This is the first small update after the public launch! It is mostly fixes, safer defaults and some cleanup behind the scenes.
What changed:
- Fixed a race condition that could send duplicate Jellyseerr request notifications.
- Fixed Jellyseerr timestamps not consistently following APP_TIMEZONE.
- Fixed active-user counting for a Jellyfin user named "0".
- Added full tests for automatic database setup and existing-data preservation.
- Removed the old unused SQL import file. Fresh installations still create everything automatically.
- Updated Guzzle and related dependencies, with no known Composer security advisories remaining.
- Added CSRF protection and stronger validation to Web Push actions.
- Hardened the Jellyfin image proxy and API response headers.
- Stopped the initial admin password from appearing in container process arguments.
No manual database migration or configuration changes are needed.
Existing Docker installations can update by running docker compose pull && docker compose up -d.
Happy Monitoring 👀