v1.4.9 - requests that close on what reached your library, downloads that arrive whole, one naming rule everywhere, and a first run that knows what to do next
🚀 Highlights
- Requests that close on what actually reached your library: one night in #240 the same pack was downloaded three times, ten requests sat in Downloading for hours, and every request on a pack was marked Completed - "available" alert and all - the moment the pack was handed to the watched folder, before anything was imported. Now a request remembers which issue it's for, so a pack is downloaded once instead of again on every monitor cycle, and a request that meets a link another request already finished is closed instead of parked forever. A pack handed to the watched folder leaves its requests at a new Importing status until the sweep reports what landed: Completed with the "available" alert when the issue is in the library, or a new Needs Review status, with an "Import Needs Review" alert, when it went to /unmatched. A Smart Matcher match closes a Needs Review request, and nothing waits longer than 6 hours - System Health flags anything that does. (#240; PRs #246, #247, #248 by realAbitbol)
- The request someone is waiting on is searched first: one worker runs every background job in turn, and searches used to stand in one line with each other and in front of the scheduled jobs - the watched-folder trigger ran up to three hours late behind a search backlog. Now the scheduled jobs go first (PR #249 by realAbitbol), then searches by who is waiting: a single issue someone requested or an admin approved, then whole-series requests, reading-list imports and automatic retries, then the Series Monitor's own searches. A request made right after a monitor run starts within a search or two instead of behind hundreds. The 5-second spacing between searches is kept, and an admin's page sweep takes turns with the requests people made instead of holding them up. (#240)
- Downloads that arrive whole: a 1.2 GB pack that arrived cut short used to be imported as one issue with 0 pages. The engine now checks the HTTP status, compares the bytes it received with what the server announced, resumes only from the exact byte where the file ends, and opens a ZIP's index before accepting it - a cut-off download resumes, a bad resume starts over, and a corrupt file moves on to the next hoster. The importer refuses an archive it can't read: nothing is filed, the release is blocked and the request searches again - and it no longer loads a whole pack into memory to look inside it. (#240)
- One naming rule everywhere, with issue-number padding: choose how issue numbers are padded under Settings → Library & Files → Issue Number Padding (none, 2 or 3 digits; 3 by default), and every way a comic arrives - downloads, the watched folder, the Smart Matcher, manual links, collected editions - now names it the way Standardize does, so a new file is never renamed by the next Standardize. {IssueYear} is the issue's own year instead of the year its series started ("X-Men #38 (2026)", not "(2024)"), no token is left in a name as literal text, and an unknown year no longer becomes "(0000)". (#243, #244, reported by anacronismo)
- A first run that knows what to do next: the README's Installation is five steps from an empty folder to the Setup Wizard, and a new First Steps section covers reading what you have, getting new comics, where files go, and what to check when a download reaches 100% but never shows up. In the app, the static "Welcome to Omnibus!" banner is now a live setup checklist - library folder usable, metadata key, comics in the library, Discover synced - with the button that does each step, and it goes away for good once they're done. An empty Library says what to do next, and users who aren't admins get a hint too. (#245, reported by parkinsonanthony378-ui, and newcomers on the Discord)
- New installs run their scheduled jobs: since April, a new install ran no library scan, metadata sync, Series Monitor, backups, diagnostics or Discover sync until someone pressed Save on Admin → Jobs - while that page showed them as scheduled. They now run on the schedule the page shows. Turning Auto-Convert CBR/RAR off now really stops the scheduled conversion sweep.
- Folder paths the server can't use are caught: a library saved as a Windows path like C:\Comics under Docker (the "EACCES: permission denied, mkdir 'C:'" error), a path with a stray space, or a folder nothing is mounted at is turned away when you save it, with the folder and the fix named - and the Settings examples are container paths now. The engine never writes under such a folder (it used to file comics inside its own container, where the next update deletes them), the Smart Matcher and System Health name the problem, and a restore lists the folders to fix. (reported on the Discord)
- Security: a series folder always stays inside the library. A volume request - which any user with the Request permission can make - could carry a name, publisher or year that put the series' folder at the library root or outside the libraries, and "Delete series + files" then removed whatever folder was stored. Both are closed, and the per-library access check no longer lets a user granted one library reach another through "..".
- October security round: sharp (a high-severity advisory in its bundled librsvg - sharp draws every cover thumbnail), source-map-js (high), Next.js (two moderate cache-poisoning advisories), follow-redirects (high: credential headers could survive a cross-origin redirect) and sanitize-html (three advisories in the library that cleans provider descriptions) move past their advisories, so the production audit is back to zero, inside the image too. The engine's TLS stack moves past six: four in rustls, and certificate-trust fixes in rustls-webpki and webpki-roots.
