Skip to content

CHANGELOG.md

Latest commit

 

History

History
813 lines (557 loc) · 57.5 KB

CHANGELOG.md

File metadata and controls

813 lines (557 loc) · 57.5 KB
Raw

Changelog

[1.0.3] - 2026-08-10

Fixed

  • Crash after download completes: "OSError: [Errno 24] No file descriptors available" — Not a file-descriptor leak: musl libc (Alpine base image) caps named POSIX semaphores at 256 per process, and every multiprocessing.Queue costs 3 semaphores / every Event costs 5, so a config with ~4 path pairs sat at the cap and the first staging→final MoveProcess after a download pushed it over (with 6+ pairs the container crashed at startup). Single-producer/single-consumer result queues and wake/terminate events are now backed by pipes (PipeStream/PipeFlag, 0 semaphores each), taking the main process from ~250 semaphores at 4 pairs to ~21 — and ~3 per pair instead of ~51, so large path-pair configs now work. mp.Queue remains only for parent→child dispatch and the multi-process log queue. Pipe ends unused by each process are closed after spawn, so a peer that dies mid-operation now yields EOF instead of a hung read/write — hardening inherited from review, not present in the old queue-based code. (#654)

[1.0.2] - 2026-07-27

Fixed

  • Mobile file list scrolling - The file list no longer uses a fixed-size scroll container on mobile, restoring natural page scrolling on small screens; desktop and mobile now share a single responsive file row template. (#370)

Changed

  • Dependency updates - Updated Angular frontend dependencies (Angular group, TypeScript ESLint, ESLint, Font Awesome, and transitive packages), website dependencies (PostCSS, React DOM, webpack-dev-server, and others), and GitHub Actions (setup-python 7, setup-uv 9, docker/login-action 4.5.1).
  • Dependabot grouping - Docusaurus dependency updates are now grouped into a single Dependabot PR.

[1.0.1] - 2026-07-08

Changed

  • Dependency and workflow updates - Updated Angular frontend dependencies, TypeScript ESLint, GitHub Actions, and website dependencies merged through develop.

Fixed

  • Dead worker result preservation - Extract/validate worker results emitted immediately before a crash are now drained and buffered before dead worker queues are closed, so completed and failed results are surfaced exactly once after supervisor recovery. (#571, #590)

[1.0.0] - 2026-06-10

First stable release. This milestone bundles the optional FTPS transfer protocol, a large backend reliability and persistence hardening pass, frontend performance work, the Angular 22 upgrade, and a security-focused test and runtime baseline.

Added

  • Optional FTPS transfer protocol — A new protocol setting (sftp by default, or ftps) lets transfers run over FTPS (FTP over TLS) instead of SFTP, reaching substantially higher throughput on high-latency links by sidestepping the SSH layer. FTPS mode is a hybrid: file discovery always stays on SSH (new remote_ftp_port, default 21, is used only for FTPS transfers; the existing remote port remains the SSH/SFTP port). FTPS transfers use the same persisted Connections settings as SFTP — what the Settings UI shows is what lftp runs. The data channel is always TLS-encrypted; certificate verification is exposed via ftp_ssl_verify_certificate and defaults off (with a per-connection WARNING log) to accommodate self-signed seedbox certificates — documented as an encryption-without-authentication trade-off with remediation. FTPS options live in a dedicated Transfer Protocol section of the Settings page. Existing SFTP installs are unaffected. (#485)
  • Notify on download start — New notify_on_download_start option (disabled by default) emits a download_start event when a file enters the DOWNLOADING state. Fires through the existing webhook, Discord, and Telegram channels, with a yellow Discord embed color and "Download Started" label. (#486)
  • Automatic extract/validate worker recovery — A crashed extract or validate worker subprocess is now detected (is_alive()/exitcode) and recreated automatically via a shared WorkerSupervisor, so extraction/validation resumes after a transient fault without restarting the container. (#535)
  • Failed-move surfacing + in-session retry — A failed staging→final move is now shown as a distinct MOVE_FAILED state (with a "Move failed" badge in the UI) instead of silently appearing done, and is retried within the session up to a bounded per-file budget. (#536)

Changed

  • Angular 22 upgrade — Upgraded the frontend from Angular 21 to 22 (all @angular/* packages, @angular/cli, @angular/build, @angular/cdk, and angular-eslint to 22.0.0), bumping TypeScript to 6.0. Migrated the deprecated APP_INITIALIZER token to the functional provideAppInitializer() and made the implicit zoneless contract explicit with provideZonelessChangeDetection(). Supersedes the closed Dependabot PRs #550 (TypeScript 6 ERESOLVE) and #551 (@angular/cli 22 ERESOLVE) by performing the lockstep major bump atomically. (#556)
  • Performance — backend model build — Replaced the O(n²) per-cycle model build with O(1) BFS frontiers and a skipped child-list copy in model_builder. (#520)
  • Performance — frontend file list — Coalesced SSE-driven view rebuilds, memoized the filter, and made bulk-remove a single pass to eliminate file-list rebuild thrash. (#521)
  • Performance — logs page — Capped the live-log buffer (ring buffer + stable collision-free trackBy), then rendered it with CDK virtual scroll and batched change detection to ~one update per animation frame. (#522, #539)
  • Refactor — lftp parser — Decomposed the 412-line, complexity-48 LftpJobStatusParser.__parse_jobs into focused, strictly-typed helpers. (#523)
  • Refactor — ViewFileService — Split the god service into a capabilities module, a selection service, and a command service (ViewFileCommandService), with a single source of truth for the status→capability state machine. (#524, #541)
  • Refactor — backend coupling & service conventions — Decoupled Controller/CommandPipeline/persist-sync, made config option types typo-safe, and migrated ConfigService.set / AutoQueueService to the documented tap-based mutating-service contract. (#525, #542)
  • Repo & CI hygiene — .gitignore cleanup, pinned GitHub Actions, per-job timeouts, removal of dead scripts, and re-enabled the mock-based lftp/ssh/scanner unit tests in CI. (#527, #529)
  • Dependency updates — Angular, React 19.2.x, typescript-eslint, eslint, vitest, hono, qs, postcss, webpack-dev-server, webob, shell-quote, and astral-sh/setup-uv, among others. (#488–#506, #545–#554, #560, #565)

