c4lyp5o/eziarr v1.0.1 on GitHub

[1.0.1] - 2026-04-05

SSRF Hardening: Implemented a custom node:http Agent to validate DNS resolution at the socket level, neutralizing DNS-rebinding attacks.
Redirect Blocks: Disabled Axios auto-redirects in the Open Directory scanner to prevent local network traversal.
Validation: Added strict 8-character minimum length requirements to the Settings API schema.

Argon2 Hashing: Replaced plain-text password storage with Bun's native Argon2 password hashing.
API Sanitization: Prevented the /api/v1/settings endpoint from exposing the admin password and Telegram MTProto session strings to the frontend.
Settings UI: Improved the conditional rendering of the *Arr "Test Connection" buttons to only appear when credentials are changed.
Internet Archive: Replaced raw Axios stack-trace crashes with graceful warnings when archive.org returns 503 errors.

Telegram Search: Implemented dual-query auto-correction to handle the & vs and discrepancy in Telegram channel scraping.
Radarr Imports: Fixed an issue where Indexer torrents with unrecognizable names were rejected by injecting metadata directly into the push payload.
File Extensions: Fixed a critical file-parsing bug where files without extensions caused the app to append the entire filename as the extension. Safely falls back to .mp4 or .mp3.
JWT Amnesia: Fixed a bug where restarting the Docker container invalidated all active sessions by persisting the JWT Secret to the SQLite database.
Settings Overwrite: Fixed a bug where saving settings would inadvertently overwrite the newly hashed password with plain text.
React Warnings: Fixed an "uncontrolled to controlled input" React warning in the Settings Modal.