MediaHub Changelog

v1.2.0 April 25, 2026

Added

• About page with version info, feature overview, and tech stack
• Trailer playback buttons on dashboard recently added cards
• Dedicated recently added page with infinite scroll (linked from dashboard "Show All")
• `User-Agent: MediaHub/1.0` header on all outgoing API requests
• Invite registration rate limiting (3 attempts / 15 min)

Changed

• All inline event handlers (`onclick`, `onsubmit`) replaced with `addEventListener` for CSP compliance
• CSP script policy upgraded from `'unsafe-inline'` to nonce-based protection
• Remember-me and MFA cookie duration reduced from 30 days to 7 days
• MFA always required on explicit login (removed mfa_remember bypass)
• Cookie `sameSite` set to `lax`; `secure` flag auto-enabled in production
• Settings page uses "Seerr" terminology instead of "Overseerr / Jellyseerr"

Fixed

• MFA bypass vulnerability - mfa_remember cookie could skip MFA on login
• Settings reveal (eye) buttons blocked by CSP nonce policy
• Trailer buttons blocked by CSP on detail, search, trending, and recently added pages
• Path traversal guard on avatar deletion
• Avatar upload validates magic bytes (JPEG/PNG/WebP only)
• Media detail and trending pages validate ID params as positive integers
• Media sync service checks content-type before parsing JSON responses
• Failed login attempts now logged with IP address

Security

• Full security audit and hardening (OWASP Top 10)
• Method spoofing disabled (`allowMethodSpoofing: false`)
• Nonce-based CSP for all inline scripts across all pages

v1.1.0 April 4, 2026

Added

• Media request system - request movies and TV shows from detail, trending, or search pages with confirmation dialog for download location and quality profile
• Overseerr/Seerr integration for requests with automatic fallback to Radarr/Sonarr
• Location-based permissions - admins can restrict which library locations each user can see
• Per-user request permissions (allow/disallow media requests)

Changed

• Root folders in the request dialog are filtered to only show locations the user is allowed to access

Fixed

• Dashboard cosmetic issue
• Mobile responsiveness improvements across multiple pages

v1.0.5 March 31, 2026

Added

• Background media sync - library data stored in local database and refreshed automatically (configurable 5-60 minute interval)
• Sync logging with configurable retention (0-14 days)
• Manual sync trigger for on-demand library refresh
• Safe API call handling with error recovery for Radarr/Sonarr requests

Fixed

• TypeScript strict-null compliance fix

v1.0.4 March 20, 2026

Fixed

• Mobile/phone view layout fixes

v1.0.3 March 20, 2026

Fixed

• YouTube trailer playback issue
• Apple device compatibility improvements

v1.0.2 March 19, 2026

Added

• Trending page - weekly trending titles from TMDb with infinite scroll and in-library badge
• TMDb search page with type filter, in-library/requested/rating badges, and state preservation
• Upcoming releases section on dashboard with date, release type, and in-library indicator
• Login rate limiting - 5 attempts per IP per 15 minutes to prevent brute force attacks
• App icon
• API key masking in Settings with reveal toggle
• Requested badge on trending page and dashboard for items already in Overseerr

Changed

• Recently added now sorted by actual import date instead of added date
• Configurable display quantity for dashboard items

Security

• Content Security Policy headers enabled via @adonisjs/shield
• Cleanup and security hardening across the application
• Performance enhancements

v1.0.1 March 18, 2026

Fixed

• Avatar upload functionality
• MFA remember-me session persistence
• Minor UI fixes

v1.0.0 March 18, 2026

Added

• Dashboard with recently added movies and series
• Media library grid with search, filter, and infinite scroll
• Movie and series detail pages with tagline, trailer playback, and cast/crew
• Multi-user support with administrator and regular user roles
• Invite-based user registration (no email server required)
• TOTP two-factor authentication with server-side QR code generation
• User profiles with avatar uploads
• Light, dark, and system theme support
• Radarr and Sonarr API integration
• In-app Settings page for API configuration
• SQLite database with session-based authentication
• Docker deployment support (Node.js 20 Alpine)