Fixed

  • Remote scan timed out at 30s under password auth — The SSH password-prompt wait in Sshcp had no explicit timeout, so it silently used pexpect's 30s default instead of the intended 180s. A server slow to present the prompt (e.g. a reverse-DNS/GSSAPI auth delay on a cold connection) failed scan attempts even though the log reported a 180s limit. The prompt wait now uses the full command timeout. Downloads were unaffected (separate LFTP path); the retry logic masked the failure as recurring log errors. (#562)
  • Config handler persistence atomicity — /server/config/set now captures the pre-mutation value, attempts the disk write, and on OSError rolls back the in-memory state and returns a structured HTTP 500 instead of letting the exception bubble up as a stack trace. The LFTP hot-reload callback only fires after a successful write, preventing the runtime from being reconfigured to a value that never made it to disk. (#469)
  • Integration delete persistence ordering — /server/integrations/<id> DELETE now writes path_pairs.json before integrations.json. A crash between the two writes previously left a dangling arr_target_id (instance gone from integrations but still referenced from a path pair), which is rejected by cross-validation on next load. The new order downgrades the worst-case crash outcome to a harmless orphaned instance. (#496)
  • Auto-queue and path-pairs handlers wrap persistence in try/except — /server/autoqueue/{add,remove} and /server/pathpairs/{create,update,delete} now return a controlled HTTP 500 with a structured body when the underlying to_file raises OSError, instead of leaking a stack trace. For path-pairs the in-memory mutation is retained (and may diverge from disk in the failure case); the auto-queue handlers were later changed to roll back on failure (see #518). (#497)
  • Config values containing % crashed persistence — Config.from_str/to_str now use ConfigParser(interpolation=None), so a % in any value (passwords, exclude patterns, rate limits) survives the write/read round-trip instead of crashing on the default interpolation (#530). The config handler also rolls back its in-memory state on any persist failure, not just OSError. (#507)
  • Controller.exit() leaked worker subprocesses and queue FDs when lftp shutdown errored — teardown is now best-effort and each worker join is bounded. (#508)
  • Auto-queue thread-safety — Cross-thread set/list races in AutoQueue/AutoQueuePersist are now lock-guarded. (#509)
  • Move pipeline silent data loss — Failed staging→final moves were reported as success; failures now propagate via a result queue. (#510)
  • Worker crash took down the whole download engine — A Validate/Extract subprocess crash is now isolated from the controller loop. (#511)
  • Failed periodic persist() misclassified as a clean shutdown — now surfaced at ERROR instead of only INFO. (#512)
  • lftp job-status parser robustness — Fixed three edge-case parsing bugs (#517) and a pget header with no data line that consumed the following job's header (#555).
  • Auto-queue add/remove applied its side effect even when persistence failed — now rolls back and returns a structured 500. (#518)
  • Directory validation broke on tilde/relative remote paths — fixed tilde expansion in the remote find/hash commands. (#519)
  • Web command handlers could block the request thread indefinitely — now bounded with a 504 timeout. (#526)
  • File-action failures were silently swallowed in the UI — single-file action errors now surface and stuck rows recover. (#513)
  • UI locked out after reload when web.api_key was set — fixed the SSE 401 deadlock by bootstrapping config off the stream. (#514)
  • Bulk Delete Local/Remote had no confirmation — now requires a two-click confirm to guard against accidental data loss. (#515)
  • Unguarded JSON.parse in SSE/logs/auto-queue handlers — wrapped with try/catch and surfaced fetch errors. (#516)
  • Cross-device move raced lftp's temp-file rename — The staging→final copy fallback could list a <name>.lftp temp file, have lftp rename it to the final name mid-copy, then fail with ENOENT and crash MoveProcess with an uncaught shutil.Error. The move now defers (recoverable retry) while any *.lftp temp files remain in the staging tree, and wraps the copy so a rename in the narrow remaining window reports a recoverable failure and keeps the source intact instead of crashing the controller. (#567)
  • Integrations handlers wrap persistence in try/except — /server/integrations create/update/delete now return a controlled HTTP 500 with a structured JSON body when the underlying to_file raises OSError, instead of leaking an unhandled stack trace. Matches the path-pairs handler contract via a shared _persist_or_500 helper. (#530)
  • Version-check banner could hang on a stalled GitHub connection — The "new version available" check now bounds the GitHub release request with a 10s timeout and recovers on error, instead of leaving it open indefinitely (browsers apply no default timeout). The banner is best-effort, so a slow or dropped connection now fails quietly. (#527)

Security

  • Documented hardened Docker runtime baseline — The shipped docker-compose.dev.yml and the installation docs now recommend running the container with no-new-privileges and cap_drop: ALL, adding back only the capabilities the entrypoint needs (CHOWN, SETUID, SETGID, DAC_OVERRIDE, FOWNER). These flags are opt-in for users running via plain docker run or their own compose template. (#528)
  • Web API key no longer persisted client-side — kept out of browser storage. (#514)
  • Security-critical path test coverage — Added tests for extraction zip-slip, SSH command quoting, persist races, config special characters, scanner symlinks, and webhook URL-scheme validation. (#530)

[0.18.1] - 2026-05-16

Fixed

  • Discord webhook 403 Forbidden — format_discord only set Content-Type, so urllib filled in its default Python-urllib/x.y User-Agent, which Discord blocks. Webhooks now identify themselves as seedsync (https://github.com/nitrobass24/seedsync). Same headers dict serves both the Test button and the live notifier, so all Discord paths are covered. (#483, #484)

Changed

  • Dependency updates — react and react-dom 19.2.5 → 19.2.6 (#478, #479), Angular group +10 packages (#480), typescript-eslint 8.59.0 → 8.59.2 (#481), @babel/plugin-transform-modules-systemjs 7.29.4 (#477), fast-uri 3.1.0 → 3.1.2 (#475, #476), hono 4.12.14 → 4.12.18 (#474), ip-address and express-rate-limit (#473).

