Added
- Opt-in trusted proxy authentication with configurable user headers, strict proxy allowlisting, and existing-user mapping for Authelia-style forward auth
- Optional recovery mode and identity provider sign-out URL for trusted proxy authentication
- Administrators can rename a user, including the initial
admin, from Settings -> Users, so an account can be lined up with an SSO username without creating a duplicate
Changed
- Updated dependencies:
- Backend:
- alembic to 1.19.0
- cryptography to 50.0.0
- fastapi to 0.141.1
- granian to 2.8.1
- pydantic-settings to 2.15.0
- Frontend:
- nanoid to 3.3.18
- Backend:
Fixed
- Disk-free rules now use the mounted media volume in Docker and apply scoped path mappings before falling back to Radarr or Sonarr disk data
- Trusted proxy allowlists now reject all-address ranges such as
0.0.0.0/0, not just* - Trusted proxy authentication now fails closed when the proxy header wrapper has not recorded the socket peer
What's Changed
- Validate rating field values in the advanced rule engine by @code-boar in #321
- Refresh arr tags for rules that match tags by pattern by @code-boar in #322
- fix: treat zero-vote TMDB titles as unrated by @code-boar in #324
- chore: sync uv.lock with the project version by @code-boar in #325
- Seconds of playback by @jessielw in #326
- build(deps): bump cryptography from 49.0.0 to 50.0.0 by @dependabot[bot] in #327
- Harden trusted proxy authentication before merge by @code-boar in #329
- build(deps-dev): bump postcss from 8.5.22 to 8.5.26 in /frontend by @dependabot[bot] in #328
- Forward auth by @jessielw in #330
- Dev by @jessielw in #331
Full Changelog: 0.3.4...0.3.5