Gauthier
bd27f2de6b
fix(users): correct auth middleware for web push subscription ( #3005 )
2026-05-09 17:18:22 +08:00
renovate[bot]
de11222a37
chore(deps): update dependency express to v5 ( #2963 )
...
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: gauthier-th <mail@gauthierth.fr >
2026-05-08 10:39:33 +02:00
Fredrik Burmester
15296a03ae
feat: add route to fetch user by jellyfin id ( #2074 )
...
Co-authored-by: gauthier-th <mail@gauthierth.fr >
2026-05-07 02:10:26 +08:00
Kyle Engler
d024849460
feat: filter out "Thanks" credits when looking at a person's credits ( #2370 )
2026-04-21 20:43:03 +08:00
Ludovic Ortega
3e4bf1b9f6
refactor(logs): align failed login attempt message with failed sign-i… ( #2914 )
...
Signed-off-by: Ludovic Ortega <ludovic.ortega@adminafk.fr >
2026-04-20 23:19:31 +08:00
fallenbagel
cd257bad2a
feat(i18n): add server-side i18n for notification agents ( #2731 )
2026-04-17 19:39:59 +08:00
Aldo
5b45806f15
fix: normalize webhook payload encoding to support raw JSON inputs ( #2641 )
...
Co-authored-by: Aldo <eliacim@aldo.pw >
2026-04-16 16:13:54 +08:00
0xsysr3ll
ff469cb6d7
feat(settings): add blocklist region and language options ( #1802 )
2026-04-15 16:42:52 +08:00
fallenbagel
20ccd4bd38
fix(request): record modifiedBy on retry and add route tests ( #2824 )
2026-04-12 16:52:45 +02:00
fallenbagel
fe2c0416ef
fix(emby): use static version in auth header for emby only ( #2821 )
2026-04-07 23:12:54 +02:00
Doug Rathbone
6aeab38ad6
fix(request): correct delete permission check and await movie save ( #2742 )
2026-04-07 07:48:24 +00:00
0xsysr3ll
1bb638e175
fix: await missing repository saves ( #2760 )
2026-04-01 15:16:30 +02:00
fallenbagel
036d000f26
refactor(imageproxy): reduce noisy image cache logging ( #2789 )
2026-04-01 14:40:14 +02:00
0xsysr3ll
993ae4c58e
feat(blocklist): add support for collections ( #1841 )
2026-03-30 06:19:45 +08:00
0xsysr3ll
eaf397a021
feat(userlist): add sortable columns to User List ( #1615 )
2026-03-21 04:45:00 +05:00
Michael Thomas
36243a0deb
chore: upgrade to eslint v9 ( #2574 )
2026-03-16 21:12:30 +05:00
fallenbagel
0be18968b4
fix: disambiguate tmdb ids by media type across lookups ( #2577 )
2026-03-14 23:47:21 +05:00
Michael Thomas
8563362588
test: support server-side unit testing ( #2485 )
2026-03-12 18:39:41 +05:00
bogo22
4ce0db1959
feat(trending): add filter options ( #2137 )
...
Signed-off-by: Florian Hoech <code@florians-web.de >
2026-03-05 15:24:55 +05:00
0xsysr3ll
3152f727ef
feat(notifications): webhook custom headers ( #2230 )
...
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
2026-03-05 15:23:47 +05:00
fallenbagel
a16d0464a6
fix(issues): update issue timestamp when adding comments ( #2616 )
2026-03-02 12:35:18 +01:00
Lachlan Wisdom
3557745b62
feat(jellyfin): allow Jellyfin Guids with dashes for import-from-jellyfin endpoint ( #2340 )
2026-03-02 16:22:33 +05:00
0xsysr3ll
001f6b1a34
fix(media): exclude null mediaAddedAt entries ( #2607 )
2026-03-01 22:51:51 +05:00
Rin
e086081b19
fix(proxy): add path validation guardrail to imageproxy ( #2531 )
2026-02-28 00:14:05 +05:00
Gauthier
946bdecec5
Merge commit from fork
...
This PR fixes a security issue where authenticated users could access and modify data belonging to
other users. The isOwnProfileOrAdmin() middleware was missing from several push subscription API
routes. As a result, any authenticated user on the instance could manipulate the userId parameter in
the URL to view or delete the push subscriptions of other users.
2026-02-28 00:58:50 +08:00
fallenbagel
4f089b29d0
Merge commit from fork
...
Add ownership check to GET /api/v1/user/:id so the full user object(including eager-loaded settings
with notification credentials) is onlyreturned to the user themselves or MANAGE_USERS admins. All
otherauthenticated users receive a stripped response (which is the intended behaviour as
https://github.com/sct/overseerr/pull/3695#issuecomment-1817827774 ). Also expands
User.filteredFields to strip sensitive fileds to prevent leaking credentials
2026-02-28 00:58:28 +08:00
fallenbagel
4ae2068409
Merge commit from fork
...
Fix a logic flaw in the jellyfin auth guard that allowed unauthenticated users to register accounts
on Plex-configured instances by authenticating against an attacker-controlled Jellyfin server.
