CrossWatch v0.9.12

Another huge update as i've continuing the work started in 0.9.11, where we moved from IMDb-first to TMDB-first.
I’ve made a bunch of optimizations and tightened up the orchestrator integration, so your sync results should be more reliable.

There’s also a new experimental feature called Progress, which lets you sync resume positions between media servers.

And last, but definitely not least, security has been improved.

IMPORTANT - what you absolutely need to do:

• All Webhooks are now protected with a unique URL/ID token. After updating, every (webhook)user must copy and paste the new webhook URL into their media server.
• As always, clear your existing cache first, it’s the smartest thing you can do. In Settings - Maintenance - Maintenance tools and then Clear Everything
  • If you don’t clear your existing cache, most improvements won’t be applied. That makes all my work a complete waste....so sad..

✨ Highlights

• Progress (Experimental): Sync resume position between Plex, Emby, and Jellyfin #119
  • Configurable per pair (source from/to target), supports one-way and two-way sync
  • WIKI: https://wiki.crosswatch.app/crosswatch/configure-pairs/features/progress

🔧 Fixes & Improvements

• History Sync Reliability: #117

  • Fixed a state persistence issue that could cause history statistics to shrink after a subsequent sync run.
  • CW now preserves watched timestamps/metadata when a provider returns sparse history.
  • Improved ID reconciliation to prevent duplicate history entries when providers disagree on IDs:
    • Uses TMDb first, then falls back to IMDb, then TVDb (in that order) to match the same title across systems.
  • Two-way sync: improved safeguards so ID drift doesn’t trigger false adds/removes or inflated counts.

• Plex Instances / Profiles: Fixed an issue where Plex per-instance library whitelists)were not being saved #126

• Plex Instances / Profiles: Fixed an issue where an extra PLEX-P01 could appear in settings. #129

• Upgrade Migration: The Migrate action in the upgrade warning modal now performs a real migration for required settings. #130

• History Sync Performance (Jellyfin / Emby / Trakt): Much faster history indexing....more speeeeeeeeeeeed #125

• Provider Rate Limiting (SIMKL / Trakt / MDBList): Added configurable request throttling to respect upstream API limits. #128

• Security Enhancements: #123

  • Authentication now fails closed if `config.json exists but can’t be loaded/parsed correctly.
  • Hardened TMDb artwork caching to block path traversal / unintended file overwrite.
  • Webhook endpoints are now protected via a unique URL token generated by CW:
    • /webhook/plextrakt?uniqueID
    • /webhook/jellyfintrakt?uniqueID
    • /webhook/embytrakt?uniqueID
    • /webhook/plexwatcher?uniqueID
  • Added Trusted reverse proxies setting in Settings - Security
    • Use this only if you run CW behind reversed proxies. This will improves secure cookies and rate limiting accuracy.
  • UI logs now redact common secrets (tokens/keys) to reduce leakage.
  • TLS certificate download endpoint now only serves valid X.509 cert files
  • Improved error handling to avoid leaking internal details via API responses.
  • Stronger path validation to prevent unintended directory access via file listing.