NeXroll 2.3.0 is a security update, and it adds more than one Radarr and Sonarr to NeX-Up. Community Prerolls moves to Typical Nerds' new servers and matches your prerolls more reliably, and Add Prerolls shows upload progress.
Upgrading
- Update soon (see Security). Your data carries over, and there are no settings to change. Two tables are added on first start, for extra Radarr and Sonarr servers.
- Read-only API keys can no longer change anything. If a script or dashboard makes changes with a read-only key, give it a Full Access key.
- With login on, preroll videos and thumbnails need a login or an API key. NeXroll's own pages and the Jellyfin and Emby plugins are not affected.
- Windows: run the installer over your existing install.
- Docker:
jbrns/nexroll:latest,:2.3and:2, and the same tags onghcr.io/jflxcloud/nexroll, are 2.3.0.:2.2stays on 2.2.9, so if you pin:2.2, move to:2.3or:2. - Jellyfin and Emby: no plugin update. 1.14.2.0 (Jellyfin 10.11 and Emby) and 1.15.2.0 (Jellyfin 12) are still current.
Security
- A read-only API key could make changes while login was on, including taking the system backup, which holds every key, password hash and login session. Read-only keys now only read.
- The Plex probe sent your saved Plex token to any address it was given. With login off, any device on your network or a web page you visited could trigger it. The token now goes only to your saved Plex server.
- A crafted backup could write files into any folder NeXroll can write to when restored. NeX-Up files from a backup now always go into NeXroll's own NeX-Up folder.
- Backups fetched with an API key still held the Plex token and the Jellyfin, Emby, Radarr, Sonarr and TMDB keys in their settings. They are now left out, and restoring such a backup keeps the keys you have.
- With login on, preroll videos and thumbnails could be fetched without signing in.
- Community downloads fetched whatever address the request named. They now always come from the Community server in use, and files over 1 GB are refused.
- Linux: secrets.json could be read by every user on the machine. It is now readable by its owner only.
Thanks to David Coulson for reporting these.
If you run NeXroll where others can reach it, turn on login under Settings > Users. See Authentication.
More than one Radarr and Sonarr
Under NeX-Up > Connections, each card has More Radarr servers or More Sonarr servers, for a 4K or anime instance beside your main one. Upcoming, the Coming Soon list, trailer syncs and Library Trailers read every server as one library: a movie or show on more than one appears once and counts as downloaded when any copy has the file. A server that can't be reached is skipped, except by a Library Trailers sync, which now stops instead of removing your trailers (this also happened with a single Radarr during an outage). See More than one Radarr.
Community Prerolls
- Typical Nerds' new servers. prerolls.uk is now the main server and home.prerolls.uk the backup; the USA server is gone. A saved USA server switches to the main one with a notice, previews and downloads come from the server in use, and the gap between bulk downloads follows each server's setting. An index built on the USA server works again without a rebuild. See Servers.
- Better matching. Linking your prerolls to Community Prerolls now compares file size and length, so renamed files are found and prerolls with similar names are no longer linked (a trailer for Carrie had been linked to a preroll called "Car"). NeX-Up trailers and other videos NeXroll made are never matched. Match Existing Prerolls and Rematch All show their progress, and Rematch All keeps your links if it can't finish. See Prerolls you already have.
Add Prerolls
Uploads show progress for each file and for the whole upload, with Cancel. Each file is sent once (it used to go up twice, the first time with nothing on screen), files already in your library are skipped, and each one ends as Added, Already in library or Failed with the reason. Add files from several folders or drop them anywhere on the page. The category list in the details panel shows every category, scrolls and works from the keyboard. See Upload.
Fixed
- Evening TV premieres in the Americas showed a day late on the Coming Soon list and the Upcoming page. They now show the network's air date.
- "Include Unmonitored TV Shows" never worked for the Coming Soon list and the Upcoming page.
The full list is in the changelog.