2026-02-28 00:36:17 +08:00
0xsysr3ll
947f70c3d7
fix(watch-data): use sentinel values to avoid invalid SQL syntax ( #2552 )
2026-02-23 21:24:48 +01:00
fallenbagel
9da8bb6dea
fix: preserve blocklist on media deletion & optimise watchlist-sync ( #2478 )
2026-02-18 21:23:50 +01:00
Conlan Kreher
33a5d9a9ac
refactor: rename blacklist to blocklist ( #2157 )
...
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
Co-authored-by: fallenbagel <98979876+Fallenbagel@users.noreply.github.com >
Co-authored-by: 0xsysr3ll <0xsysr3ll@pm.me >
Co-authored-by: gauthier-th <mail@gauthierth.fr >
2026-02-14 14:31:45 +01:00
fallenbagel
faa2c0a005
fix(servarr): add timeout to Radarr/Sonarr API requests to prevent infinite loading ( #2375 )
...
* fix(servarr): add timeout to Radarr/Sonarr API requests to prevent infinite loading
Adds a 5-second timeout to all Radarr/Sonarr API requests and displays a warning banner when
services are unreachable. This prevents the Recent Requests section and request list pages from
hanging indefinitely when a configured service has connection issues.
fix #2374
* fix(requests): only show service error banner to users with advanced permissions
2026-02-06 21:38:21 +01:00
fallenbagel
8b41685b31
chore(deps): upgrade prettier, and tailwind ( #2351 )
2026-01-29 07:48:34 +01:00
fallenbagel
ddf347994a
chore(deps): update dependencies and fix security vulnerabilities ( #2342 )
...
* chore(deps): update dependencies and fix security vulnerabilities
Update TypeScript 4.9 → 5.4. Update Zod 3 → 4. Update nodemailer 6 → 7. Update @typescript-eslint
packages to v7. Update xml2js, undici, lodash, axios, swr, winston- Add pnpm.overrides for
transitive dependency vulnerabilities
* chore: fix import ordering for TypeScript 5.4 compatibility
prettier-plugin-organize-imports behaves differently with TypeScript 5.4 vs 4.9, causing CI
formatting checks to fail. This reformats imports to match the ordering expected by the plugin with
the upgraded TS version.
2026-01-27 19:00:42 +01:00
0xsysr3ll
d0c9afc16e
fix(webpush): improve iOS push subscription endpoint cleanup ( #2140 )
2025-12-31 13:44:45 +01:00
fallenbagel
3ee69663dc
fix(local-login): remove automatic plex linking and reduce logout log verbosity ( #2225 )
...
Removed redundant Plex user discovery logic that applies to all media servers currently. This is now
handled explicitly via linked accounts settings page. Also changed the successful logout log level
from info to debug since its routine behaviour
2025-12-15 19:44:43 +08:00
0xsysr3ll
9a92d6ac30
fix(api): respect is4k parameter for all media status changes ( #1951 )
...
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
2025-10-28 17:26:28 +01:00
0xsysr3ll
7dfa30a151
fix(media): handle 4K Radarr removal for multiple instances ( #2037 )
...
This PR fixes an issue where removing 4K movies from Radarr failed when multiple Radarr instances were configured. The backend was misparsing boolean query parameters and using string slugs instead of TMDB IDs. The fix ensures that the correct 4K Radarr instance is targeted and that TMDB IDs are used for movie removal.
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
2025-10-28 17:25:57 +01:00
Ludovic Ortega
b34ca1543a
feat: do not enforce TLD on email ( #2075 )
...
fix #1846
2025-10-20 17:24:24 +03:00
J. Winters-Brown
f7f00ce361
feat: migrate to validator from email-validator ( #2059 )
...
* refactor(adds package): this adds the validator package and removes email-validator from dependencys
* refactor(auth.ts and email.ts): migrates from EmailValidator to validator
2025-10-19 22:37:09 +02:00
Brandon Cohen
a975ab25c3
fix: delete endpoint on push notification disable ( #2067 )
...
fix: add endpoint deletion on disable
fix: use definemessages util
refactor: add code comment
2025-10-19 00:03:28 +08:00
salty
a8c7e35f56
fix(api): cleanup radarr bits in sonarr api ( #2035 )
2025-10-12 17:19:51 +02:00
TheCatLady
2e2d2a031b
chore: rename Jellyseerr -> Seerr, part 1 ( #1984 )
...
* chore: rename Jellyseerr -> Seerr, part 1
* chore: update Jellyfin bot name
2025-10-06 15:22:36 -07:00
0xsysr3ll
c024799dae
feat(api): add completed count to request count API ( #1824 )
2025-09-24 14:03:33 +02:00
0xsysr3ll
cd479d0d17
feat(api): add excludeKeywords parameter to discovery queries ( #1908 )
...
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
2025-09-17 03:32:39 +08:00
0xsysr3ll
17172e93f9
feat(webhook): add support for dynamic placeholders in webhook URL ( #1491 )
...
