release(sabnzbd): update sabnzbd/sabnzbd ( 5.0.4 → 5.1.3 )

[botpunk]

This PR contains the following updates:

Package	Update	Change
sabnzbd/sabnzbd	minor	5.0.4 → 5.1.3

---

Release Notes

sabnzbd/sabnzbd

v5.1.3: SABnzbd 5.1.3

Compare Source

Release Notes - SABnzbd 5.1.3

Security fixes

SABnzbd 5.1.1, 5.1.2 and 5.1.3 resolve a number of security vulnerabilities.

Over the past releases, several security researchers have put a lot of time and effort
examining SABnzbd, responsibly reporting their findings, and helping us verify the fixes.
We are grateful for their hard work, it has made SABnzbd meaningfully safer for everyone.

For most users the risk is limited: you are only affected if your setup is exposed to
untrusted parties. The web interface issues only apply if it can be reached by someone
you do not trust. By default, SABnzbd is only accessible from your own device and
External internet access is set to No access. If either of those is still at its
default, or if you use a proxy service for authentication, you are not affected.
The download-processing issues only apply if SABnzbd handles NZBs from a source you
do not fully trust, such as a public indexer.
If none of that describes your setup, you were never at risk.

The safest action is simply to update to 5.1.3.
Full details, affected versions, actions and mitigations for each vulnerability are described at:
https://sabnzbd.org/5-1-vulnerabilities

Vulnerabilities resolved:

• GHSA-q326-jpxx-jmjc: __wrapped__ dispatch bypass allows unauthenticated API access, fixed in 5.1.3.
• GHSA-mjwj-v5mr-cmcg: PAR2 symlink bypass allows pickle remote code execution, fixed in 5.1.3.
• GHSA-rgqj-28c2-gxwp: Critical remote code execution via authentication bypass on configuration endpoints, fixed in 5.1.2.
• GHSA-75g3-96fr-7p2r: High-severity path traversal during post-processing via crafted PAR2/SFV files, fixed in 5.1.2.
• GHSA-xrfq-jhgh-wqch: Critical authentication bypass allowing a valid session without credentials, fixed in 5.1.1.

If you rely on the SABnzbd username and password to keep out untrusted parties, and your
setup was exposed, it is recommended that you rotate your SABnzbd username/password and
API-key, Usenet server passwords, indexer API-keys used in RSS-feeds, and notification
service credentials after updating. See the page above for the full guidance.

Other changes and bug fixes in 5.1.3

• Tighten Compact display mode.
• Directly show usenet server errors instead of parsing them.
• Prevent database is locked error when re-evaluating stored RSS jobs.
• Added tooltip to explain search filters in Queue and History.
• Windows and macOS: Updated 7zip to 26.03.

Other bug fixes in 5.1.2

• RSS filters were not applied directly.

Other bug fixes in 5.1.1

• Styling cache issues could occur after updating.
• RSS items were removed too eagerly from RSS-history after download.
• The RSS-feed Clear Downloaded button did not do anything.

Changelog 5.1.0

This release brings a fundamental improvement to "Retry": instead of
re-downloading any files with missing data, only the articles that were actually
missing are fetched again. RSS got an overhaul under the hood, the interface is
refreshed, and we added quite a long list of long-requested features and bugfixes.

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again.
  This only works for jobs downloaded in 5.1.0 (or newer).
• RSS items are now stored in the database instead of on disk.
• New RSS Age rule to filter jobs based on their age.
• Downloaded RSS items are cleared from the RSS database after 3 days.
• Added support for filename and path pattern matching to the Cleanup List.
• Unwanted extensions will also be removed after unpacking.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• Added SAB_FILES environment variable to Post-processing scripts,
  listing all files that resulted from the job.
• New Servers will default to 16 connections instead of 8.
• Use media duration as part of Ignore Samples detection.
• Added option to (auto) sort the queue by Remaining Percentage.
• Improved support for screen readers.
• Parsing of header-encrypted RARs will use significantly fewer resources.
• Add Ayatana AppIndicator tray support on GNOME.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.
• Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Prevent path traversal in orphaned job APIs.
• Disk Full errors from unrar were not handled gracefully during unpacking.
• Memory leak could occur during article decoding.
• In containers (like Docker), the Article Cache could exceed the memory limit.
• Diskspace checks would be too strict when unpacking to different disk.
• Prevent deadlock when a second signal arrives during shutdown procedure.
• Verification using SFV-checks could fail, even though files were correct.
• Don't log Warning during clean shutdowns.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.
• macOS: Included par2cmdline-turbo will now use all available CPU-features.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader.
It simplifies the process of downloading from Usenet dramatically, thanks to its web-based
user interface and advanced built-in post-processing options that automatically verify, repair,
extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)

