What's fixed
🏆 Showcase toggle clunky hide
Flipping "Show equipped showcase" OFF sometimes kept showing the pills until a hard refresh. Root cause was a race: the ab:showcase-pref-changed broadcast fired BEFORE the preference POST had landed on disk, and sidebar.js was responding by re-fetching /preferences which returned the OLD true state.
Fix: sidebar.js now reads detail.show directly from the event payload and applies it without a server round-trip. DOM gets removed instantly.
🔒 Admin force-hide propagation
When the admin toggled ForceHideEquippedShowcase in Feature Controls, it didn't affect any other user's open session until they manually refreshed — the admin has no way to broadcast across tabs.
Fix: sidebar.js now periodically re-resolves (every 60 seconds) by re-fetching public-config + user prefs. Admin-side changes propagate to every open client within a minute without anyone having to reload.
🎨 SVG upload
Two fixes stacked:
- Specific error message —
SvgWarningnow includes the actual sanitizer reason (disallowed element, malformed XML, > 100 KB, etc.) instead of a generic "rejected" so you know exactly what to fix. <use>allowed for same-document refs — blanket-blocking<use>was rejecting many legitimate icon SVGs that reference internal<symbol>definitions. Now allowed ifhref/xlink:hrefis a same-document anchor (#id). External URIs still blocked.
📘 README
- Expanded the Friends section with the privacy toggles (appear offline, hide now playing), Jellyfin avatar support, relaxed online check (15-minute LastActivity grace window so casual browsing counts as online), and compact request rows
- Version badge bumped to 1.7.10
MD5: DBC5453481D4E417485F790EB2FC6895