[0.18.0] - 2026-05-04

Changed

  • Image size reduced from 114 MB to 64 MB — RUN --mount=from=ghcr.io/astral-sh/uv keeps uv out of the runtime image; build artifacts no longer persist (#437)
  • Dockerfile collapsed to 2 stages on Python 3.13-alpine — Removes an intermediate stage and the legacy Buster build path (#436)
  • Test image rewritten as Alpine with Python 3.13 (#435)
  • Removed stale Docker test infrastructure — Old Compose files and fixture data carried over from the Protractor era (#434)
  • Playwright E2E migrated to the official mcr.microsoft.com/playwright container — Eliminates host-side browser install and apt install of system deps; image tag auto-pinned to the @playwright/test version from package-lock.json (#456)
  • Build and Test (amd64) runs on develop pushes — Populates the GHA cache so PRs against develop hit a warm cache instead of paying the install cost on every run (#456)
  • Playwright browser cache + npm cache wired through actions/cache (#452, #453)
  • Python 3.12 → 3.13 in CI and Dockerfile (#451)
  • README refreshed to cover features through v0.17.0 — Notifications, Sonarr/Radarr, integrity verification, staging, API key (#454)
  • Test count badges added to the README (#451)
  • Dependency updates — Angular group (10 packages), typescript-eslint, jsdom, eslint, Docusaurus 3.10.0 → 3.10.1 across 5 packages (#458, #459, #460, #461, #463, #464, #465, #466)

Added

  • LFTP hot-reload — Connection-related settings (parallel connections, max total connections, socket buffer size, bandwidth limit) apply without a container restart. Settings UI distinguishes between options that take effect immediately and those that require restart (#433)
  • Atomic config writes — Config.to_file() now flushes to disk via temp file + os.rename so a process kill mid-write can't truncate the config (#433)
  • Expanded unit and E2E test coverage:
    • 47 security middleware unit tests (#439)
    • 36 controller core unit tests (#444)
    • 28 FileOptions / Integrations / Option component tests (#448)
    • 25 AutoQueueService and PathPairsService tests (#445)
    • 20 HeaderComponent and VersionCheckService tests (#443)
    • 18 ViewFileFilterService tests (#440)
    • E2E for integrations CRUD (#441)
    • E2E for File Actions & Error States (#438)
    • E2E Settings coverage expansion (#442)
    • Web App Job & Context Python tests (#446)
    • Handler integration test expansion (#447)
    • Python integration tests added to CI (#449)

Fixed

  • Hash Algorithm select test flake — Test waited on the wrong config field; the algorithm select's disable gate is validate.enabled, not validate.xfer_verify. Test now sets the correct field and waits for the SSE-delivered model value before asserting (#455)
  • StreamHandler leaks in test setUp methods — Tests added a handler to the shared root logger but never removed it. Loggers are singletons, so by test N the logger had N handlers and each log line printed N times. Fixed via self.addCleanup(logger.removeHandler, handler) across 8 test files / 10 setUp methods (#450, #457)
  • Multiprocessing resource leak in test_active_scanner.py — scanner.close() now registered with addCleanup so resources release even if assertions raise

Security

  • apk and its package database are stripped from the runtime image — /sbin/apk, /etc/apk, /var/cache/apk, /lib/apk, and the libapk shared libraries are removed in the runtime stage to keep the image under 64 MB (#437). This means in-image vulnerability scanners (Trivy, Grype) can't enumerate Alpine packages directly from a running container; consumers should scan the published ghcr.io/nitrobass24/seedsync image via SBOM or image-history tooling. Affected runtime packages: lftp, openssh-client, ca-certificates, setpriv, libstdc++. Derived images that need apk add should base on Alpine and reinstall what they need rather than extending this image.

[0.17.0] - 2026-04-30

Added

  • Multi-instance Sonarr/Radarr integration — Replace single Sonarr/Radarr config with named instances stored in integrations.json; each path pair can be mapped to specific *arr instances via arr_target_ids; full CRUD REST API and chip-picker UI for attaching/detaching instances (#425, #426)
  • Discord notification preset — Configure a Discord webhook URL in Settings to receive rich embed notifications with color-coded event types (download complete, extraction complete/failed, delete complete); includes Test button (#329, #428)
  • Telegram notification preset — Configure a Telegram bot token and chat ID in Settings to receive Markdown-formatted notifications; includes Test button (#329, #428)
  • Cross-validation for arr_target_ids — Path pair create/update rejects unknown integration instance IDs with a 400 response (#426)

Changed

  • Notification architecture — Refactored WebhookNotifier with extracted _resolve_event_type and generic _fire_raw dispatch; Discord and Telegram formatters are pure functions in notification_formatters.py (#428)
  • Controller decomposition — Decomposed step(), _update_pair_model_state(), and update() into focused methods, reducing cyclomatic complexity below C901 threshold (#419, #420)
  • Settings UI consistency — Integrations and Path Pairs headers use matching .header pattern; dark mode card headers use consistent light text color (#429, #430, #431)
  • Semantic headings — Integrations and Path Pairs section titles now use <h3> for screen-reader heading navigation (#430)
  • Dependency updates — Angular group (10 updates), vitest 4.1.4→4.1.5, typescript-eslint 8.56.1→8.59.0, postcss 8.5.6→8.5.12 (#421, #422, #423, #424)

Fixed

  • Corrupt integrations.json recovery — Corrupt file now returns empty config instead of re-running migration with new UUIDs, which could overwrite user customizations (#426)
  • Refresh preserves instances on error — IntegrationsService.refresh() preserves the existing instance list on HTTP error instead of replacing with empty (#426)
  • Toggle enabled error handling — onToggleEnabled() now shows an error message and refreshes on failure instead of silently leaving the UI out of sync (#426)
  • Arr-picker dark mode — Fixed white dropdown background in dark mode caused by CSS specificity mismatch (#430)
  • Telegram Markdown safety — Backticks in filenames are escaped to prevent breaking inline code spans (#428)
  • Webhook URL redaction — webhook_url added to sensitive_property_names() for API response redaction (#428)
  • Thread leak on start failure — _fire_raw now cleans up _active_threads if thread.start() raises RuntimeError (#428)

Security

  • Credential redaction — Discord webhook URLs and Telegram bot tokens are redacted in API responses via sensitive_property_names() (#428)
  • URL scheme validation — Notification test endpoints reject non-http(s) URLs before attempting the request (#428)
  • Button type safety — All integrations component buttons have explicit type="button" to prevent unintended form submission (#426)

[0.16.0] - 2026-04-22

Added

  • Sonarr/Radarr integration — Test connection buttons in Settings to verify Sonarr and Radarr API connectivity (#328, #362)
  • Angular ESLint enforced in CI — All 17 lint rules at error with --max-warnings 0; covers OnPush, a11y, type safety, and code style (#376-#382, #389-#392)

Fixed

  • Mobile file list scrolling — Fixed items skipping during scroll on Android/iOS by correcting virtual scroll itemSize (50→82) and switching to dynamic viewport height measurement via ResizeObserver (#370, #371, #396)
  • Log streaming memory — Stream log files line-by-line instead of readlines() to avoid loading entire log into memory (#385)
  • Controller deadlock on exception — Use with statement on model lock to prevent deadlock when exception occurs during model update (#373, #384)
  • Integrations error leaking details — Strip internal exception details from Sonarr/Radarr error responses (#386)

