Bazarr+ v2.3.1 (Keystone)

Codename: Keystone (continuing the v2.3 line).

Bazarr+ v2.3.1, Keystone, is a focused patch release for the v2.3 line, but it is not only a dependency bump. The headline addition is automatic translation from a configured source language in language profiles, backed by wanted-scan integration, movie-detail source metadata, and follow-up fixes for subtitle variants.

The release also adds per-provider language exclusions, records embedded subtitles as first-class source-quality history entries, fixes embedded-history upgrade behavior, and closes three high-severity Dependabot alerts before the next stable build.

This draft is based on development after v2.3.0.

Headline: Language Profile Auto-Translation

Language profiles can now declare a Translate From language for each target language. This is for users whose target language has poor subtitle-provider coverage but whose media usually has good source subtitles available in another language, most commonly English.

Example workflow:

Set a profile item to target Latvian.
Set Translate From to English.
Bazarr+ downloads or finds a good English subtitle.
Bazarr+ queues translation from English to Latvian through the configured translator.

What landed:

Added translate_from to language profile items, with existing profile items defaulting to no auto-translate behavior.
Added a Translate From dropdown in the language profile editor.
Added translator.min_source_score, exposed in Settings > Translator as a minimum source-quality score before auto-translation can trigger.
Queues translation after a fresh subtitle download when the downloaded source language matches a profile item.
Extends wanted scans so an existing on-disk source subtitle can satisfy the search path and queue translation instead of querying providers again.
Skips forced subtitles as translation seeds.
Avoids re-queueing translations that are already satisfied or already pending.

The movie subtitle table now surfaces the metadata that makes this flow easier to audit:

Source subtitle score with color-coded badges.
Provider name for the subtitle that produced the source file.
Status icons for sync and translation activity.
Missing-subtitle actions can use available subtitles as translation sources.

Auto-Translation Fixes

Several follow-up fixes landed after the initial auto-translation merge:

Series auto-translations now queue with media_type=episode, matching the translator pipeline.
Translate From matching now respects exact target variants, so base, forced, and hearing-impaired targets do not bleed into each other.
Source score lookup now handles :hi and :forced language suffixes, closing issue #142.
Double-translation guards now use the correct language column and variant-aware matching.
Missing history is treated as exactly at threshold, avoiding silent quality-gate bypass behavior while keeping wanted scans moving when old rows lack score metadata.
Logging was cleaned up around translation re-queue checks and pending jobs.

Per-Provider Language Exclusions

Providers can now be limited by language from the provider drawer. This lets an operator keep a provider enabled while excluding languages where that provider is noisy, low quality, blocked, or simply not desired.

What changed:

Added Excluded languages to Settings > Providers for enabled search providers.
Stored exclusions under the existing general.provider_languages config key, now interpreted as excluded languages.
Applied exclusions before native provider queries.
Applied the same exclusion hook to the OpenSubtitles-compatible provider pool.
Included active Provider Hub plugin providers in the same settings flow, using plugin manifest language metadata where available.
Cleaned up provider removal so language exclusions and priorities are removed with the provider.

This came from the per-provider language request and was validated against both native search and compat search paths.

Embedded Subtitle History

Embedded subtitles now get proper history representation instead of looking like unknown-quality subtitles.

What changed:

Embedded subtitles are recorded as action=7 history entries with provider embedded.
Embedded history rows receive full source-quality score metadata.
Series and movie indexing both deduplicate embedded history rows on re-index.
Combined forced and hearing-impaired embedded variants are normalized before deduplication.
The history UI shows a dedicated embedded-source icon and label.
Upgrade selection now ignores newer embedded-source rows when deciding whether an older downloaded subtitle is still upgradable.
Batch upgrade media-id selection handles embedded-source rows correctly.

The practical effect: embedded tracks are visible as real source-quality subtitles, but they do not block legitimate upgrade candidates or get targeted as upgrade downloads themselves.

Security

This draft includes the current open high-severity Dependabot fixes from requirements.txt:

Updated urllib3 from 2.6.3 to 2.7.0.
- Fixes GHSA-mf9v-mfxr-j63j, CVE-2026-44432: decompression-bomb safeguards bypassed in parts of the streaming API.
- Fixes GHSA-qccp-gfcp-xxvc, CVE-2026-44431: sensitive headers forwarded across origins in proxied low-level redirects.
Updated dynaconf from 3.2.12 to 3.2.13.
- Fixes GHSA-pxrr-hq57-q35p, CVE-2026-33154: remote code execution risk through insecure template evaluation in the @jinja resolver.
Added a dependency regression test so requirements.txt and the startup requirements probe stay aligned with the patched versions.

GitHub still reports these alerts on the default branch until the release path carries the dependency bump from development to the stable branch.

Release Hygiene

Fixed the project site GitHub stars badge URL.
Added pre-commit configuration for common local checks.
Added the detect-secrets baseline used by the pre-commit setup.

Included Pull Requests

#137: Automatic subtitle translation via language profile.
#151: Add per-provider language exclusions.
#152: Original embedded subtitle history contribution.
#153: Fix auto-translate media type and variant matching.
#154: Fix embedded subtitle history upgrade handling.

Validation Coverage Added

Auto-translation profile behavior and variant matching.
Provider language exclusion parsing and application to native and compat pools.
Embedded history indexing and deduplication for movies and series.
Embedded history upgrade selection for movie, episode, and batch upgrade flows.
Patched dependency pins in requirements.txt and the startup requirements probe.

Docker

docker pull ghcr.io/lavx/bazarr:2.3.1
docker pull ghcr.io/lavx/bazarr:latest

After upgrade, confirm the UI loads and /api/system/status reports 2.3.1.

Contributors

Thanks to @davidgut1982 for the auto-translation language profile feature, embedded subtitle history, and the many follow-up fixes that made both production-ready.

Full Changelog: v2.3.0...v2.3.1

LavX/bazarr v2.3.1 Bazarr+ v2.3.1 Keystone on GitHub