Kha-kis/arr-dashboard v2.7.2

v2.7.2 - Custom Upstream Repos & User Custom Formats

on GitHub

Added

• Custom upstream repository - Configure a custom GitHub fork as TRaSH Guides upstream source, replacing the official TRaSH-Guides/Guides repo. Includes settings UI with Git URL input, test connection, and reset to official (#77)
• User custom formats - Full CRUD management for user-defined custom formats with specification builder, import from TRaSH upstream, and deploy to Sonarr/Radarr instances
• UserCustomFormat database model - New Prisma model for persisting user-created custom format definitions with specifications

Fixed

• DOMPurify v3 CJS import - Fix silently returning empty HTML for all sanitized content by using mod.default || mod with sanitize() validation (#74)
• CF description endpoint - Switch to dedicated lazy-loading endpoint with multi-strategy slug matching (exact, displayName, base name fallbacks) (#74)
• Template update banner overflow - Fix wrapping badge row layout that overflowed on narrow viewports
• SSR hydration mismatch - Use deterministic skeleton widths to prevent server/client rendering differences
• Timer stacking - Prevent scheduleCacheRefresh from stacking on rapid mutations
• Silent error swallowing - Add console.warn to catch blocks for diagnostic visibility

Changed

• Parameterized TRaSH fetcher URLs - github-fetcher and version-tracker now accept TrashRepoConfig for per-request fetcher creation
• Tab content rendering - Refactored from nested ternary to switch statement with ErrorBoundary wrappers
• UX copy improvements - Better messaging for cache repopulation timing expectations

Security

• Alpine package CVEs - Patch libcrypto3/libssl3 3.3.5→3.3.6, busybox 1.37.0-r13→r14 via apk upgrade in Dockerfile (#75)
• Dependency overrides - Force lodash ≥4.17.23 (prototype pollution) and hono ≥4.11.7 (XSS, cache deception, IP spoofing) in Prisma transitive dependency chain (#75)

Full Changelog: v2.7.1...v2.7.2