Overview
This patch release improves media security, service connectivity, and development startup reliability. It also introduces a guided self-hosted installation flow.
Improvements
- Add a guided installer with Docker Compose checks, writable-folder validation, and an option to skip AI-provider setup. (#155)
- Allow media access to be limited to configured top-level folders with
MEDIA_VISIBLE_FOLDERS. - Show separate background-jobs and ML service status indicators, including accessible labels.
Bug Fixes
- Require authentication for media, thumbnail, and directory-listing routes, and reject path traversal, hidden files, symlink escapes, and malformed byte-range requests.
- Route service-status connections through the web application using authenticated Socket.IO connections, with polling fallback when WebSocket upgrades are unavailable. by @W3D3
- Defer embedding-model preload in development to reduce startup memory usage and prevent background-jobs from being killed; set
PRELOAD_EMBEDDING_MODELS=trueto preload models at startup. - Improve media-browser error messages and serve SVG files using the fallback content type.
Full Changelog: v0.40.0...0.40.1