Changed

  • Accessibility — 55 template a11y violations fixed: <div>/<a> click targets converted to <button>, keyboard navigation added, decorative images marked with alt="" aria-hidden="true" (#391)
  • OnPush change detection — All components now use ChangeDetectionStrategy.OnPush with Angular signals (#392)
  • Type safety — Replaced 50 no-explicit-any violations with proper types; added ModelFileJson, ConfigValue, OptionValue interfaces (#390)
  • Dependency updates — Angular group (8 packages), follow-redirects, hono, vitest, ruff, pytest, pexpect, tblib, Docusaurus (#347-#368, #388)

Security

  • npm audit fixes — Resolved high-severity vulnerabilities in Angular dependencies (#388)

[0.15.0] - 2026-04-08

Added

  • Virtual scrolling for large file lists — Improves performance when browsing directories with many files (#335)
  • Size sorting in file list — New sort option to order files by size (#334)
  • Log level dropdown — Replaced debug toggle with a full log level selector (DEBUG/INFO/WARNING/ERROR/CRITICAL) (#332)

Fixed

  • Bulk delete crash — Fixed unbounded process spawning that caused crashes during bulk delete; scoped concurrency cap to delete operations and added move retry on failure (#338, #341)
  • Infinite busy-loop in command process throttling — Fixed CPU spin in the controller process throttle logic
  • Mobile viewport height — File list viewport no longer wastes 40px on small screens where the header row is hidden
  • Bulk action error resilience — A single failed action no longer aborts the entire bulk operation pipeline

Changed

  • Dependency updates — Angular group bump (9 packages), hono, @hono/node-server, jsdom, vitest, lodash (#326, #333, #336, #337, #343, #344, #345)
  • Documentation — Moved recommended hard-link workflow from FAQ to a dedicated Usage section; fixed UI label consistency (#340)

[0.14.4] - 2026-03-30

Changed

  • Pyright strict mode — Upgraded Pyright type checking from basic to strict mode across the entire Python codebase; added type stubs for bottle, pexpect, and tblib (#291, #316)

Fixed

  • Extraction-move validation race — Extraction completion no longer spawns a staging move while validation is still running; the move is deferred to the validation completion path (#316)
  • Directory size preservation in exclude filter — _filter_children now preserves scanner-reported directory sizes instead of recomputing from filtered children, preventing remote_size divergence (#316)

Security

  • Website dependency bumps — Fixed 4 vulnerabilities in website transitive dependencies: brace-expansion, path-to-regexp, picomatch, minimatch (#324)
  • Pygments 2.20.0 — Bumped pygments to fix ReDoS vulnerability GHSA-5239-wwwm-4pmq (#325)

[0.14.3] - 2026-03-25

Added

  • Configurable remote Python path — New "Remote Python Path" setting lets users specify a custom Python binary on the remote server (e.g. ~/python3/bin/python3), solving issues on seedboxes where python3 is not on the default PATH (#314, #315)
  • Startup config validation — SeedSync now validates required LFTP config fields on startup and shows clear error messages when remote_address, remote_username, remote_path, or local_path are missing (#310, #313)

Fixed

  • scan_fs.py Python 3.5 compatibility — Remote scanner script now works on servers with Python 3.5+ by using typing.List/Optional instead of modern type syntax (#314, #315)
  • Sshcp.copy() user@host format — Fixed scp command construction to use the shared _remote_address() helper, matching the pattern used by shell() (#312)
  • Pre-existing code quality bugs — Fixed extraction retry counter, NotImplementedError base class, and process cleanup issues found during Ruff review (#289, #312)

Changed

  • uv for Python dependencies — Replaced pip + requirements.txt with uv and PEP 621 dependency groups; pinned uv versions in CI and Docker (#286, #311)

[0.14.2] - 2026-03-23

Added

  • Playwright E2E test suite — Replaced legacy Protractor tests with Playwright; 55 tests covering all pages, navigation, themes, and settings (#250)
  • Pyright type checking enforced in CI — Completed Pyright phases 3 & 4, fixing 166 type errors to reach 0 errors in basic mode; Pyright check is now required in CI (#249)

Fixed

  • ModelFile nullable size fields — local_size and remote_size are now correctly typed as number | null to match the Python backend JSON contract

Security

  • Reject control characters in filenames — Decoded filenames containing control characters are now rejected to prevent corrupted file entries and queue command injection (#300)
  • Redact sensitive credentials from API — SSH password and key passphrase are no longer exposed in API responses; set handler rejects the redacted sentinel value (#257)

Changed

  • Angular dependency updates — Bumped Angular group to latest, jsdom to 29.0.1 (#307, #308)
  • CI: actions/setup-python v6 — Bumped setup-python action from v5 to v6 (#306)

Removed

  • Legacy Docker E2E infrastructure — Cleaned up Protractor Docker Compose files, test images, and fixture data

[0.14.1] - 2026-03-18

Fixed

  • Parser crash on long filenames — Chunk progress lines that wrap across PTY boundaries no longer crash the controller; unrecognized lines inside a job context are skipped with a warning (#290, #293)
  • False download completion on parser error — Parser failures no longer trigger false "download completed" signals that left files stuck in staging at partial progress (#296)
  • Progress tracking with .lftp temp naming — ActiveScanner now recognizes .lftp-suffixed temp files in staging, fixing 0% progress display for single-file downloads when temp naming is enabled (#298)

Changed

  • PEP 621 pyproject.toml — Consolidated Python dependencies from Poetry format to PEP 621 with proper dependency groups (runtime, test, dev); removed dead dependencies (#287)
  • Ruff linting and formatting — Added Ruff as Python linter/formatter with CI enforcement; applied auto-fixes across 99 files (#288)
  • Pyright type checking — Added Pyright in basic mode with CI reporting; fixed 91 type errors across 26 modules (#292, #295)
  • Python unit tests in CI — Python tests now run in CI alongside Angular tests (#287)
  • Angular dependency updates — Bumped Angular group to 21.2.4, vitest to 4.1.0, jsdom to 29.0.0 (#282, #283, #284)