v5.1.2: SABnzbd 5.1.2

Compare Source

Release Notes - SABnzbd 5.1.2

SABnzbd 5.1.1 and 5.1.2 resolved 3 serious vulnerabilities.

Critical remote code execution vulnerability resolved in 5.1.2 (GHSA-rgqj-28c2-gxwp)

You are only affected if an untrusted party can reach the web interface.
By default, SABnzbd is only accessible from your own device and External internet access
is set to No access. If either of those is still at its default, or if you use a proxy
service for authentication, you are not affected.

In version 5.1.1 and earlier, an attacker who can reach the web interface could bypass
authentication on configuration endpoints, even when SABnzbd is protected with a username
and password. By changing SABnzbd's settings this way, an attacker could ultimately execute
arbitrary commands on the system running SABnzbd, with the same permissions as SABnzbd itself.
This also means that all information in SABnzbd would be exposed.

See GHSA-xrfq-jhgh-wqch below for actions and mitigations.
More information: https://sabnzbd.org/5-1-vulnerabilities

High-severity path traversal vulnerability resolved in 5.1.2 (GHSA-75g3-96fr-7p2r)

You are affected if SABnzbd processes NZBs or downloads from a source you do not fully
trust, such as a public indexer.

In version 5.1.1 and earlier, a maliciously crafted PAR2 or SFV file inside a download
could cause SABnzbd to move downloaded content outside of the job's own folder during
post-processing. By using this to plant a file in another job's internal administration,
an attacker could ultimately execute arbitrary commands on the system running SABnzbd,
with the same permissions as SABnzbd itself.

The only mitigation is to update, there is no configuration change that prevents this.
More information: https://sabnzbd.org/5-1-vulnerabilities

Critical authentication vulnerability resolved in 5.1.1 (GHSA-xrfq-jhgh-wqch)

You are only affected if an untrusted party can reach the web interface.
By default, SABnzbd is only accessible from your own device and External internet access
is set to No access. If either of those is still at its default, or if you use a proxy
service for authentication, you are not affected.

If the SABnzbd login page is reachable from outside your network, an attacker could
obtain a valid session in version 5.1.0 and earlier, even when SABnzbd is protected with
a username and password. This means that all information in SABnzbd would be exposed.

If you rely on the SABnzbd username and password to keep out other users on your
network or the internet, it is recommended that you change the following
sensitive information after applying the update:

• SABnzbd username and password.
• SABnzbd API-key.
• Usenet server passwords.
• API-keys from indexers used within RSS-feeds.
• Authentication information for notification services.

If you cannot update right away, the only mitigations are to ensure the web interface is not
reachable by untrusted parties, or to lower External internet access to Full API or below.

More information: https://sabnzbd.org/5-1-vulnerabilities

Other bug fixes in 5.1.2

• RSS filters were not applied directly.

Other bug fixes in 5.1.1

• Styling cache issues could occur after updating.
• RSS items were removed too eagerly from RSS-history after download.
• The RSS-feed Clear Downloaded button did not do anything.

Changelog 5.1.0

This release brings a fundamental improvement to "Retry": instead of
re-downloading any files with missing data, only the articles that were actually
missing are fetched again. RSS got an overhaul under the hood, the interface is
refreshed, and we added quite a long list of long-requested features and bugfixes.

