🚀 XC_VM v2.0.0

Major release — complete architecture redesign and large-scale codebase refactoring.
XC_VM 2.0 is a full internal rewrite focused on long-term maintainability, modular architecture, and improved scalability.

This release introduces a new modular architecture, a front controller routing system, a unified CLI runner, and significant improvements in security, maintainability, and performance.
The project has been reorganized from a monolithic structure into a layered architecture with clear separation of concerns.

✨ New Features

New Architecture

• Introduced a layered project structure (core, domain, streaming, infrastructure, modules, resources, migrations)
• Added ServiceContainer for dependency management
• Implemented classmap-based autoloader

Front Controller & Router

• Added unified entry point public/index.php
• Introduced HTTP Router with request/response abstraction
• Admin and reseller interfaces now operate through the Front Controller

API Layer

• Unified API layer with dedicated controllers:

  • Player API
  • Enigma2 API
  • Device / XPlugin API
  • Internal server API
  • Playlist API
  • XMLTV / EPG API

CLI System

• Introduced console.php as single CLI entry point

• Implemented command framework with:

  • command registry
  • daemon traits
  • cron job classes

• Replaced legacy CLI and cron scripts

Streaming Core

• Added StreamAuthMiddleware
• Introduced unified ShutdownHandler
• Added internal micro-router for streaming handlers

Module System

• Added ModuleInterface and ModuleLoader

• Extracted several built-in modules:

  • Plex
  • Watch
  • TMDB
  • Ministra
  • Fingerprint
  • Theft detection

🔧 Improvements

Codebase Refactoring

• Removed legacy monolithic architecture
• Refactored controllers, services, and domain logic
• Reduced global variable usage and introduced service-based access

Autoloader

• Rewritten autoloader using tokenizer-based class discovery
• Added igbinary cache for faster class resolution
• Fixed class conflicts and duplicate declarations

Player & Web UI

• Migrated web player from JW Player to Video.js
• Refactored webplayer structure
• Moved views to public/Views

Streaming & API

• Improved FFmpeg variable handling
• Improved API request validation and response handling
• Improved EPG processing and bouquet handling

Build System

• Improved Makefile security and permissions
• Introduced LB-scoped build configuration
• Improved file cleanup during updates

CI / Security

• Added Semgrep security scanning
• Added PHP syntax checks
• Updated GitHub Actions to Node.js 24 compatible versions

🐛 Bug Fixes

• Fixed PHP syntax issues in several services
• Fixed Redis deserialization edge cases
• Fixed duplicate controller conflicts
• Fixed API request validation logic
• Fixed admin view XSS vulnerabilities
• Fixed server configuration conflicts
• Fixed EPG cron job bouquet handling
• Fixed errors in CLI command detection

🔒 Security Improvements

• Hardened binary endpoints against MIME sniffing XSS
• Improved file permission handling in build scripts
• Removed unsafe shell command handling
• Improved API request validation and sanitization

📚 Documentation

• Added full Docsify documentation (English and Russian)
• Added autoloader documentation
• Updated installation and migration documentation
• Corrected documentation repository links

🧹 Cleanup

• Removed legacy CLI scripts
• Removed old admin API monolith
• Removed deprecated utilities and temporary scripts
• Cleaned up legacy directories and duplicate code

⚠ Breaking Changes

System Administration

• Crontab now uses console.php instead of legacy cron scripts

• Admin interface runs through the Front Controller

• Legacy paths such as:

  • crons/*.php
  • includes/cli/*.php
    are no longer used.

Developers

• Legacy utility classes removed:

  • CoreUtilities
  • StreamingUtilities
  • admin_api.php

• Global variables replaced with service accessors and managers

• New services must be registered in the autoloader classmap

Load Balancer Servers

• LB builds now include only required components
• MAIN-only modules are automatically excluded

New Contributors

• @icleitoncosta made their first contribution in #92

Full Changelog: 1.2.16...2.0.0