Releases: seerr-team/seerr
Releases · seerr-team/seerr
Release list
Release v3.4.1
Release v3.4.0
3.4.0 - 2026-07-28
This release patches a path traversal vulnerability in the avatar image proxy.
Exploitation vectors:
- A malicious or compromised Jellyfin/Emby media server returning a crafted HTTP response.
- A man-in-the-middle attacker intercepting the connection to the media server, if it is configured over HTTP instead of HTTPS (the default setting).
🛡️ Security
- Patch GHSA-mc6w-69r3-62h8 - Path Traversal leading to Remote Code Execution vulnerability (in seerr's ImageProxy) - (f484791)
🚀 Features
- (PlexImportModal) Add user details sync functionality (#2977) - (902b88e)
- (api) Support
userIdwhen creating issues (#3100) - (5f2722d) - (external-links) Add Simkl media link (#3121) - (5ae70d0)
- (notifications) Add Discord thread ID support (#3065) - (6e9ba06)
- (requests) Allow admins to bypass user quota limits (#2026) - (72536da)
- Allow to disable version check (#3137) - (73937c0)
- Add jellyfin/emby quick connect authentication (#2212) - (74c8db4)
🐛 Bug Fixes
- (availability-sync) Prevent false removals for merged-version Plex items (#3224) - (46d8033)
- (discover) Use added sort in recent requests slider (#3202) - (8ccd0f6)
- (email) Respect hosts file for SMTP connections (#3082) - (b660201)
- (i18n) Fallback to server locale for "Default" user lang in notifs (#3190) - (ef9edc8)
- (next) Add next-env.d.ts to .gitignore (#3282) - (3279393)
- (notifications) Make the Discord IDs available even when the notification is disabled on Seerr (#3139) - (a8f1780)
- (proxy) Proxy clients built before proxy init (#3196) - (8ad191f)
- (scanners) Decline orphaned requests when media is removed from servarr (#3191) - (2e0e4ce)
- (subscriber) Await request status updates (#3223) - (f481b56)
- (ui) Revalidate request list after approving or declining a request (#3283) - (e810b98)
- (webpush) Guard subscriptions request until user loads (#3113) - (6829850)
- Support for IPv6 address literals in HOST env var (#2614) - (0adbf50)
- Prevent cross-instance external ID collisions (#3203) - (8e02d92)
- Close manage movie sidebar without back reopening (#2590) - (0a1f703)
- Availability sync demotion and orphan season rollup edge cases (#3148) - (784faa9)
📖 Documentation
- (blog) Rootless design and PUID/PGID rationale (#3105) - (bf5323f)
- (blog) Fix "monitorNewItems" feature description and previous post author (#3103) - (4e7a227)
- Update truenas migration section to include chown (#3143) - (ebac489)
- Add TrueNAS migration guidance (#3107) - (8b062ed)
⚙️ Miscellaneous Tasks
- (actions) Update github actions (#3041) - (0438710)
- (dev) Add devenv setup (#3138) - (d2ffe4f)
- (i18n) Update translations from Weblate - (4b65ab5)
- (i18n) Update translations from Weblate - (1926095)
- (i18n) Update translations from Weblate - (d051deb)
- (i18n) Update translations from Weblate - (8d351bc)
- (i18n) Update translations from Weblate - (3f33842)
- (i18n) Update translations from Weblate - (6c8527f)
- (i18n) Update translations from Weblate - (ab26f06)
- (i18n) Update translations from Weblate - (0a305f6)
- (i18n) Update translations from Weblate - (32249f2)
- (i18n) Update translations from Weblate - (2a249a8)
- (release) Prepare v3.4.0 - (2dbe886)
- (release) Prepare 3.4.0 release - (b21049a)
New Contributors ❤️
- @aaamoeder made their first contribution
- @kouellette made their first contribution
- @u61d made their first contribution
- @thraizz made their first contribution
- @john-fletcher made their first contribution
- @Gilmoursa made their first contribution
- @atoy3731 made their first contribution
- @nightt5879 made their first contribution
Contributors
atoy3731, john-fletcher, and 6 other contributors
Assets 2
Release v3.3.0
3.3.0 - 2026-06-02
🚀 Features
- (db) Add DB_POOL_SIZE environment variable for postgres connection pool (#2990) - (f093c69)
- (i18n) Add server-side i18n for notification agents (#2731) - (cd257ba)
- (notification) Add support for public seerr logo in email (#3036) - (a8f147d)
- [breaking](notifications) Support multiple Discord IDs (#2712) - (63175f5)
⚠️ This change updates the webhook fielddiscordIDfrom astringintodiscordIDs, a list of stringstring[].
