v1.6.1
🐛 Critical fixes
401 error on refresh / back navigation — auth header fetch now waits up to 2s for the Jellyfin ApiClient to fully initialize before firing requests, and retries once on 401 transient races. Fixes the "Failed to load achievements. Error 401" that appeared when refreshing the achievements page or navigating back from the shareable profile card.
Xbox logo upload silently failing — base64 detection was incorrectly rejecting raw SVG input as invalid. Now checks for < character before attempting base64 decode. Admin UI also surfaces sanitization warnings so you can see what happened if a paste is rejected.
✨ New feature — Disable equipped badges showcase
For users with custom home page themes that clash with the showcase styling, you can now disable it:
- Per-user: Settings → Display & Features → "Show equipped showcase" toggle
- Admin override: Feature Controls → "Force hide equipped showcase (for all users)"
Hides: sidebar showcase strip, header badge dots, equipped slots section on the achievements page. The achievements nav link stays visible so you can still reach the page.
🔒 Security — 4 additional audit findings fixed
- Information disclosure in the anonymous profile card endpoint — exception messages no longer leaked in responses
- Resource exhaustion — limit/weeks query params on leaderboard, prestige, streak calendar, ETAs, recent unlocks, and next badges endpoints had no upper bounds. All clamped now.
- SaveUserPreferences input validation — free-form strings (Language, AchievementPageTheme, MinimumToastRarity) now allowlisted, EquippedBadgeSlots clamped 1-10
- PinBadge validation — bogus badge IDs accepted without validation, no cap on pinned list. Now requires alphanumeric IDs, requires the badge exists, caps at 50 entries.
No critical vulnerabilities found beyond those already fixed in v1.6.0. No path traversal, open redirects, or untrusted deserialization issues.