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again.
  This only works for jobs downloaded in 5.1.0 (or newer).
• RSS items are now stored in the database instead of on disk.
• New RSS Age rule to filter jobs based on their age.
• Downloaded RSS items are cleared from the RSS database after 3 days.
• Added support for filename and path pattern matching to the Cleanup List.
• Unwanted extensions will also be removed after unpacking.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• Added SAB_FILES environment variable to Post-processing scripts,
  listing all files that resulted from the job.
• New Servers will default to 16 connections instead of 8.
• Use media duration as part of Ignore Samples detection.
• Added option to (auto) sort the queue by Remaining Percentage.
• Improved support for screen readers.
• Parsing of header-encrypted RARs will use significantly fewer resources.
• Add Ayatana AppIndicator tray support on GNOME.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.
• Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Prevent path traversal in orphaned job APIs.
• Disk Full errors from unrar were not handled gracefully during unpacking.
• Memory leak could occur during article decoding.
• In containers (like Docker), the Article Cache could exceed the memory limit.
• Diskspace checks would be too strict when unpacking to different disk.
• Prevent deadlock when a second signal arrives during shutdown procedure.
• Verification using SFV-checks could fail, even though files were correct.
• Don't log Warning during clean shutdowns.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.
• macOS: Included par2cmdline-turbo will now use all available CPU-features.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader.
It simplifies the process of downloading from Usenet dramatically, thanks to its web-based
user interface and advanced built-in post-processing options that automatically verify, repair,
extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)

v5.1.1: SABnzbd 5.1.1

Compare Source

Release Notes - SABnzbd 5.1.1

Critical authentication vulnerability resolved in 5.1.1 (GHSA-xrfq-jhgh-wqch)

You are only affected if an untrusted party can reach the web interface.
By default, SABnzbd is only accessible from your own device and External internet access
is set to No access. If either of those is still at its default, or if you use a proxy
service for authentication, you are not affected.

If the SABnzbd login page is reachable from outside your network, an attacker could
obtain a valid session in version 5.1.0 and earlier, even when SABnzbd is protected with
a username and password. This means that all information in SABnzbd would be exposed.

If you rely on the SABnzbd username and password to keep out other users on your
network or the internet, it is recommended that you change the following
sensitive information after applying the update:

• SABnzbd username and password.
• SABnzbd API-key.
• Usenet server passwords.
• API-keys from indexers used within RSS-feeds.
• Authentication information for notification services.

If you cannot update right away, the only mitigations are to ensure the web interface is not
reachable by untrusted parties, or to lower External internet access to Full API or below.

More information: https://sabnzbd.org/auth-bypass

Other bug fixes in 5.1.1

• Styling cache issues could occur after updating.
• RSS items were removed too eagerly from RSS-history after download.
• The RSS-feed Clear Downloaded button did not do anything.

Changelog 5.1.0

This release brings a fundamental improvement to "Retry": instead of
re-downloading any files with missing data, only the articles that were actually
missing are fetched again. RSS got an overhaul under the hood, the interface is
refreshed, and we added quite a long list of long-requested features and bugfixes.

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again.
  This only works for jobs downloaded in 5.1.0 (or newer).
• RSS items are now stored in the database instead of on disk.
• New RSS Age rule to filter jobs based on their age.
• Downloaded RSS items are cleared from the RSS database after 3 days.
• Added support for filename and path pattern matching to the Cleanup List.
• Unwanted extensions will also be removed after unpacking.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• Added SAB_FILES environment variable to Post-processing scripts,
  listing all files that resulted from the job.
• New Servers will default to 16 connections instead of 8.
• Use media duration as part of Ignore Samples detection.
• Added option to (auto) sort the queue by Remaining Percentage.
• Improved support for screen readers.
• Parsing of header-encrypted RARs will use significantly fewer resources.
• Add Ayatana AppIndicator tray support on GNOME.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.
• Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Prevent path traversal in orphaned job APIs.
• Disk Full errors from unrar were not handled gracefully during unpacking.
• Memory leak could occur during article decoding.
• In containers (like Docker), the Article Cache could exceed the memory limit.
• Diskspace checks would be too strict when unpacking to different disk.
• Prevent deadlock when a second signal arrives during shutdown procedure.
• Verification using SFV-checks could fail, even though files were correct.
• Don't log Warning during clean shutdowns.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.
• macOS: Included par2cmdline-turbo will now use all available CPU-features.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader.
It simplifies the process of downloading from Usenet dramatically, thanks to its web-based
user interface and advanced built-in post-processing options that automatically verify, repair,
extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)