* feat(wehbook): add support for dynamic placeholders in webhook URL
* refactor(webhook): rename supportPlaceholders to supportVariables and update related logic
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
* feat(i18n): add missing translations
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
* refactor(notifications): simplify webhook URL validation logic
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
* fix: wrong docs url
Co-authored-by: Gauthier <mail@gauthierth.fr >
* fix: update webhook documentation URL to point to Jellyseerr
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
---------
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
Co-authored-by: Gauthier <mail@gauthierth.fr >
2025-09-10 17:20:58 +08:00
THOMAS B
4878722030
fix(tvdb): respect display language when fetching metadata ( #1889 )
...
* fix(tvdb): respect display language when fetching metadata
* refactor(tvdb): use seasons translation
* refactor(tvdb): limit while loop
* fix(tvdb): fix translation with '-'
* refactor(tvdb): remove logs
* style(tvdb): remove useless logs
* refactor(tvdb): simplify wanted translation condition
* refactor(languages): move AvailableLocale from context to types
2025-09-08 20:20:21 +08:00
Ishan Jain
479be0daeb
feat(notifications): make embedded posters optional ( #1364 )
...
* feat(notifications): make images optional
* fix(notifications): added en i18n config
* fix: prettify
* fix(notifications): added embedImage support for ntfy
* fix(frontend): update embedImage on form state change and submission
* fix(locale): updated locale for embedImage
* fix: renamed embedImage to embedPoster
2025-09-08 14:11:31 +02:00
0xsysr3ll
13fe4c890b
feat(issue): add issue description preview ( #1881 )
...
* feat(issue): add issue description preview
This PR adds a description preview to the issues list page, allowing users to quickly view issue details without navigating to individual issue pages.
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
* fix(issue): remove unnecessary user join
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
---------
Signed-off-by: 0xsysr3ll <0xsysr3ll@pm.me >
2025-09-04 10:24:08 +02:00
THOMAS B
22b2824441
feat: add tvdb indexer ( #899 )
...
* feat(tvdb): get tv seasons/episodes with tvdb
* fix: fix rate limiter index tvdb indexer
* fix(usersettings): remove unused column tvdbtoken
* refactor(tvdb): replace tvdb api by skyhook
* fix: error during get episodes
* fix: error if tmdb poster is null
* refactor: clean tvdb indexer code
* fix: wrong language with tmdb indexer
* style: replace avalaible to available
* style: tvdb.login to tvdb.test
* fix(test): fix discover test
* fix(test): wrong url tv-details
* test(tvdb): add tvdb tests
* style(tvdb): rename pokemon to correct tv show
* refactor(indexer): remove unused getSeasonIdentifier method
* refactor(settings): replace tvdb object to boolean type
* refactor(tmdb): reduce still path condition
* test(tvdb): change 'use' to 'tvdb' condition check
* fix(tmdb): fix build
fix build after rebase
* fix(build): revert package.json
* fix(tvdb): ensure that seasons contain data
* refactor(swagger): fix /tvdb/test response
* fix(scanner): add tvdb indexer for scanner
* refactor(tvdb): remove skyhook api
* refactor(tvdb): use tvdb api
* fix(tvdb): rename tvdb to medatada
* refactor(medata): add tvdb settings
* refactor(metadata): rewrite metadata settings
* refactor(metadata): refactor metadata routes
* refactor(metadata): remove french comments
* refactor(metadata): refactor tvdb api calls
* style(prettier): run prettier
* fix(scanner): fix jellyfin scanner with tvdb provider
* fix(scanner): fix plex scanner tvdb provider
* style(provider): change provider name in info section
* style(provider): full provider name in select
* style(provider): remove french comment
* fix(tests): fix all cypress tests
* refactor(tvdb): fix apikey
* refactor(tmdb): apply prettier
* refactor(tvdb): remove logger info
* feat(metadata): replace fetch with axios for API calls
* feat(provider): replace indexer by provider
* fix(tests): fix cypress test
* chore: add project-wide apikey for tvdb
* chore: add correct application-wide key
* fix(test): fix test with default provider tmdb anime
* style(cypress): fix anime name variable
* chore(i18n): remove french translation + apply i18n:extract
* style(wording): standardize naming to "Metadata Provider" in UI text
* docs(comments): translate from French to English
* refactor(tvdb): remove unnecessary try/catch block
* feat(i18n): add missing translations
* fix(scanner): correct metadata provider ID from Tmdb to Tvdb
* style(settings): clarify navigation label from "Metadata" to "Metadata Providers"
* style(logs): update error log label from "Metadata" to "MetadataProvider"
* refactor(tvdb): replace indexer by metadata providers
* refactor(settings): remove metadata providers logo
* fix(config): restore missing config/db/.gitkeep file
---------
Co-authored-by: TOomaAh <ubuntu@PC>
Co-authored-by: fallenbagel <98979876+Fallenbagel@users.noreply.github.com >
2025-09-02 22:40:47 +02:00
Gauthier
368ecf8771
fix(dnscaching): display stats for DNS caching ( #1858 )
...
* fix(dnscaching): display stats for DNS caching
* fix: add missing translation
2025-08-20 17:32:59 +08:00