- Add plex media ratingKey and ratingKey4k to webhook payload and… (#1812) - (9b7b50b)
- Add route to fetch user by jellyfin id (#2074) - (15296a0)
- Filter out "Thanks" credits when looking at a person's credits (#2370) - (d024849)
🐛 Bug Fixes
- (auth) Drop popup.closed check in Plex pin poll (#2941) - (ce9643c)
- (availability-sync) Detect deleted seasons when media server retains empty season metadata (#2850) - (9c34864)
- (discover) Preserve keyword filter input focus after selection (#2962) - (32169d9)
- (docs) Enable trailingSlash to prevent 404 flash on direct navigation (#3039) - (df105b8)
- (docs) Switch to SWC minimizer to fix broken runtime bundle - (d88242f)
- (docs) Bump openapi docs packages to 5.0.2 (#3027) - (080c68a)
- (entity) Set the default value of UpdateDateColumn to CURRENT_TIMESTAMP (#2913) - (86e780e)
- (external-link) Replace TMDB ID with IMDB ID for Trakt links (#2934) - (f078da8)
- (imdbRadarrProxy) Pass headers and nodeCache as options instead of params (#2900) - (7861db4)
- (issuedescription) Fix issue display lists in IssueDescription (#2972) - (ce47cfb)
- (media) Clean up watchlist on error card delete (#3073) - (ee915b9)
- (media-request) Remove cascade from modifiedBy to prevent user column wipe (#2911) - (2dfea0c)
- (ntfy) Save priority field as number instead of string (#3096) - (2fa535d)
- (ntfy) Remove undefined fields from ntfy payload (#2931) - (377bf65)
- (override-rules) Use find() instead of index lookup for service resolution (#2903) - (5fdedb1)
- (plex-watchlist-sync) Handle MediaContainer.Video fallback in watchlist sync (#2992) - (99f8520)
- (request) Restore media status correctly when deleting requests (#3064) - (ff88d52)
- (scanners) Reset orphaned processing media from deleted Radarr/Sonarr entries (#2757) - (198e4e5)
- (scanners) Ignore unknown seasons in availability rollup and skip empty placeholder seasons (#2958) - (ce51f6a)
- (search) Replace "TV" with "Series" in search placeholder (#3067) - (c04172a)
- (slider) Add async to spring animation (#2978) - (5267611)
- (tag) Use inset ring to avoid clipped outlines (#2985) - (cf87205)
- (tvrequest) Allow special episodes when partial series requests are disabled (#2973) - (b32ab02)
- (users) Correct auth middleware for web push subscription (#3005) - (bd27f2d)
- (watchlistsync) Re-request deleted media from watchlist (#3072) - (2588e49)
- Update series status to partially available when seasons are missing (#3044) - (4ed29cf)
- Add missing "key" to React arrays (#3043) - (4fa2c71)
- Send availability notification if media is available before approval (#2819) - (d426e1e)
- Normalize webhook payload encoding to support raw JSON inputs (#2641) - (5b45806)
📖 Documentation
- (blog) Add v3.3.0 release blog post (#3098) - (759e359)
- (fail2ban) Add fail2ban documentation (#2894) - (39e9f1f)
- (nixpkgs) Add documentation for nixpkgs 26.05 (#3089) - (5fc7a40)
- Add REST API documentation (#2981) - (7aa1470)
- Add Terraform/OpenTofu provider page (#2967) - (811126d)
🚜 Refactor
- (docs) Move REST API docs to navbar and dedicated sidebar (#3040) - (08b7bd4)
- (logs) Align failed login attempt message with failed sign-i… (#2914) - (3e4bf1b)
- Replace react-toast-notifications with react-hot-toast (#3004) - (dfde4d3)
⚙️ Miscellaneous Tasks
- (actions) Update github actions (#3028) - (6bb402a)
- (actions) Update github actions (#2982) - (20dbc30)
- (actions) Update github actions (major) (#2947) - (952261b)
- (actions) Update taiki-e/install-action action to v2.75.18 (#2961) - (d50bdad)
- (actions) Update github actions (#2945) - (60a2a87)
- (create-tag) Add gh token to avoid api rate limit in tag version retrieval (#2886) - (85bfdb2)
- (i18n) Update translations from Weblate - (73fcfd2)
- (i18n) Update translations from Weblate - (788311a)
- (i18n) Update translations from Weblate - (6eb43e0)
- (i18n) Update translations from Weblate - (656e33f)
- (i18n) Update translations from Weblate - (4742018)
- (i18n) Update translations from Weblate - (2d4cd03)
- (i18n) Update translations from Weblate - (3c249c7)
- (i18n) Update translations from Weblate - (4e4e673)
- (i18n) Update translations from Weblate (#2906) - ([6513915](https://github.com/seerr-tea...