[0.14.0] - 2026-03-14

Added

  • Inline transfer verification — LFTP's xfer:verify checksums files during download, catching corruption in real-time; enabled by default (#242)
  • Post-download integrity checking — Optional validation step that compares local and remote checksums via SSH after download, with per-file Validate button and Validated/Corrupt status indicators (#125, #276)
  • File list pair label column — File list shows which path pair each file belongs to (#156)
  • Accessibility — All file action buttons converted to native <button> elements (#241)
  • Comprehensive test coverage — 287 unit tests across Angular (Vitest) and Python (pytest) (#225)

Changed

  • Alpine-only Docker image — Removed Debian variant; all images are now Alpine-based (~45 MB), multi-arch (amd64/arm64) (#231, #244)
  • Multiprocessing fork to spawn — Fixes Python 3.12 deprecation warnings (#228)
  • Verbose logging in web UI — Verbose LFTP logging setting is now exposed in the Settings page under Logging (#266)
  • CI deduplication — Eliminated redundant amd64 Docker build; publish triggers now build, test, and push in a single job (#274)

Fixed

  • Stopped download delete stuck — Deleting local files for a stopped download no longer leaves the UI spinner and ActiveScanner polling forever (#271, #272, #273)
  • File descriptor leak on restart — Multiprocessing Event/Queue references are now released in close_queues() to prevent FD exhaustion across restarts (#265)
  • Model rebuild log noise — Temporary model objects used during diff computation no longer emit "Adding file" log messages on every controller loop iteration (#267)

[0.13.5] - 2026-03-13

Fixed

  • Exclude patterns use wrong LFTP flag — Changed --exclude (regex) to --exclude-glob (glob) so patterns like *.nfo work correctly instead of being silently misinterpreted as regex (#271)

Changed

  • LFTP queue command logging — Log LFTP queue commands at INFO level (previously DEBUG) for easier troubleshooting without enabling verbose mode
  • CI workflow_dispatch support — Allow manual Docker image publishing via GitHub Actions workflow_dispatch trigger

[0.13.4] - 2026-03-12

Fixed

  • Exclude patterns not passed to LFTP — Exclude patterns were only filtering the UI display model but were never passed to LFTP's mirror command, causing all files to be downloaded regardless of configured exclusions (#259)
  • Parser crash on Unraid PTY line-wrap fragments — Unraid's Docker PTY handling wraps long LFTP progress lines, producing tail fragments like /s eta:25m [Receiving data] that crashed the parser and stopped the container (#260)
  • Parser error threshold too aggressive — Bumped consecutive status error threshold from 2 to 10 so persistent parse issues don't crash the app within seconds
  • PTY width override on Unraid — Set COLUMNS=10000 in pexpect spawn environment as belt-and-suspenders alongside setwinsize to prevent Unraid from overriding PTY dimensions

[0.13.3] - 2026-03-12

Fixed

  • lftp parser crash on orphan progress lines — Parser no longer crashes when lftp emits bare progress lines like 3.0K/s eta:3m [Receiving data] outside a job context, which caused the Docker container to stop (#253)

[0.13.2] - 2026-03-10

Fixed

  • Recursive exclude filtering — Exclude patterns now filter through nested children, not just top-level files (#158, #217)
  • Persist key separator — Replace colon separator with non-printable unit separator (\x1f) to avoid conflicts with filenames containing colons; includes backward-compatible migration of existing persist data (#221)
  • Default-pair filenames with colons — Fix _sync_persist_to_all_builders incorrectly excluding filenames like Show 01:02.mkv from default pair contexts (#221)
  • Python version check placement — Move version guard above project imports so the friendly error message displays on older Python versions (#224)
  • Angular memory leaks — Fix 6 leaked subscriptions in header and sidebar components (#220)

Added

  • LZIP archive detection — is_archive() now recognizes LZIP format with 5-byte magic signature (#218)
  • Plain gzip/bzip2 extraction — Support extraction of standalone .gz and .bz2 files (not just .tar.gz/.tar.bz2) (#219)
  • Webhook graceful shutdown — WebhookNotifier.shutdown() drains in-flight webhook threads with a configurable timeout, preventing lost notifications on exit (#222)
  • 67 new tests — Unit tests for extraction, exclude patterns, webhook drain, persist migration, file-list component, bulk-action-bar component, and path pairs CRUD handler (#219, #226, #227)

Changed

  • Angular subscription cleanup — Migrate 6 components from manual Subscription[]/ngOnDestroy to takeUntilDestroyed pattern (#220)
  • Shared form template — Extract duplicated path-pairs form fields into ng-template with *ngTemplateOutlet (#223)
  • Defensive copy for path pairs — PathPairsConfig.get_pair() returns deep copies to prevent external mutation of internal state (#221)
  • Dependency cleanup — Move timeout-decorator from runtime to test-only; remove unused localization strings (#224)
  • Angular dependency updates — Bump Angular group dependencies (#213)

[0.13.1] - 2026-03-09

Fixed

  • RAR archive extraction — Use source-built 7-Zip 26.00 with RAR codec support; distro packages strip the proprietary RAR codec (#204, #210, #212)
  • Extract/move pipeline stall — Fix pending_completion never clearing for files in EXTRACTED or EXTRACT_FAILED state when staging is enabled (#208)
  • Auto-delete with path pairs — Fix auto-queue commands missing pair_id for path pair configurations (#205)
  • Pre-extraction false negatives — Remove redundant archive verification that rejected valid archives (#207)

Changed

  • Pre-built 7-Zip Docker image — Extract 7zz binary from ghcr.io/nitrobass24/docker-7zip instead of compiling from source during CI (#212)

Security

  • CodeQL alerts resolved — Fix code scanning alerts identified by GitHub CodeQL (#197)

[0.13.0] - 2026-03-06

Added

  • Multiple path pairs — Configure multiple remote/local directory pairs, each with independent LFTP and scanner instances. Replaces the single remote/local path with a flexible pair-based model (#122, #149, #155, #161)
  • Path pairs settings UI — Full CRUD interface for managing path pairs in Settings, with per-pair enable/disable and auto-queue toggles (#160, #162, #163)
  • Exclude patterns — Filter out unwanted remote files using glob patterns (e.g. *.nfo, Sample/), configurable per path pair (#26, #146)
  • Multi-select and bulk operations — Select multiple files and apply queue/stop/delete actions in bulk (#123)
  • Webhook notifications — HTTP POST notifications on file download/extract events (#128)
  • Historical log query — /server/logs endpoint with search, filter, and level controls; accessible from the UI (#124)
  • Structured JSON logging — Optional JSON log format for log aggregation tools (#127)
  • Alpine Docker image — Lightweight Alpine variant alongside the Debian image, published as *-alpine tags (#164)
  • Docker HEALTHCHECK — Built-in health check for container orchestrators with WEB_PORT env var support (#164, #180)

