This release adds Simkl watch-history integration, Trakt ratings import, support for MDBList official lists, and reverse-proxy (SSO) sign-in configurable from the UI, together with a broad security hardening pass on accounts, permissions and jobs, fixes for AI Search and Cleanup, and dependency updates.
📺 Simkl Watch-History Integration
- Added Simkl as an optional per-user watch-history source, alongside Trakt
- Users link their own Simkl account from Profile → Simkl Account with Simkl's device PIN flow, so no redirect URI or client secret is needed
- Admins only add the app-level Simkl Client ID in Services → Simkl
- Simkl history is cached locally and can be used as seeds and exclusions in recommendation jobs
- Titles reported by both Trakt and Simkl are merged instead of counted twice
- Added a Recent Simkl preview and Simkl options in recommendation jobs
- Plex server owners who link through plex.tv are now matched to their server account, so their history and links resolve correctly
- Simkl tokens are never exposed in API responses or the frontend
Implemented in #495 by @markusmo3. Addresses #128.
⭐ Import Ratings from Trakt
- Recommendation jobs can now use titles rated on Trakt, including ratings synced into Trakt from streaming services
- Added a Use Trakt ratings option to recommendation job filters
- Ratings set in SuggestArr take precedence over imported ones
Addresses #537.
📋 MDBList Official Lists
- Import List jobs now accept official MDBList lists, such as
https://mdblist.com/lists/official/movies/popular - Improved URL parsing and media-type filtering for official lists
Addresses #542.
🔑 Reverse Proxy (SSO) Sign-In from the UI
- Sign In Through Reverse Proxy (SSO) can now be selected in Settings → Advanced → Access & routing
- The proxy address, username header and automatic account creation can be configured from the same page
- Saving settings no longer switches a configured SSO setup back to Require Login
- Password sign-in keeps working when the proxy header is missing, so a misconfigured proxy cannot lock admins out
- Environment variables still work and take precedence
🛡️ Security Hardening
- Admin-only data: config export, application logs and the cleanup log now require the admin role (GHSA-f2r6-9fm5-8743)
- Account linking: Jellyfin and Emby accounts can now be linked only with the account's password. The old endpoints, which accepted any user id, were removed
- Jobs and AI Search: jobs and AI searches of regular users now only use their own linked media accounts. Before, a job with no user selection scanned every user's history and could request in other people's Seer names
- Page permissions: pages an admin removes from a user are now enforced by the server for job actions and AI Search, not only hidden in the UI
- Reverse proxy: with the default whole-network trusted ranges, the SSO header is now accepted only from localhost
- Sessions: changing your password now signs out your other sessions; the current browser stays signed in
- Plex sign-in: PINs are bound to the user who started the sign-in, expire after 30 minutes and can be used only once
- AI Search: only display metadata is stored for requested titles, so one user can no longer overwrite another title's details. Error messages no longer expose internal details
🤖 AI Search & Filter Fixes
- Fixed searches and jobs returning no results when the language filter was stored as a single string (
'en' not in selected languages: e, s) - Fixed TV requests from AI Search sending the TMDb id as the TVDB id, which could add the wrong series in Sonarr
Addresses #546.
🧹 Cleanup Safety
- Cleanup now stops and deletes nothing when favorites cannot be read from Jellyfin or Emby. Before, a failed read was treated as "no favorites", so favorited titles could be deleted
- The Cleanup page now explains whose favorites protect a title: the server owner's 5-star rating on Plex, and the selected users' favorites on Jellyfin and Emby
⚠️ Upgrade Notes
- Reverse proxy (SSO) users: if your proxy runs in another container or on another host and you never set the trusted address, set it in Settings → Advanced → Access & routing (or
AUTH_TRUSTED_CIDRS). Until then, sign-in through the proxy fails; password sign-in still works - Regular users' recommendation jobs now only use their own linked account. Jobs of users with no linked account are skipped with a message; link one from Profile
- Removed API endpoints:
POST /api/users/me/link/jellyfinandPOST /api/users/me/link/emby. Use/api/integrations/<provider>/link, which the UI already uses - Users without the Jobs or AI Search page now get
403from the related API actions
🧰 Maintenance & Dependencies
- Updated Python dependencies: asgiref 3.13.0, concurrent-log-handler 0.9.31, mysql-connector-python 26.10.0, openai 3.37.0
- Updated frontend dependencies: Vite 8.3.5, swagger-ui-dist 5.34.0
- Updated GitHub Actions: actions/setup-python 7.1.0, docker/login-action 4.7.0
- The Docker image now includes the app version for the backend, which the Simkl API requires
- Expanded automated coverage for Simkl, Trakt ratings, account linking, permissions, sessions, Cleanup and the access settings page
Dependency updates include #543, #544, and #545.
🙏 Thanks
A special thanks to the community contributors who made this release possible:
- @markusmo3 for the Simkl watch-history integration (#495)
- @NotAFlightRisk for responsibly reporting the admin-endpoint authorization issue (GHSA-f2r6-9fm5-8743)