Contributors
kyle-engler, death2all110, and 10 other contributors
Assets 2
Release v3.2.0
e4ee71a
This commit was signed with the committer’s verified signature.
3.2.0 - 2026-04-15
🚀 Features
- (blocklist) Add support for collections (#1841) - (993ae4c)
- (discover) Handle errors gracefully when content is available (#1542) - (7920970)
- (i18n) Add Estonian language support (#2611) - (56b79ff)
- (i18n) Add Luxembourgish language support (#2671) - (dccdc95)
- (i18n) Add Vietnamese language support (#2670) - (40edaea)
- (jellyfin) Allow Jellyfin Guids with dashes for import-from-jellyfin endpoint (#2340) - (3557745)
- (notifications) Add ntfy markdown formatting (#2602) - (77f2c13)
- (notifications) Webhook custom headers (#2230) - (3152f72)
- (notifications) Add priority setting for ntfy agent (#2306) - (61e0377)
- (person) Add tmdb- and imdb link on person detail page (#2136) - (fb2ee7c)
- (quota) Added support for unlimited quota days (#2797) - (6d8b2b7)
- (requests) Mark requests as failed when Radarr/Sonarr unreachable (#2171) - (c23117e)
- (settings) Add blocklist region and language options (#1802) - (ff469cb)
- (settings) Add help tooltips for services setup (#2662) - (f5115da)
- (sonarr) Add monitorNewItems option to sonarr settings & modal (#2071) - (5c34c91)
- (trending) Add filter options (#2137) - (4ce0db1)
- (ui) Add loading state to request approve/decline buttons (#2815) - (bd8f2d4)
- (userlist) Add sortable columns to User List (#1615) - (eaf397a)
- (webhook) Add imdbid to webhook notification (#2658) - (2432e8d)
- Sort quality profiles ASC in request and service configuration (#1805) - (25e376c)
- Add trailing whitespace warning on login username field (#2040) (#2177) - (636dcb9)
🐛 Bug Fixes
- (auth) Resolve Plex OAuth client ID mismatch (#2746) - (15b3109)
- (email) Correctly classify final MIME header in PGP email encryption (#2618) - (9ec3d58)
- (email) Preserve newlines in PGP key textarea fields (#2617) - (835e917)
- (emby) Use static version in auth header for emby only (#2821) - (fe2c041)
- (entities) Replace MySQL-only onUpdate with @UpdateDateColumn (#2823) - (0b8f872)
- (generate-password) Await setPassword to fix race condition (#2845) - (061121c)
- (issues) Update issue timestamp when adding comments (#2616) - (a16d046)
- (jellyfin-scanner) Add TheMovieDb provider fallback for Jellyfin scanner (#2605) - (10f23f0)
- (login) Resolve stuck transition when switching login forms (#2779) - (735ec47)
- (media) Exclude null mediaAddedAt entries (#2607) - (001f6b1)
- (migration) Repair postgres blocklist id sequence (#2686) - (f40323c)
- (movie,tv) Respect display language for trailers (#2674) - (90d407d)
- (open-api) Add missing mediaType query parameter to blocklist and watchlist (#2722) - (c7185d4)
- (override-rules) Remove users from
useEffectdependency array (#2771) - (be57997) - (overseerr-merge) Sanitise corrupt quota values during overseerr migration (#2863) - (43eff25)
- (plex) Set 4K Plex URLs whenever ratingKey4k is set (#2635) - (1548948)
- (proxy) Add path validation guardrail to imageproxy (#2531) - (e086081)
- (region-selector) Prevent empty region reporting during sync (#2636) - (fbfcb43)
- (request) Record modifiedBy on retry and add route tests (#2824) - (20ccd4b)
- (request) Correct delete permission check and await movie save (#2742) - (6aeab38)
- (requests) Mark requests as completed when media is already available (#2462) - (d25d0ca)
- (settings) Persist new settings defaults to disk on startup (#2884) - (66130be)
- (settings) Serialize settings writes and prevent partial overwrites (#2696) - (6c52a2f)