Changed

  • Python scanfs replaces PyInstaller binary — Remote scanner is now a plain Python script, eliminating glibc compatibility issues with seedbox servers (#80, #148)
  • JSON serialization for scanfs — Scanner uses JSON instead of legacy serialization for safer, more debuggable output (#129)
  • Consolidated extraction to 7z — All archive extraction (zip, rar, 7z, tar, gz, bz2, xz) now uses the single 7z binary, removing the unrar dependency and reducing image size (#178)
  • Dual-image CI pipeline — CI builds and tests both Debian and Alpine variants on every push, with parallel arm64 builds on develop (#164, #175, #176)
  • Startup log improvements — Path pairs dumped at startup for debugging; model logs show short pair ID instead of full GUID (#165)

Fixed

  • Per-pair extraction pipeline — Extraction now uses the correct path pair's filesystem paths instead of always using the first pair (#167, #173)
  • Per-pair staging subdirectories — Each path pair gets its own staging subdirectory, preventing filename collisions (#168, #173)
  • Unique pair name enforcement — Duplicate pair names are now rejected on create/update (#169, #172)
  • Graceful pause when all pairs disabled — Controller idles cleanly and the UI shows an informational banner instead of falling back to legacy behavior (#170, #174)
  • Spurious staging moves on restart — Files already moved to their final location are no longer re-queued for move on container restart (#177, #179)
  • Healthcheck IPv6 resolution — Healthcheck uses 127.0.0.1 explicitly instead of localhost, which resolved to IPv6 ::1 on Alpine (#180)

Removed

  • paste WSGI server — Replaced with Bottle's built-in multithreaded server (#140)
  • patool dependency — Archive extraction consolidated to 7z (#141, #145, #178)
  • unrar dependency — Removed in favor of 7z which handles all RAR formats (#178)

[0.12.10] - 2026-03-04

Added

  • API key authentication — Optional API key protects all /server/* endpoints. Set via Settings > Web > API Key. SSE stream accepts key as query parameter; config GET is exempt for frontend bootstrapping (#130)
  • Security response headers — Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy on all responses (#130)
  • CSRF protection — Origin/Referer validation on state-changing requests with loopback exemption (#130)
  • Rate limiting — Per-IP sliding window (120 requests/60s) on all endpoints except SSE stream (#130)
  • Config file backup — Automatic backup before each config save, keeps last 10 with ISO timestamps (#130)
  • Scanner home directory fallback — Automatically retries scanner installation to ~/ when /tmp is restricted on the remote server (#114)
  • Server Script Path documentation — README troubleshooting, configuration docs, and FAQ entries for common scanner installation issues (#114, #115)

Fixed

  • CSP blocks inline scripts — Moved inline theme detection to external theme-init.js and disabled Beasties critical CSS inlining to comply with script-src 'self' (#134)
  • Settings page not loading — Eagerly initialize ConfigService and AutoQueueService in APP_INITIALIZER to ensure config loads on first connection (#136)
  • SSE API key state mismatch — Clear SSE stream API key at all config-reset paths (disconnect, parse failure, fetch failure) to prevent stale auth (#136)
  • SFTP permission preservation overrides umask — Disabled lftp sftp:set-permissions so local umask applies to downloaded files (#115)
  • Scanner path traversal in delete endpoints — Validate filenames and check path containment before local/remote delete operations (#130)
  • Zip-slip archive extraction — Pre-validate zip/tar members for symlinks and path traversal; post-extraction check for rar/7z formats (#130)
  • Remote scanner shell-quoting — Properly escape remote paths in md5sum and execution commands (#114)

Security

  • Path traversal protection on all controller command endpoints (queue, stop, extract, delete) (#130)
  • Constant-time API key comparison with secrets.compare_digest (#130)
  • Null byte rejection in filename validation (#130)

[0.12.9] - 2026-03-02

Changed

  • UMASK diagnostic logging — Log the applied umask and previous value at startup to help diagnose permission issues (#109)

[0.12.8] - 2026-03-02

Fixed

  • Staging path crash on Unraid — Container failed to start with PermissionError: /staging when staging was enabled but /staging was not a writable volume mount. The /staging directory is now created and chowned at container startup, declared as a Docker VOLUME, and exposed in the Unraid template as an optional advanced path (#109)
  • Entrypoint permission errors hidden — chown failures for /downloads and /staging were silently swallowed. Errors now surface on stderr. A writability check (run as the app user) verifies /downloads on every startup and /staging when it is externally mounted, exiting with a clear error message instead of crashing deep in the application

[0.12.7] - 2026-03-02

Fixed

  • UMASK not applied to downloaded files — Shell umask was not reliably inherited by lftp through the setpriv exec chain. Now applied directly via os.umask() in Python at startup, ensuring correct file permissions for all downloaded files (#109)

[0.12.6] - 2026-02-28

Added

  • Unraid installation docs — Added Unraid Community Applications install instructions to README and Docusaurus docs site (#79)

Changed

  • Docker build optimization — Added .dockerignore, reduced build context, shared build artifacts between CI jobs
  • CI improvements — Test caching, always-rebuild test image, non-root test user
  • Poll interval tuning — Reduced unnecessary polling in logger and web app

[0.12.5] - 2026-02-28

Fixed

  • Delete Remote directory hang — Fixed infinite spinner when deleting a remote directory (#92)
  • SSH password exposed in debug logs — Mask remote_password in debug config dump output (#97)

Added

  • UMASK environment variable — Control downloaded file permissions via UMASK env var (e.g. 002 for 775/664)
  • Angular unit tests in CI — 132 Vitest unit tests now run on every CI build (#93)

Changed

  • Parallel multi-arch Docker builds — amd64 and arm64 images now build in parallel and merge into a single multi-arch manifest, reducing total release build time (#93)
  • Skip Angular build on arm64 — Build Angular natively and inject into arm64 Docker build via build-contexts, cutting arm64 CI from ~4min to ~1min
  • Angular packages — Bumped from 21.1.x to 21.2.0

Security

  • Dependabot alerts — Dismissed 4 dev-only alerts; remaining 5 are unfixable Docusaurus transitive deps (#96)

