NeXroll 2.2.1 is a security and quality update to 2.2.0. It updates the YouTube PO-token provider to fix a security flaw, makes Plex path mappings check and set themselves up, lets each media server play its own prerolls, and fixes Jellyfin and Emby sequences, sequence sharing and backups.
Back up your configuration before updating (Settings > Backup and Restore).
Upgrading
- Your data carries over. New settings migrate on first start.
- Windows: run the installer over your existing install. Then open NeX-Up and click Update on the YouTube downloads card: the old PO-token provider is no longer started (see Security). If you never installed it, nothing changes.
- Docker:
jbrns/nexroll:latestis 2.2.1 and already includes the fixed provider. - Jellyfin and Emby: update the NeXroll Intros plugin to 1.14.1.0 (Jellyfin 10.11 and Emby) or 1.15.1.0 (Jellyfin 12). A plugin installed from the NeXroll repository updates itself; the Emby DLL is replaced by hand from the Connect page. Until you update, set Max Intros to 0 on Jellyfin so sequences play in full.
Security
- The YouTube PO-token provider could be reached from the whole network. NeXroll ran bgutil 1.3.1, which listened on every network interface and had a remote code execution flaw reachable that way (GHSA-qpv9-8xfj-xx9m). It now runs 2.0.0, which answers only the machine NeXroll runs on.
- The Docker image reported fixable vulnerabilities. They came from the provider's build tools and outdated dependencies, and from the copies of setuptools and msgpack bundled inside pip. The image now ships only what the provider runs, on patched versions, and no pip.
Path mappings that check themselves
Path mappings are the setting new Plex users most often get stuck on. Settings > Path Mappings now asks your Plex server whether it can open each preroll it is set to play, and says why not when it can't.
- Find it for me searches the folders Plex can see for every folder NeXroll hands it files from (your prerolls, NeX-Up trailers stored elsewhere, and the movie folders Library Trailers read from), confirms each by finding your files, and adds the mappings in one click. It also runs in the first-run wizard whenever Plex is connected.
- Browse Plex picks a mapping's Plex folder from Plex's own view of its disk.
- Prerolls Plex can't open are no longer applied. A path that matched no mapping used to reach Plex unchanged and nothing played, with no warning. NeXroll now leaves those files out, and if Plex can open none of them it keeps its current prerolls. System health shows the result.
Plex only: Jellyfin and Emby never need a mapping. The Path Mappings wiki page now walks through each setup.
Different prerolls on each server
A new Media server condition (Advanced mode) plays a block only on the servers you choose, with its Otherwise everywhere else. With Plex and Jellyfin connected together, one sequence can give each server its own category while the rest of the sequence stays shared. See the recipe in Advanced Sequences.
Jellyfin and Emby play whole sequences
Max Intros used to decide how many prerolls played, so the setting that made a random category play one preroll also stopped every sequence after its first block, and on Emby it did so out of the box. NeXroll now decides, as it does for Plex: one preroll from a random category (or the number set on the Connect page), working through the whole category before repeating, while sequences and in-order categories play in full. If you left Max Intros at 0 on Jellyfin and heard a whole random category before each movie, you now hear one.
Sharing sequences
- Importing into Saved Sequences works again. Every import had failed since 1.12.0. A sequence whose categories or prerolls aren't on this server now opens in the builder to finish.
- Exports carry the whole sequence. Fixed blocks keep all their prerolls, and full bundles include in-order categories and conditional alternatives, keep their names intact, and import .m4v and .webm videos.
Backups
- Backups include your media server logins (the Plex token and Jellyfin and Emby API keys), and a restore puts them back. Keep backup files private.
- A System Backup includes changes made moments before it, which it could miss before.
- Restores keep ignored schedule conflicts pointing at the right schedules, and bring back sidebar favorites.
- A System Restore onto another machine uses that machine's folders and relinks uploaded Generator logos, soundtracks and backdrops. Large backups no longer need to fit in memory.
Other fixes
- Applying a saved sequence skipped Plex on most installs while reporting success.
- The External API's category apply reported success even when Plex refused the change.
- A mapping for
/data/prealso caught/data/prerolls2. - Choosing a theme in Settings pushed its name to the edge of the button.
Documentation
Updated wiki pages: Path Mappings, Advanced Sequences, Sharing Sequences, Backup and Restore, Jellyfin, Emby and NeX-Up.
Full notes: CHANGELOG.md.