All sessions and tokens were forcibly invalidated in this update with no backward compatibility/legacy.
- Addon origin checks now accept any
*.strem.iohost to prevent false security blocks from Stremio edge domains. - Service worker now treats session/token API calls as non-cacheable and honors server no-store headers before caching API responses to avoid persisting sensitive data.
- Config page caches are now scoped to the active session token so swapping tokens can't leak or reuse another user's saved configuration.
- Session manager fingerprints configs and backfills token metadata, deleting mismatched or corrupted sessions from storage to prevent cross-user contamination.
- Session manager now removes sessions immediately when decryption fails or yields empty configs, ensuring corrupted payloads cannot be reused across users.
- Session-token config resolutions now always bypass the in-process resolve cache, preventing stale token lookups from leaking other users' language/target settings.
- Session-token addon routers are no longer served from the router cache; routers are rebuilt per request to eliminate stale token bleed across users.
- Package version bumped to 1.4.6 so runtime version reporting and cache busting align with the release notes.
- Redis key prefixes are now normalized to a canonical colon-suffixed form while still accepting colon/non-colon/custom variants, preventing mixed-prefix splits like
stremiosession:*. - Redis migrations reuse a raw migration client, handle cross-prefix self-healing across all variants, and clean up duplicates when targets already exist.
- Redis pub/sub invalidation subscribes and publishes on both prefixed and unprefixed channels to keep cache invalidations working across hosts with different prefixes.
- Startup validation now scans for double-prefixed keys across all configured prefix variants to flag misconfigurations early.