getmydia/mydia v0.14.0-beta.3

on GitHub

17 PRs since v0.14.0-beta.2. This build closes a round of security findings in authentication, the p2p node and the shared metadata relay, so prefer it over beta.2. Two migrations, both small.

Security

• Close a privilege escalation path, forgeable tokens and unthrottled login in authentication (#544)
• Bound two unauthenticated memory-exhaustion leaks in the p2p node (#544)
• Close four unauthenticated abuse paths in the shared metadata relay (#544)
• Mount the Ecto SQL sandbox plug in test only, so a running server never carries it (#539)

Server

HDR

• Quality now stores a canonical HDR base plus a separate Dolby Vision profile. HDR files were scoring below SDR in quality profiles, and a null hdr_format was read as SDR (#543)
• Separator-form HDR10+ is recognised, so an untagged release stops being classified as SDR (#543)
• Dolby Vision profile fields are exposed over GraphQL, with hdrFormat kept as a display string (#543)
• A one-shot backfill worker recomputes HDR on files already in the library (#543)

Subtitles

• The subtitle format is read from the file content, and the stored format is what the file actually is (#532)
• The download button no longer crashes the media page, and auto-download shares the manual download path (#532)
• Search results rank by release-name match against the file on disk, with the score explained as a factor breakdown in the UI (#545)
• Malformed and negative result indexes are rejected on download (#532)

Downloads

• New per-client External torrents mode. A torrent adopted from the client that falls outside the policy is routed to External rather than Issues, badged, and recorded as a download.adopted activity event (#535)
• DownloadStatus reports torrent categories and labels, and Transmission writes the configured category as a torrent label (#535)
• EXTERNAL_TORRENTS parses as a fixed enum (#535)

Streaming

• The client's device profile is honoured on the remux and auto-detect paths, and empty device-profile codec entries are rejected (#541)

Player

• The app probes a device profile, sends it on every request and trusts the server's per-device direct play answer. The profile travels over the p2p GraphQL transport too (#541)
• The subtitle button stays alive in direct play on iOS, with tracks derived from both sources (#548)
• Sidebar edit mode: reorder entries, reset to defaults behind a confirmation, and exit when the drawer closes (#540)

Web UI

• The library picker is a page-level dialog and works inside scrolling rails and on detail pages (#536, #537)
• Adding from a detail-page rail honours the chosen library, and a malformed library target is rejected rather than silently defaulted (#537)
• The subtitle search dialog has a mobile shell, and the release score breakdown is reachable on touch (#546)

Release and development

• The changelog's Player section is sent to TestFlight as store release notes, falling back to player commit subjects on a prerelease (#533)
• The browser suite drops from 24 tests to 4, with route, role and login coverage moved down to ConnTest and LiveViewTest, and sleeps forbidden (#542)
• The npm DaisyUI source is explicit and the stale vendored copy is gone (#547)
• metadata-relay dependencies updated, and metadata-relay v0.14.0 released (#549, #550)

Upgrade notes

1. Two migrations. One adds external_torrents to download client configs, one canonicalises hdr_format on existing files (#535, #543).
2. HDR files are re-ranked. A file previously stored with a Dolby Vision or untagged HDR format may now sort differently against your quality profiles, and a one-shot backfill runs at boot to recompute it. Expect some items to be re-evaluated for upgrade (#543).
3. Security fixes are the reason to take this build. Authentication, the p2p node and the shared relay all had unauthenticated paths closed (#544).

Full Changelog: v0.14.0-beta.2...v0.14.0-beta.3