technomancer702/nodecast-tv v2.2.1 on GitHub

This release improves playback, subtitle selection, guide reliability, and account security across Live TV, movies, and series.

Playback and subtitles

Fixed duplicate subtitle entries and selections that enabled a track without working subtitles in Live TV and VOD.
Preserved distinct SDH, Forced, and closed-caption options. Subtitle choices now reset correctly between streams, and Off disables captions reliably.
Improved AAC and mixed-audio remuxing, encrypted HLS playback, FFmpeg HTTP handling, and maximum-resolution settings.
Improved movie and episode duration displays, resume behavior, and seeking during transcoded playback.
Reduced abandoned FFmpeg processes during rapid channel changes, stopped playback, and page exits. Added bounded playback-session limits and live-stream retries.
Improved startup responsiveness by streaming proxied media progressively, with better handling of redirects, range requests, and disconnects.

Failed EPG refreshes now preserve the previous guide until a complete replacement is ready.
Fixed XMLTV timestamp handling, channel ID collisions, and missing programmes during large imports.
Prevented concurrent database updates from overwriting each other and protected the last administrator account.
Added Docker readiness checks and excluded local credentials, data, and build artifacts from container images.
Expanded automated coverage with real FFmpeg playback, browser subtitle checks, and Docker smoke tests.

Browser authentication now uses HttpOnly cookies, with persistent installation secrets and stronger logout and password-change handling.
Media requests require authentication, and transcode sessions are isolated by account.
Restricted shared configuration changes to administrators and added cross-site request checks and login/media request limits.
Hardened stream and subtitle URL validation and FFmpeg protocol restrictions, and reduced exposure of provider credentials in logs.

Sign in again after upgrading. Existing accounts and settings are retained.
Keep the persistent data directory, including security.json, across restarts and container upgrades.
If an IPTV provider runs on localhost, set ALLOW_LOCAL_MEDIA_URLS=true. Providers on ordinary LAN addresses remain supported.
For reverse-proxy deployments, review APP_ORIGIN, TRUST_PROXY, and AUTH_COOKIE_SECURE in the README.

Thanks to MikaelKW and the upstream contributors whose work helped improve this release.