Release v2.0.2 · webtor-io/self-hosted

Patch release: web-ui moves up to the 2026-08-30 build, which carries a batch of security fixes. No schema migrations — safe to pull over 2.0.1.

Fixes

web-ui: outbound fetches driven by user input are behind an SSRF guard.
web-ui: job caches are scoped per session, so a raw session cookie no longer ends up in cache keys.
web-ui: credentialed CORS is limited to the instance's own origin.
web-ui: i18n redirects can no longer be used to bounce a visitor off the site.
web-ui: previews of banned resources are no longer served.
web-ui: access-token scope is enforced outside the four token-bearing surfaces, and caller-supplied resize widths are bounded.
web-ui: the Stremio /s alias proxies the request instead of answering 301 with the token in Location.
web-ui: side-loaded subtitles survive a transcoder session restart.
web-ui: five dependencies bumped to clear govulncheck.

Smoke scenario 94-stremio.sh now expects the alias to proxy rather than redirect.
Renovate handles base images (alpine, nats, versitygw) as their own group: a soak period before they land, and dashboard approval for major bumps. Component digests under ghcr.io/webtor-io/** keep automerging on green smoke.
generate-session-secret is documented as required rather than defensive: since 2026-08 web-ui refuses to start without SESSION_SECRET, and the value also signs Stremio links and per-user S3 secret keys, so it must persist across restarts.

docker pull ghcr.io/webtor-io/self-hosted:2.0.2 (or :latest / :2.0), multi-arch amd64 + arm64. No configuration changes, no schema migrations.