- (settings) Remove beta info banner (#2615) - (fece753)
- (setup) Fix Plex login not proceeding after authentication (#2596) - (1dc5154)
- (watchlist-sync) Handle empty watchlists on PostgreSQL (#2718) - (865396f)
- Improve local login UX (#2849) - (aef2481)
- Await missing repository saves (#2760) - (1bb638e)
- Helm chart liveness and readiness probe (#2755) - (4434c45)
- Disambiguate tmdb ids by media type across lookups (#2577) - (0be1896)
- Anchor streaming service filter check icon to each provider card (#2634) - (94ccd47)
📖 Documentation
- (contributing-guide) Fix a typo (#2807) - (6f9b743)
- (docker) Replace backslashes by backticks in windows docker run commands [skip-ci] (#2557) - (40e02bb)
- Clarify Docker volume creation instructions on fresh Windows install (#2861) - (a133930)
- Move network-related docs to a dedicated tab (#2791) - (5bbdc52)
- Promote Nixpkgs as an official installation method (#2775) - (05ad60c)
- Fix PM2 start command syntax (#2713) - (5373da4)
🚜 Refactor
- (imageproxy) Reduce noisy image cache logging (#2789) - (036d000)
- (notifications) Move event from author to title field in Discord Embed (#2119) - ([a2d1e1b](a2d1e1b06fe82ba4ee731e36...
Contributors
redondos, leereilly, and 19 other contributors
Assets 2
Release v3.1.1
3.1.1 - 2026-04-13
This update addresses a critical security vulnerability discovered in one of our core dependencies (axios).
This is not the same vulnerability where axios was hijacked.
🛡️ Security
- Patch CVE-2026-40175 - Unrestricted Cloud Metadata Exfiltration via Header Injection Chain - (3ca6422)
🐛 Bug Fixes
- (imageproxy) Type axios instance - (74100e9)
Release v3.1.0
3.1.0 - 2026-02-27
🛡️ Security
- Patch CVE-2026-27707 - Unauthenticated account registration on Plex-configured Seerr instances via Jellyfin authentication endpoint - (4ae2068)
- Patch CVE-2026-27793 - Broken Object-Level Authorization in User Profile Endpoint Exposes Third-Party Notification Credentials - (4f089b2)
- Patch CVE-2026-27792 - Missing authentication on pushSubscription endpoints - (946bdecec)
🚀 Features
- (helm) Use an existing PVC as config volume (#2447) - (8f0c904)
- (servarr-api) Make Servarr API request timeout configurable (#2556) - (3bcb4da)
- Self-host font for better privacy (#2540) - (10ea21b)
🐛 Bug Fixes
- (helm) Add "v" as prefix for appVersion tag (#2445) - (04b9d87)
- (jellyfin-scanner) Include unmatched seasons in processable seasons (#2538) - (68f56d2)
- (link-account) Fix error-message override (#2547) - (b843be0)
- (plex-scanner) Add TVDb to TMDB fallback in plex scanner (#2537) - (7c60a5c)
- (radarr) Trigger search for existing monitored movies without files (#2391) - (55776ea)
- (servarr) Increase default API timeout from 5000ms to 10000ms (#2442) - (b499976)
- (sonarr) Use configured metadata provider for season filtering (#2516) - (5013d1d)
- (watch-data) Use sentinel values to avoid invalid SQL syntax (#2552) - (947f70c)
- (watchlist-sync) Correct permission typo for TV auto requests (#2488) - (e0e4b6f)
- Preserve blocklist on media deletion & optimise watchlist-sync (#2478) - (9da8bb6)
🚜 Refactor
📖 Documentation
- (synology) Add installation guide via SynoCommunity (#2503) - (0e636a3)
- (truenas) Update install/migration guide (#2491) - (dc1734d)
- (unraid) Improve unraid migration guide (#2470) - (5e64d49)
- Update Unraid install and migration guides with dual permission methods (#2532) - (a0d0eb1)
- Add a warning in migration-guide for third party installation (#2527) - (7e9dff3)
- Remove double quotes (") from DB_HOST environment variable (#2514) - (fa905be)