[0.12.4] - 2026-02-28

Fixed

  • RAR5 extraction failure — Replace unrar-free (RAR1-3 only) with RARLAB's full unrar (v6.21) which supports all RAR formats including RAR5. Modern archives use RAR5, causing silent extraction failures and a download-extract-fail-delete loop (#84)
  • Incomplete directory stuck in DOWNLOADED — Fix persist authority overriding children BFS check when extra local files inflate local_size >= remote_size, preventing re-download of missing remote children (#83)
  • LFTP chunk parser crash — Fix crash on rangeless \chunk lines (e.g. \chunk 5077) emitted by LFTP during parallel downloads
  • Zombie app after controller crash — Fix main loop swallowing controller exceptions, causing the app to run indefinitely without functioning instead of cleanly exiting for Docker restart
  • Extract retry loop not stopping — Fix retry counter being reset on every re-download cycle, preventing files from reaching EXTRACT_FAILED state after 3 attempts
  • Delete Local fails for staged files — Check staging path before local_path in DELETE_LOCAL so files still in staging can be deleted
  • Late-binding closure in DELETE_LOCAL — Bind delete_path as default argument so each callback captures the correct path when multiple deletes are batched
  • Manual extract silently failing — Extract dispatch errors (e.g. "no archives found") were silently swallowed, leaving the file in DOWNLOADED state with no UI feedback. Now reported as failures so the file reaches EXTRACT_FAILED state
  • Extract fails after staging move — When staging is enabled and files are moved to the final local path before extraction runs, ExtractDispatch only checked the staging path. Now falls back to local_path so archives are found in either location

[0.12.3] - 2026-02-21

Fixed

  • SSH output decoding crash — Fix UnicodeDecodeError crash when remote commands (e.g. scanfs) return output containing non-UTF-8 bytes (#76)

[0.12.2] - 2026-02-20

Fixed

  • Extraction failure handling — When extraction fails, SeedSync now retries up to 3 times by re-downloading the file. After 3 failures, the file shows a red extracting icon with "Extract failed" text so the user knows intervention is needed. Extract, Delete Local, and Delete Remote actions are all available from this state. (#70, #71, #72, #73)
  • Persist cleanup during staging moves — Fix persist cleanup incorrectly firing for files with in-flight staging moves, which caused state loss
  • Extraction timing with staging — Fix extraction starting before the staging move completed
  • LFTP parser crash on long paths — Fix crash when terminal line wrapping splits LFTP output mid-line (#69)
  • Directory download ETAs — Fix wildly inaccurate ETAs for directory downloads by using LFTP's real-time transfer sizes and EMA smoothing (#68)
  • scanfs timeout crash — Fix pexpect resource leak, add retry logic, and enable SSH keepalive (#62)
  • SSH crash on apostrophes in filenames — Fix shell crash on filenames like "Don't Look Now" (#66)
  • LFTP status parser crash — Fix crash from interleaved 'jobs -v' command echo in LFTP output (#66)
  • Error handling hardening — Fix multiple error handling bugs found during code review (#63, #64)
  • Cross-device move crash — Fix FileExistsError during staging-to-final moves across filesystems

[0.12.1] - 2026-02-14

Fixed

  • Progress bar glitch during downloads — Fix race condition where the UI progress bar randomly dropped to 0% mid-download because active file sizes were wiped when the local scanner replaced its file dict (#57)
  • Download state loss after LFTP completion — Fix download state being lost after LFTP job completion (#55)
  • LFTP pexpect timeout recovery — Fix lftp pexpect timeout recovery to prevent buffer corruption (#54)

[0.12.0] - 2026-02-13

Added

  • Staging directory — Downloads land on a fast staging disk (e.g. NVMe/SSD) first, then automatically move to the final destination after completion. (#36)
  • Dark mode — Theme toggle with a 3-surface elevation system and semantic color tokens. (#37, #51)
  • Advanced LFTP settings — Exposes tunable LFTP options in Settings — parallel connections, max total connections (0 = unlimited), and socket buffer size with human-readable suffixes (8M, 16M). (#40, #44)
  • Remote server diagnostics — Runs diagnostics against the remote seedbox on first connection, surfacing server environment info. (#41)
  • Graceful config upgrades — New config keys are automatically backfilled with defaults and saved to disk — no manual edits needed after upgrading. (#45)

Changed

  • Settings layout — Moved File Discovery below Archive Extraction in the left column. (#48)

Fixed

  • Fix crash when a remote file is removed during sync (#49)
  • Preserve DOWNLOADED state after remote file is auto-deleted (#50)
  • Fix dashboard status sort: groups ordered logically, oldest-first within each group (#47)

[0.11.3] - 2026-02-09

Fixed

  • Config persistence hardened against data loss - Config writes now use atomic file operations (temp file + fsync + rename) to prevent truncation if the process is killed mid-write. Missing config sections fall back to defaults instead of triggering a backup-and-reset cycle. A warning is now logged when config parse failure causes fallback to defaults. (#32)

[0.11.2] - 2026-02-09

Changed

  • Web access logging - Moved all HTTP request access logs from INFO to DEBUG level to reduce log noise during normal operation

[0.11.1] - 2026-02-08

Fixed

  • Config file overwritten on container restart - Config files from older versions (missing newer properties like auto_delete_remote or net_limit_rate) no longer cause parse errors that trigger a backup-and-overwrite cycle. Config loading is now resilient to missing keys (uses defaults) and unknown keys/sections (silently ignored), enabling smooth upgrades across versions.

[0.11.0] - 2026-02-08

Changed

  • Angular 4 → 21 - Complete frontend rewrite with modern Angular 21
    • Standalone components replacing NgModule architecture
    • New Angular control flow syntax (@if, @for, @switch)
    • inject() function replacing constructor dependency injection
    • Bootstrap 4 → 5.3 with JS bundle for dropdowns
    • Font Awesome 4 → 7 (Free)
    • RxJS 5 → 7 with modern pipe operators
    • Immutable.js removed — plain TypeScript interfaces
    • Node 12 → 22 for builds
    • npm install → npm ci for reproducible builds
  • Smaller transfer size - 156 kB gzipped (down from ~300 kB)
  • Settings page - Simplified layout with all sections always expanded

Added

  • Unit tests - 125 Vitest tests across 14 new spec files covering all models, pipes, and services

Removed

  • Angular 4 code - Old frontend code (src/angular-old/, src/angular-v17/) removed
  • Immutable.js - Replaced with plain TypeScript interfaces
  • ngx-modialog - Replaced with inline confirmation patterns
  • angular-webstorage-service - Replaced with direct localStorage usage
  • css-element-queries - Replaced with native ResizeObserver

