Stable-26.11.07

This release fixes Fred TV EPG compatibility, speeds up large Web Player catalogs, and addresses the findings from a full-project reliability and security review. See PR #645 for the detailed changes.

Xtream and Web Player

• EPG listings consistently include numeric now_playing and has_archive fields, fixing the strict-client failure reported in #644. Current-program boundaries are handled consistently; existing timeshift support remains available.
• The Web Player loads the active tab first and fetches other catalogs when opened. Series load as folders with the correct local IDs; episodes load on demand. Search and accessible “Load more” controls keep the full catalog reachable.
• Tab switches clear old interactive rows immediately, reuse loaded catalogs, and ignore stale responses. Playback URLs preserve authentication, including reserved characters in credentials, and media-format detection ignores misleading credential/query text.
• Xtream profile/server aliases, public server metadata, category IDs, series modification times, and VOD extensions are corrected. Movie metadata/playback now require a movie assignment.

A local synthetic catalog with 5,000 live channels and 150 series × 100 episodes generated its initial Live response in 145 ms, versus 4,502 ms for the previous full cold request. Payload fell from 10.93 MB to 2.71 MB. Actual loading depends on your server, network, and device.

Reliability and security

• Stream capacity reservations are atomic across SQLite/Redis. Remote termination requires owner acknowledgement before freeing capacity; stale remote owners no longer block accounting reads. Catch-up activity, account deletion, probes, subtitles, and FFmpeg credential forwarding receive additional safeguards.

• Expired/revoked accounts and changed share permissions take effect consistently, including cached access. Account switches clear private UI state; confirmed HTML injection paths and old public JWT defaults are fixed.

• XMLTV keeps the last valid guide after incomplete imports. Catalog downloads have size/time limits; malformed M3U headers fail safely, and delayed automatic matching preserves newer manual EPG mappings.

• Encrypted backups support portable OTP secrets and preserve valid admin grants, hidden state, and episode aliases. Installer permissions, LAN HTTP AI request keys, CORS handling, and comments are corrected.

• The bare-metal updater prepares dependencies for the exact fetched commit before stopping the service and protects recovery files.

• ESLint’s minimatch dependency is pinned to patched version 11.0.1 (PR #643).

Upgrade notes

• If your installation used the old JWT placeholder, sign in again after upgrading. Existing encryption keys are retained.
• For legacy enabled-OTP backups restored with a different key, upgrade and re-export from the source installation. Unreadable OTP data now aborts import safely.
• Allow disk space for a second dependency copy during bare-metal updates.
• Unreachable stream owners retain capacity. Only after confirming the old instance and its playback children stopped, use the terminate endpoint’s explicit confirm_owner_stopped recovery with the recorded owner identity.

Automated tests and Docker/runtime CI passed. Real-provider playback, DRM/Cast hardware, and Debian/systemd deployment were not exercised.

Full changelog