Highlights
This release marks the 1.0 milestone with major improvements to image sourcing, full URL-based customisation, and several important bug fixes and security hardening.
New Features
- URL query parameter overrides (#3) — All render settings (badge style, size, position, direction, label style, ratings limit/order, image source, textless) can now be controlled per-request via URL query parameters,
without changing saved settings. - TMDB as primary source for logos and backdrops (#10) — Logos and backdrops now prioritise TMDB, falling back to Fanart.tv. Fanart.tv is no longer required to serve logos/backdrops (removed the 501 error). The
poster_source setting has been renamed to image_source to reflect this. - ARM support — Docker images now build for ARM architectures.
- Newest items first (#8) — Image listings now sort by most recently added.
- MIT License — The project is now officially MIT-licensed.
Bug Fixes
- Ratings with value 0 no longer treated as max rating (#11) — A 0 rating now correctly returns "no rating" instead of being interpreted as the maximum score.
- Client IP extraction fixed — Now correctly uses CF-Connecting-IP (Cloudflare) and rightmost X-Forwarded-For entry instead of the leftmost (which can be spoofed).
Security
- API keys redacted in logs — API keys are no longer written in plain text to log output.
- Image decode size limit — Added a maximum decode size to prevent memory exhaustion from maliciously large images.
- Referrer-Policy header — Added no-referrer policy to prevent API key leakage via the Referer header.
Internal Improvements
- Refactored string-based settings to use explicit enum types (BadgeStyle, LabelStyle, BadgeSize, BadgeDirection, BadgePosition, ImageSource).
- Renamed fanart_lang → lang, fanart_textless → textless, poster_source → image_source (auto-migrated).
- Added TMDB images cache layer.
- Added upgrade/migration framework (v001_backdrop_cache_keys).
- Floating major version Docker tag support in CI.
- Extensive new test coverage: e2e_settings, query_overrides, upgrade tests, and RatingsOrderList component tests.
Breaking Changes
- Settings column renames (poster_source → image_source, fanart_lang → lang, fanart_textless → textless) are auto-migrated, but any external tooling referencing old column names will need updating.
Full Changelog: v0.9.8...v1.0.0