- The Smart Matcher closes requests properly: a match that puts a requested issue on disk closes the request with the "available" bell and the Comic Available alert on Discord, email, Pushover, Telegram and Apprise - one alert per requester, listing their issues.
🛠️ More fixes and improvements
- An admin can stop impersonating: a "Viewing Omnibus as … · Stop impersonating" bar on every page, signing out ends it for good, and the session keeps the admin's own name and idle window
- Admin pages found in a permission sweep: the Trophies page works (it called a route that never existed), the API Guide's tester tests a key you paste, bulk approve / deny / retry / cancel / mark read report what failed instead of always "success", denying several issues of one series no longer fails, and the Library list view's Edit Metadata is admin-only
- A search for "TMNT: The Last Ronin #1" keeps GetComics' "Teenage Mutant Ninja Turtles - The Last Ronin #1" (and the other way round): acronyms now count on both sides of the relevance filters
- A file moved into /unmatched never replaces one already there - the second is kept as "(copy N)" - and uploads use the same naming, so the Smart Matcher still reads the right issue number
- Every archive write (ComicInfo embed, CBR conversion, page removal, cover insertion, watched-folder move) builds in a temp file of its own, so two writers of the same comic can't truncate each other's half-built archive, and a failure cleans up after itself
- One watched-folder sweep at a time: a trigger that lands during a sweep becomes one more sweep after it, never a second sweep beside it (#240)
- The Smart Matcher's hourly sweep walks the whole unmatched backlog instead of stalling on the same 100, and Auto-Scan retries only real errors (#226; PR #231 by dissentingd)
- Matching a series that relocates its folder repoints every issue whose file moved - never a same-named file left behind (#225; PR #230 by dissentingd)
- A series' book type comes from its files' own tag, the one-shot guess works again for volumes at least two years old, and series.json's "Print" default is marked as a guess so it's never read back as fact (PR #233 by dissentingd)
- Genres from ComicVine drop its cover and variant tags, and the noise already stored is cleaned on the series' next metadata sync (PR #241 by dissentingd)
- ComicVine's HTTP 420 burst limit is handled as the rate limit it is at every call site (PR #242 by dissentingd)
- Windows checkouts build working images: shell scripts stay LF (#223; PR #228 by dissentingd)
- Every page credits ComicVine and Metron in the footer, with Metron's CC BY-SA 4.0 license and a note that covers belong to their publishers; the README spells out both providers' terms, including how a donation raises Metron's daily limit
- Paperback 0.9: its Komga extension can save its server settings and link its read-status tracker - Omnibus now answers the "who am I?" check it makes (it crashed with "e.violations.map" before). On Paperback 0.9, use the Komga extension: the built-in Paperback source can't be linked as a tracker there, so it never sends finished chapters back (reported on the Discord)
- Paperback: the Komga endpoint logs each chapter Paperback reports (and, at debug level, each page it loads) - the groundwork for filling Continue Reading from Paperback
- Includes the v1.4.7 and v1.4.8 hotfixes: regular users stay signed in, and users who sign in with a password can request again
📦 Upgrading
Standard three-service compose: docker compose pull && docker compose down && docker compose up -d - update the web app and the engine together. Schema changes are additive (the issue a request is for, and an import handoff table) and apply automatically on boot; SQLite and PostgreSQL both covered. Requests gain two statuses, Importing and Needs Review. No new environment variables.
- Scheduled jobs: if you never pressed Save on Admin → Jobs, the jobs shown there start running on their default schedule - library scan every 12 hours; metadata sync, Series Monitor, Discover and cache cleanup daily, and the CBR sweep daily while Auto-Convert is on; diagnostics and backups weekly; the weekly digest only once email is set up. Expect more activity on the first day. Anything you saved, including Off, is kept.
- Folder paths: Settings won't save a library Root Path, Download Scan Root or download client Local Path the server can't use, and a library Root Path that doesn't exist now stops imports instead of being created. Check System Health after upgrading.
- File names: new files are padded to three digits ("#1") by default; choose 2 digits under Settings → Library & Files → Issue Number Padding to keep "#1". After one Standardize nothing else changes for plain, decimal and negative numbers; names with a letter or a fraction, and files of a series with no year, are renamed once.
- Requests created before this release don't store their issue number and fall back to their name; a request already waiting on the watched folder is judged by the new Importing flow.
- An impersonation that is running during the upgrade ends; start it again if you need it.
Thanks to realAbitbol for four pull requests (#246-#249) and the #240 report behind them - a night of logs that found four separate problems; to dissentingd for six pull requests (#228, #230, #231, #233, #241, #242) and the issues behind them; to anacronismo for #243 and #244; to parkinsonanthony378-ui for #245; to the Discord users whose reports became the folder-path checks, the First Steps section and the setup checklist, and to the Paperback user who keeps testing; and to Metron for its guidance on crediting the data.