v5.1.0: SABnzbd 5.1.0

Compare Source

Release Notes - SABnzbd 5.1.0

This release brings a fundamental improvement to "Retry": instead of
re-downloading any files with missing data, only the articles that were actually
missing are fetched again. RSS got an overhaul under the hood, the interface is
refreshed, and we added quite a long list of of long-requested features and bugfixes.

New features in 5.1.0

• Refreshed the interface.
• When Retrying a job, only the actually missing articles are tried again.
  This only works for jobs downloaded in 5.1.0 (or newer).
• RSS items are now stored in the database instead of on disk.
• New RSS Age rule to filter jobs based on their age.
• Downloaded RSS items are cleared from the RSS database after 3 days.
• Added support for filename and path pattern matching to the Cleanup List.
• Unwanted extensions will also be removed after unpacking.
• Allow job setting changes directly from Extra queue columns.
• Added support for unpacking .tar files during post-processing.
• Improved anonymization of the logs when using Show Logging.
• Added SAB_FILES environment variable to Post-processing scripts,
  listing all files that resulted from the job.
• New Servers will default to 16 connections instead of 8.
• Use media duration as part of Ignore Samples detection.
• Added option to (auto) sort the queue by Remaining Percentage.
• Improved support for screen readers.
• Parsing of header-encrypted RARs will use significantly fewer resources.
• Add Ayatana AppIndicator tray support on GNOME.
• Removed redundant INSTALL.txt file.
• Dropped support for Python 3.9.
• Windows and macOS: Updated Python to 3.14.6, Unrar to 7.23 and 7zip to 26.02.

Bug fixes in 5.1.0

• Prevent incorrect warnings about non-writeable directories.
• Files unrelated to job could get removed by the Cleanup List logic.
• Prevent path traversal in orphaned job APIs.
• Disk Full errors from unrar were not handled gracefully during unpacking.
• Memory leak could occur during article decoding.
• In containers (like Docker), the Article Cache could exceed the memory limit.
• Diskspace checks would be too strict when unpacking to different disk.
• Prevent deadlock when a second signal arrives during shutdown procedure.
• Verification using SFV-checks could fail, even though files were correct.
• Don't log Warning during clean shutdowns.
• Windows: Uninstall would not remove Settings or Windows Service.
• Windows: Warn for OS-limit if more than 1024 connections are configured.
• macOS: AppleDouble files could result in failures in Moving stage.
• macOS: Restarting the application resulted in Terminal window.
• macOS: Included par2cmdline-turbo will now use all available CPU-features.

Upgrade notices

• You can directly upgrade from version 3.0.0 and newer.
• Upgrading from older versions will require performing a Queue repair.

Known problems and solutions

• Read ISSUES.txt or https://sabnzbd.org/wiki/introduction/known-issues

Code Signing Policy

Windows code signing is provided by SignPath.io using a SignPath Foundation certificate.

About

SABnzbd is an open-source cross-platform binary newsreader.
It simplifies the process of downloading from Usenet dramatically, thanks to its web-based
user interface and advanced built-in post-processing options that automatically verify, repair,
extract and clean up posts downloaded from Usenet.

(c) Copyright 2007-2026 by The SABnzbd-Team (sabnzbd.org)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM (* 0-3 * * *)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[botpunk]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

[botpunk]

📦 App Size Analysis

Note

Comparing ghcr.io/vijayakumarravi/sabnzbd:rolling ➔ ghcr.io/vijayakumarravi/sabnzbd:sandbox

📈 Size Comparison Table

OS/Platform	Previous	Current	Change	Trend
linux/amd64	44.17 MB	47.88 MB	+3.71 MB (+8.39%)	🔼
linux/arm64	44.2 MB	47.94 MB	+3.75 MB (+8.48%)	🔼