- Add Unraid installation and migration guide (#2440) - (b6a9132)
- Fix migration guide title (#2425) - (39ae32f)
⚡ Performance
⚙️ Miscellaneous Tasks
- (changelog) Fix changelog template (#2431) - (c2977f6)
- (eslint) Add react/self-closing-comp (#2563) - (cd8b386)
- (github) Add docs and maintenance issue templates (#2467) - (cf4883a)
- (helm) Add GatewayAPI route support to helm chart (#2544) - (3a42f59)
- (helm) Update ghcr.io/seerr-team/seerr ( 3.0.0 → 3.0.1 ) [skip-ci] (#2441) - (87fb0df)
- (husky) Fixed husky commit message from bash/zsh syntax to sh syntax (#2572) - (a00c9e5)
- (release) Prepare ${TAG_VERSION} - (94a70bb)
- Updated the Contributing and Security guides to reflect our current practices (#2579) - (0d40a42)
- Disable nextjs telemetry (#2517) - (cecdd63)
- Update contributing guide regarding Automated AI Agent (#2518) - (880fbc9)
- Remove discord notification from release (#2501) - (fba20c1)
- Add create-tag workflow to streamline release process (#2493) - (06e5eb0)
- Update concurrency logic (#2481) - (4939f13)
- Add semantic-pr workflow to enforce conventional commits (#2472) - (5e57fdc)
New Contributors ❤️
- @caillou made their first contribution
- @Kenshin9977 made their first contribution
- @MagicLegend made their first contribution
- @wiiaam made their first contribution
- @mjonkus made their first contribution
- @nova-api made their first contribution
- @mreid-tt made their first contribution
- @DataBitz made their first contribution
- @Hyperion2220 made their first contribution
- @blassley made their first contribution
- @JanKleine made their first contribution
- @koiralasandesh made their first contribution
Contributors
caillou, mreid-tt, and 10 other contributors
Assets 2
Release v3.0.1
Release v3.0.0
3.0.0 - 2026-02-14
Migrating from Overseerr/Jellyseerr to Seerr
Read our release announcement to learn what Seerr means for Jellyseerr and Overseerr users.
Please follow our migration guide for detailed instructions on migrating from Overseerr or Jellyseerr.
🚀 Features
- (api) Add completed count to request count API (#1824) - (c024799)
- (api) Add excludeKeywords parameter to discovery queries (#1908) - (cd479d0)
- (issue) Add issue description preview (#1881) - (13fe4c8)
- (notifications) Make embedded posters optional (#1364) - (479be0d)
- (requests) Add user's avatar next to Requested/Last Modified by icon (#1750) - (af7ceaf)
- (ui) Rebrand Jellyseerr logos to Seerr (#2406) - (55c2d54)
- (webhook) Add support for dynamic placeholders in webhook URL (#1491) - (17172e9)
- Overseerr to Jellyseerr migration (#2019) - (4e9c94c)
- Do not enforce TLD on email (#2075) - (b34ca15)
- Migrate to validator from email-validator (#2059) - (f7f00ce)
- Add anidb support to jellyfin scanner (#1533) - (b209e7f)
- Add tvdb indexer (#899) - (22b2824)
- Add IMDb rating votes count in tooltip (#1696) - (d3fd502)
- Dns caching manager (#1294) - (b4adfd2)
🐛 Bug Fixes
- (UserProfile) Handle optional chaining for recentlyWatched data (#1852) - (5c1583c)
- (api) Respect is4k parameter for all media status changes (#1951) - (9a92d6a)
- (api) Correct Jellyfin users endpoint documentation (#2073) - (a790934)
- (api) Cleanup radarr bits in sonarr api (#2035) - (a8c7e35)
- (api) Add a migration script to rename *arr tags with spaces (#1946) - (f2bd0ab)
- (api) Remove spaces from tags in *arr (#1913) - (837629e)
- (api) Catch error when watchlist item doesn't exist anymore (#1907) - (e9f2f44)
- (availability-sync) Handle resolution check for single-server setups (#2334) - (0f7d296)
- (availability-sync) Fix 4K media availability detection (#2298) - (6275569)
