended CREDITS.md with DomeNinchen fork attribution

Full Changelog: v1.3.9...v1.4.0

v1.3.9

Added

• IPTV / M3U playlist management with admin CRUD, channel refresh, auto-refresh scheduler, and live stream playback (!channels, !tv, !iptv) — adapted from simardwtf/ts6-manager
• !lyrics music-bot command (LRCLIB + lyrics.ovh fallback) — adapted from coom/ts6-manager
• YouTube stream-first playback via yt-dlp direct URL resolution with download fallback — inspired by prankroker/ts6-manager
• Client avatars and voice-state icons in Channels — adapted from kytos22/ts6-manager
• Per-channel file storage summary in File Manager (GET /api/files/summary) — adapted from kytos22
• Music bot runtime status auto-refresh (1s polling) — adapted from mqh9007/ts6-manager
• Client IP column (admin) and richer online status badges — adapted from mqh9007
• Settings → About tab (build version + optional git sha) — adapted from mqh9007

Fixed

• Connection form tooltips no longer clip off-screen (collision-aware positioning)
• YouTube playlist import edge cases: shape-based playlist URL detection, canonical URLs, re-import plan, !play gating, import polling stop on error — adapted from coom
• File Manager storage summary file/folder count inversion
• IPTV playlist fetch SSRF hardening (no unvalidated redirects)

Changed

• Extended CREDITS.md with fork attribution for coom, kytos22, mqh9007, simardwtf, and prankroker

v1.3.8

Added

• Connection setup guide on Settings → Connections with checklist, deployment scenarios (Docker/remote/same-host), and WebQuery vs SSH feature matrix
• Optional connection setup wizard with inline instructions, WebQuery/SSH draft testing, and links to official TeamSpeak 6 Server docs
• Deployment self-check in wizard step 1 (GET /api/servers/deployment-check) — probes common hosts from the manager backend
• Field-level tooltips and sectioned connection form (WebQuery required, SSH optional)
• SSH test endpoints (POST /api/servers/test-ssh, POST /api/servers/:id/test-ssh) and Test SSH buttons on connection cards
• Dashboard nudge for admins with no connections → /settings?tab=connections (wizard via ?wizard=1)

Changed

• Connections tab stays minimal when empty; detailed help moved to an optional dialog
• docker-compose.pr-test.yml bundles TeamSpeak 6 on the compose network for local wizard testing

Security

• SSRF hardening for TeamSpeak connection hosts (validate/sanitize, metadata blocklist, optional DNS check on draft tests)
• CodeQL request-forgery barriers for validated endpoint helpers

Fixed

• Edit connection without re-entering API key when unchanged
• Removed Dockerfile # syntax= directive to avoid Docker Hub build failures

v1.3.7

Added

• Music bots accept !commands in additional channels (SSH text-channel listeners) and reply there while audio stays in the default playback channel
• Configure under Music Bots → Command channels (comma-separated channel IDs) + Virtual server ID
• On !play and !radio, the voice bot joins the command channel so audio plays where the user typed

Fixed

• Load & Play on stream playlists now autoplays the first track after loading the queue
• yt-dlp uses flexible bestaudio format fallbacks with YouTube player_client rotation (fixes "Requested format is not available" on skip/play)
• Cache lookup accepts any downloaded extension for a video ID
• Clearer hint to configure YouTube cookies when bot-check errors occur without cookies

v1.3.6

Added

• Phase B: Import Apple Music / YouTube playlists directly to a running music bot queue (musicBotId, optional clearFirst) without creating a playlist
• TS6 Markdown formatting for !help, !np, !queue, and !radio bot replies (headings, lists, <details> controls hint)
• Custom command editor documents TS6 Markdown / BBCode formatting for responses
• TS6-style formatting toolbar on custom command responses (bold, lists, spoilers, headings, code, math, tables, Mermaid, BBCode snippets)

Changed

• Default max playlist import raised from 50 → 250 (still configurable up to 500 in Settings → Limits)
• !np / !nowplaying shows track progress, up next, and expandable playback control hints (text commands — TS6 has no clickable skip/pause buttons in bot messages)

Fixed

• Apple Music / playlist import jobs report sourceTrackCount and warn when capped (e.g. 259-track playlist with limit 50)
• Import progress shows Matching X/Y of 259; completion toast tells you to raise Settings cap when truncated

v1.3.5

Changed

• Default max playlist import raised from 50 → 250 (still configurable up to 500 in Settings → Limits)

Fixed

• Apple Music / playlist import jobs report sourceTrackCount and warn when capped (e.g. 259-track playlist with limit 50)
• Import progress shows Matching X/Y of 259; completion toast tells you to raise Settings cap when truncated

v1.3.4

Added

• Background Import as Playlist / Import all for Apple Music URLs (matches YouTube on YouTube, registers on stream playlists without downloading)
• Import jobs show matching progress for Apple Music (Matching 45/259 (42 hits)) before adding tracks
• Paste Apple Music URL and import without Load (library tab and playlist editor)

Fixed

• Apple Music Load URL no longer fails at 15s while the backend is still matching tracks — client timeout raised to 5 minutes and nginx /api proxy timeouts set to 300s
• Apple Music load UI shows match progress (98 matched of 259 (first 100 searched)) and clearer timeout error messages
• Duplicate YouTube video matches in Apple Music playlists no longer collapse selection checkboxes
• Stream playlist import registers YouTube tracks on-demand instead of bulk-downloading

v1.3.3

Added

• Stream playlists: Add from URL registers YouTube tracks without downloading; audio is fetched on first play
• POST /music-library/youtube/register for URL-only song rows (empty filePath until played)

Changed

• Apple Music / URL Load matching cap raised from 15 → 100 tracks (parallel YouTube search)

Fixed

• Stream-only playlists no longer bulk-download when adding from a loaded URL

v1.3.2

[1.3.2] - 2026-08-27

Fixed

• Apple Music Load URL matches YouTube tracks in parallel (avoids proxy timeouts on large playlists like 250+ tracks)
• /youtube/info returns the real error message as HTTP 502 instead of a generic 500
• Frontend Load toast shows the server error text
• /api/health reports backend version (+ optional gitSha) so deploys can confirm backend matches the UI

v1.3.1

[1.3.1] - 2026-08-27

Added

• !shuffle [on|off] chat command to toggle or set queue shuffle

Fixed

• Apple Music user playlist IDs (pl.u-… with hyphens) parse correctly
• Library / playlist Load URL resolves Apple Music links via metadata + YouTube match instead of sending them to yt-dlp (fixes Unsupported URL: music.apple.com)