Bazarr+ v2.2.1 (Synapse Hotfix)

v2.2.1 is a focused patch release for Synapse. It restores the correct auth boundary for Docker-served SPA routes, keeps startup handling stable, adds the Prijevodi-Online provider, and fixes a small badge-label overflow regression.

No config migration is required.

Docker Auth Boundary

The Docker supervisor no longer injects a plaintext API key into index.html and no longer serves protected SPA routes as if they were public pages.

• Protected routes such as /system/releases now reach the running backend and redirect unauthenticated browser sessions to /login.
• Unauthenticated API calls still return 401.
• Static assets remain served directly by the supervisor.
• Stale asset requests still return 404 instead of falling through to the SPA shell.

This fixes the v2.2.0 regression where users could see most of the app without logging in and only hit auth when an API action was attempted.

Startup Shell

The supervisor now serves a tiny reload page only while the backend is in the starting state. This prevents the real frontend from booting with an empty bootstrap API key during startup.

Crash and restart scenarios keep the normal SPA shell, so the frontend reconnection flow still works instead of trapping users in a refresh loop.

Prijevodi-Online Provider

This release adds the Prijevodi-Online subtitle provider and exposes it in the provider settings list.

The provider parser also handles language markers as slug segments, not only strict URL suffixes. That means valid links such as ...-sr-dr4e and ...-sr-3236 are now detected as Serbian subtitles instead of being dropped.

UI Fix

Badge labels no longer force overflow: visible, which fixes the small alignment issue where long badge text could visually decenter rows across the UI.

Validation

• Deployed ghcr.io/lavx/bazarr:sha-463997f to the test server and verified Docker health is healthy.
• Verified /system/releases redirects to /login in a browser when unauthenticated.
• Verified unauthenticated /api/system/settings returns 401.
• CI passed for the release PR, including frontend, Python 3.12/3.13/3.14 backend tests, and CodeQL.

Docker

docker pull ghcr.io/lavx/bazarr:2.2.1
docker pull ghcr.io/lavx/bazarr:latest

Docker version tags use semver without the v prefix.

Full Changelog: v2.2.0...v2.2.1