- (availability-sync) Prevent incorrect season deletion when media server is unreachable (#2302) - (448a25e)
- (base-scanner) Derive media availability from actual season state… (#2412) - (15be3d7)
- (base-scanner) Fix PROCESSING status persisting for unmonitored seasons (#2311) - (bb2120c)
- (collection) Allow re-request of deleted items in a collection (#2339) - (6031fab)
- (deps) Upgrade typeorm to 0.3.28 to address security vulnerabilities (#2333) - (f8f90cb)
- (dnscaching) Check dnsCache before init & support forceipv4 with caching (#1910) - (9e73757)
- (dnscaching) Display stats for DNS caching (#1858) - (368ecf8)
- (docker) Pass
COMMIT_TAGto build stage for custom image builds (#2146) - (2fe7253) - (docker) Casing in dockerfile (#2141) - (6dcae34)
- (download-tracker) Reset both service caches when resetting downloads (#2065) - (0d6bfa1)
- (jellyfin-api) Use standard Authorization header (#2211) - (f4fe166)
- (jellyfin-scan) Reduce jellyfin API calls during recently added scan (#2205) - (15356df)
- (local-login) Remove automatic plex linking and reduce logout log verbosity (#2225) - (3ee6966)
- (login) Add missing keys to PlexLoginButton FormattedMessage children (#2291) - (d0f029b)
- (media) Handle 4K Radarr removal for multiple instances (#2037) - (7dfa30a)
- (media-request-subscriber) Prevent mediald nullification from cascade saves (#2356) - (1ed86c1)
- (mediarequest) Explicitly set mediaId when creating request (#2316) - (beba2ea)
- (migration) Add cleanup step for duplicate push subscriptions before enforcing unique constraint (#2269) - (0c95b5e)
- (network-settings) Convert DNS cache TTL values to numbers (#2299) - (c9037f7)
- (override-rules) Show correct genres for both *arr services (#2155) - (bde322d)
- (overriderules) Display the users of an override rule (#2410) - (3dea58e)
- (overriderules) Test service using the right endpoint (#2399) - (028c7c2)
- (plex-settings) Fix Plex preset selection not enabling save button (#2289) - (e0a8103)
- (prettier) Include sw.js file in .prettierignore (#1885) - (d5bf175)
- (proxy) Configure proxy agent connection limits and IPv4 support (#2303) - (dbd5935)
- (pushover) Prevent notifications when agent is disabled or unconfigured (#2304) - (ac7c298)
- (servarr) Add timeout to Radarr/Sonarr API requests to prevent infinite loading (#2375) - (faa2c0a)
- (servarr) Replace spaces in arr user tags with
-(#2231) - (f91a26b) - (settings) DNS cache UI consistency, validation, and conditional rendering (#2382) - (91261f6)
- (settings) Correct port saving of proxy settings (#1890) - (d82c6f6)
- (setup) Fix Plex login not proceeding after authentication (#2290) - (4ab9193)
- (sonarr) Re-monitor episodes when re-requesting deleted but monitored seasons (#2312) - (88b2e78)
- (subscriber) Prevent infinite loop when requesting existing media with scan disabled (#2043) - (d5ff0c1)
- (tvdb) Respect display language when fetching metadata ...
Contributors
conlank, sbogomolov, and 12 other contributors
Assets 2
v2.7.3
2.7.3 (2025-08-14)
Bug Fixes
- api: add missing user settings' api docs (#1820) (e52c631)
- api: make username field nullable in UserSettings API schema (#1835) (c86ee0d)
- api: update Plex Watchlist URL (#1847) (17d4f13)
- blacklist: handle invalid keywords gracefully (#1815) (ca16864)
- MediaRequestSubscriber: use event manager to get fresh media state for MEDIA_AVAILABLE notifications (#1825) (3292f11)
- media: update delete media file logic to include is4k parameter (#1832) (e02ee24)
- proxy: initialize image proxies after the proxy is set up (#1794) (e98f31e), closes #1787
This release is also available on:
v2.7.3