v2.12.3
Security patch for 2.12.1. Nothing else changes. The work on develop stays there for 2.13.0.
2.12.2 was tagged earlier today with the first half of these fixes. 2.12.3 adds the image optimiser change below, so go straight to 2.12.3.
Docker tags
| Tag | What it tracks |
|---|---|
bitr8/agregarr:latest
| Stable releases. This is what you want. |
bitr8/agregarr:2.12.3
| Pinned to this exact release. |
bitr8/agregarr:develop
| Bleeding edge. Builds on every push, breaks sometimes. |
Upgrading from 2.12.x is just a pull. Config volumes are compatible.
Fixed
- Removed a package npm flagged as malicious. npm took down
youtube-search-without-api-keyon 25 October and flagged it as malicious (MAL-2026-18270). Every earlier image includes it. Agregarr only used the package to search YouTube when TMDB had no trailer. That search now goes through yt-dlp, which was already handling the download. Include and exclude words still apply to the top 10 results,youtube-cookies.txtis used for searches too, and the static placeholder video remains the fallback. - Turned off the Next.js image optimiser. Agregarr inherits
/_next/imagefrom Next.js, but its own UI never used it. The endpoint still answered without a login, and it's the path used by the two recent Next.js image optimisation advisories (GHSA-2xp9-vwfh-vxw4, GHSA-2464-fhr4-w9xw). It should now return a 404 before fetching anything. Posters and backdrops should load as before. - Updated sharp to 0.35.5. That should cover the same two advisories for Agregarr's own image processing, plus sharp's librsvg advisory (CVE-2026-114111).
- Updated express to 4.22.3 and axios to 1.21.0. Both stay on the same major versions. This should pick up the body-parser (CVE-2026-111181), proxy-addr (CVE-2026-90711), path-to-regexp, and qs fixes, along with the axios SSRF and DoS fixes. Other vulnerable packages have moved to the newest versions allowed by their existing ranges.
Heads up
- Some advisories remain open because they need major upgrades: Next.js 12, nodemailer 6, multer 1, and zod 3. Those are bigger jobs and are tracked for a later release. Security scanners will still flag the Next.js image advisories against Next.js 12 even though the endpoint is now off.
- Don't expose Agregarr directly to the internet. Keep it on your LAN. If you need remote access, put it behind a reverse proxy with its own authentication at a minimum. Some endpoints answer without a login.
- Trailer search now runs through yt-dlp, so it may occasionally pick a different video for the same title.
Thanks
Cheers to diblaze, whose upstream PR (agregarr#639) worked out the yt-dlp search approach used here.