SuggestArr v3.0.0 is the biggest release so far. The frontend has been rebuilt from scratch, and the release adds request expiry, automatic replacement of declined requests, MDBList and Trakt list imports, a personal Journey and annual Year Recap, Trakt "Seen it" sync, light/system themes with installable PWA support, and a broad security hardening of authentication and outbound integrations. Suggestions also now skip titles you already own much more reliably.
⚠️ Please read the Upgrade Notes before updating, especially if you run SuggestArr behind a reverse proxy with
local_bypass.
🎨 A Completely New Interface
- Rebuilt every screen on Tailwind CSS with a shared component library; the legacy CSS layer has been removed entirely
- Redesigned Home, Requests, AI Search, Jobs, Database, Profile, Users, Logs, Webhooks, Approvals and Connections
- Advanced settings split into dedicated pages: AI provider, Approvals, Webhooks, Cleanup and System, each with its own save
- "Services" is now Connections: required services first, optional ones side by side, with foldable service cards (TMDb, Trakt, OMDb, Seer, MDBList) and show/hide for secrets
- All modals unified on a single dialog component with consistent header, danger actions and sticky footer
- New run history: status/job filters with counts, success rate and inline expandable errors
- Native selects and date inputs replace custom dropdowns and pickers for better accessibility and mobile behaviour
- Loading skeletons, an unsaved-changes guard on settings pages and custom confirm dialogs instead of browser prompts
- Title details now show logos, backdrops, watched status and recommendation rationale, with in-place YouTube trailer playback (privacy-enhanced embed)
- Improved accessibility throughout (ARIA roles, hidden decorative icons, keyboard support)
- Smaller frontend bundle: Font Awesome, vue-multiselect, vue-toastification, core-js and cron-parser are no longer shipped
🌗 Themes & Installable App
- Added light and system themes alongside dark
- Added a service worker: SuggestArr can now be installed as an app and shows an offline notice when the server is unreachable
⏳ Seer Request Expiry
- Requests that are not fulfilled within a configurable period can now be expired automatically in Seer
- Configurable actions, validation of expiry settings, manual "run now" and an expiry log in the UI
- Documented in the installation guide
Addresses #504.
🔁 Replacement of Declined Requests
- When a request is explicitly declined in Seer, SuggestArr can now generate an alternative suggestion for the same user
- Supported by Discover and Trakt recommendation jobs
- Manual "run now" and replacement log in settings
Addresses #114.
📋 List Imports (MDBList & Trakt)
- New List import job type for public MDBList and Trakt lists, on a schedule
- New one-time import with preview, pagination, progress tracking and resume
- Added MDBList connection settings and connection test
Addresses #138.
🏆 Journey, Badges & Year Recap
- New Journey panel in the profile: requested titles, milestones, badges and hit rate (how many suggestions were actually watched)
- Badges unlock with a small celebration and can be shared
- New seasonal Year Recap stories (available from December 15 to January 31) built from recorded requests and optional Plex/Jellyfin watch activity
- Export recaps as PNG, copy or share them natively; preview with sample data
- Privacy and behaviour documented in
RECAP.md
✅ Trakt "Seen it" Sync
- Marking a suggestion as Seen it now lets the user rate it with stars
- The play and rating are sent to the user's Trakt history and ratings, per Trakt account and title, without duplicate plays
- TV shows are opt-in
Implemented in #529 by @arctus.
📥 Requests & Approvals
- Requests page gains a progress filter (requested, processing, available, watched) and media status badges
- New availability sync job that fires a webhook when requested media becomes available
- Keyboard (A/R/S) and swipe shortcuts for quick approve / reject / seen decisions
- Request stats on the Home page now show trends versus the previous period
- "Open in Seer" links use Seer's public Application URL when configured
- The sidebar request badge now refreshes after every decision
🔔 Webhooks & AI Search
- New ready-made notification formats for Discord, Telegram and ntfy
- Webhooks page redesigned with destinations, deliveries, grouped events and a secret generator
- AI Search keeps a per-user search history and offers mood-based inspiration from watched titles
- AI features are no longer marked as beta
📚 Fewer Suggestions You Already Own
- Titles already available in Seer are now excluded, covering items your media server matches only through TVDB, IMDb or AniDB
- Applies to recommendation, Discover, Trakt, Force Run and AI Search, with a single shared "already owned" policy
- Titles available only in 4K are now counted as owned
- If Seer or the media server is unavailable, SuggestArr falls back to the other source instead of failing the job
- Jellyfin library queries are now scoped to the user
Implemented in #516. Addresses #527.
🔌 Plex & Integration Fixes
- Plex friends are now read from
/api/users, since plex.tv retired/api/v2/friends - Saving a settings section no longer copies the redacted
***secret into the live configuration - Server requests always use the API key, regardless of session cookies
- Deep links work correctly under a subpath
- MySQL overview columns widened to
TEXT - Improved OMDb API key validation and error messages
Implemented in #530 by @arctus.
🔐 Security Hardening
This release fixes two security issues that were reported privately: GHSA-fcjm-xhw8-pmh5 and GHSA-7qqj-qmf8-8922. All users are encouraged to update.
- Trusted reverse proxies are now configured separately from the networks allowed to bypass login, and forwarded client addresses are resolved consistently for authentication, middleware and rate limiting
- Authentication fails closed: if the database cannot confirm whether accounts exist, SuggestArr returns
503instead of enabling setup (the login screen offers a retry) - Integration configuration, connection tests, service discovery and setup OAuth endpoints now require an administrator; personal account linking remains available to all users
- Saved credentials are bound to their destination: a redacted token can no longer be sent to a different URL
- Integration base URLs are validated, outbound requests no longer follow redirects, and public-only destinations (external avatars, webhooks without
allow_private) reject non-public addresses, including after DNS changes - Non-admin users only receive sanitized Seer profile data
⚠️ Upgrade Notes
- Reverse proxy +
local_bypass: add your proxy address(es) to the newAUTH_TRUSTED_PROXY_CIDRSsetting (e.g.10.0.20.11/32) and keep the client networks allowed to bypass login inAUTH_TRUSTED_CIDRS. Without it, forwarded requests can no longer bypass login. Direct LAN access is unaffected. - Integration URLs for Plex, Jellyfin/Emby and Seer must be complete
http://orhttps://base URLs, without credentials, query strings or fragments. Since redirects are no longer followed, use the final URL with the correct scheme. Reverse-proxy paths such ashttps://media.example/jellyfinand LAN/Docker addresses keep working. - Changing an integration URL now requires re-entering its token.
- Settings → Advanced has been split into several pages;
/dashboard/advancedredirects to the AI provider page. - Integration settings and connection tests are now admin-only.
See docs/INSTALLATION.md for the full details.
🧰 Maintenance
- Updated aiohttp to 3.14.4 (CVE-2026-111063, CVE-2026-111064, GHSA-2g87-pp6c-29x5)
- Frontend migrated to Tailwind CSS 4; unused components and dependencies removed
- Updated README and added a full feature guide
- Updated Trakt app creation and redirect URI documentation
- Improved ASGI response handling
- Extensive new backend, frontend and end-to-end test coverage
🙏 Thanks
A special thanks to the community contributors who made this release possible:
- @arctus for the Trakt "Seen it" rating and history sync, and the Plex friends and redacted-token fixes (#529, #530)
- @btarr-vc for responsibly reporting GHSA-fcjm-xhw8-pmh5
- @tonghuaroot for responsibly reporting GHSA-7qqj-qmf8-8922