CI Report:
https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-799a5f6f-ls12/index.html
LinuxServer Changes:
Full Changelog: develop-463b4279-ls11...develop-799a5f6f-ls12
Remote Changes:
Escape session fields in the get_activity output
The dashboard update tick builds the subtitle decision from the PMS
subtitle language and writes it with .html(). The endpoint returned
the session fields raw. A session whose subtitle language carries
markup executes for anyone who has the dashboard open. Apply the
same @sanitize_out() the sibling endpoints already use. The track
card titles and the raw stream info modal read the same fields with
.text(). Switch those to .html() so escaped entities still render.
Pin the escaping in a regression test.
Closes GHSA-33vr-q476-8wgg.
Co-Authored-By: Claude Opus 5.5 noreply@anthropic.com