[0.10.6] - 2026-02-07

Added

  • Auto-delete from remote after download - New "Delete from remote after download" option in AutoQueue settings. When enabled, files are automatically deleted from the remote seedbox after successful download, preventing the remote server from filling up. Works correctly with auto-extract — extraction runs before deletion when both are enabled. (#25)

[0.10.5] - 2026-02-07

Fixed

  • Delete remote with tilde (~) path - Fixed "Delete remote" command not working when the remote path uses ~. Now properly converts tilde to $HOME for shell expansion, matching the fix previously applied to the remote scanner. (#27)
  • Remote shell auto-detection - SeedSync now automatically detects the available shell on the remote server (/bin/bash, /usr/bin/bash, /bin/sh) instead of failing when /bin/bash doesn't exist. Uses SFTP fallback for detection when the login shell is broken. (#18)
  • SSH key auth no longer requires password - The password field is now optional when SSH key authentication is enabled. Previously required a dummy value. (#21)
  • Config serialization of None values - Fixed None values being written as the string "None" in config files, which caused issues with new optional fields.

Added

  • Bandwidth/speed limit - New "Bandwidth Limit" setting in the Connections section allows capping download speed. Supports values like 500K, 2M, or raw bytes/sec. Set to 0 or leave empty for unlimited. (#24)
  • SSH key auth documentation - README and docker-compose now document how to mount SSH keys for password-less authentication.

Changed

  • Shared remote path utilities - Extracted tilde-aware path escaping into a shared utility module for reuse across scanner and delete operations.
  • Makefile test target - Fixed make test to install all required Python dependencies.

[0.10.4] - 2026-01-27

Fixed

  • Remote paths with tilde (~) - Fixed remote scanner to properly handle paths containing ~. The tilde is now converted to $HOME for shell expansion, allowing users whose SSH and LFTP paths differ (e.g., LFTP locked to home directory). (#14)
  • LftpJobStatusParser crash on empty output - Fixed parser crashing with "Missing queue header line 1" when lftp jobs -v returns empty or unexpected output. Now gracefully returns empty status instead of crashing. (#15)
  • ANSI escape codes in LFTP output - Fixed parser failing on "First line is not a matching header" when LFTP output contains ANSI escape sequences like bracketed paste mode (^[[?2004l). These terminal control codes are now stripped before parsing. (#15)

[0.10.3] - 2026-01-27

Fixed

  • Restart button - Fixed server restart functionality that was broken due to Bottle framework's custom __setattr__ blocking attribute updates. Now uses threading.Event for thread-safe signaling.
  • Settings persistence - Settings are now properly saved before restart
  • Restart notification - "Restart the app to apply new settings" notification now clears immediately when restart button is clicked

Changed

  • About page - Updated GitHub repository link to nitrobass24/seedsync and copyright information

[0.10.2] - 2026-01-27

Fixed

  • scanfs architecture mismatch - Force AMD64 build for scanfs binary since it runs on remote seedbox servers, not locally. Fixes "cannot execute binary file: Exec format error" on ARM-based local machines.

[0.10.1] - 2026-01-27

Reverted

  • Angular 17 rollback - Reverted to Angular 4 due to runtime issues. Angular 17 code preserved in src/angular-v17/ for future work.

Changed

  • Dockerfile - Reverted to Node 12 for Angular 4 compatibility

[0.10.0] - 2026-01-27

Changed

  • Angular 4 → 17 - Complete frontend rewrite with modern Angular
    • Standalone components (no NgModules)
    • Bootstrap 4 → 5.3 (removes jQuery dependency)
    • RxJS 5 → 7 with pipe operators
    • Immutable.js removed (native TypeScript)
    • ngx-modialog → Angular CDK Dialog
    • Node 12 → Node 20 for builds
  • Smaller JS bundles - ~150-200KB reduction from removed dependencies
  • scanfs builder - Now uses Debian Bullseye (glibc 2.31) as Buster repos are EOL

Added

  • src/angular-v4/ - Original Angular 4 code preserved for rollback if needed

Fixed

  • Dockerfile compatibility - Fixed Python/Debian version combinations for multi-stage build

[0.9.4] - 2026-01-26

Fixed

  • Docker entrypoint UID/GID handling - Fixed container crash when PGID matches an existing group ID in the container (e.g., Synology with GID 101). Now checks for existing UID/GID by ID instead of name, allowing reuse of pre-existing system groups. (#4)
  • scanfs glibc compatibility - Fixed "Failed to load Python shared library" error on older seedbox servers by building scanfs on Debian Buster (glibc 2.28) instead of Bookworm (glibc 2.36). Now supports Linux systems from 2018+. (#5)

Changed

  • Improved entrypoint logging - Now shows whether existing users/groups are being reused for easier debugging of permission issues

[0.9.3] - 2026-01-26

Security

  • Updated requests to >=2.32.0 (fixes credential leak, session verification issues)
  • Updated urllib3 to >=2.2.0 (fixes redirect bombs, decompression vulnerabilities)
  • Updated certifi to >=2024.7.4 (removes revoked root certificates)
  • Updated pyinstaller to >=6.0 (fixes privilege escalation in build)

Removed

  • poetry.lock - Removed unused lock file that was triggering 30 Dependabot alerts
  • mkdocs/mkdocs-material - Removed documentation tools from pyproject.toml (not needed at runtime)

Changed

  • Cleaned up pyproject.toml with explicit version constraints

[0.9.2] - 2026-01-26

Fixed

  • Python 3.12 regex warnings - Converted all regex patterns to raw strings across:
    • lftp/job_status_parser.py - LFTP output parsing patterns
    • system/scanner.py - File size parsing patterns
    • controller/extract/dispatch.py - RAR file extension pattern

Changed

  • CI workflow - Updated softprops/action-gh-release to v2 with make_latest: true

[0.9.1] - 2025-01-25

Changed

  • Docker-only deployment - Removed Debian package support, simplified to Docker-only
  • Image size reduced 45% - From 439MB to 240MB
  • Python 3.12 - Updated from Python 3.11 to 3.12
  • Replaced Poetry with pip - Faster builds, smaller image
  • Replaced node-sass with sass - Pure JS, no native compilation needed
  • Fixed Python 3.12 regex warnings - Updated to raw strings

Removed

  • Debian packaging (src/debian/)
  • Legacy build files (src/docker/build/deb/, src/docker/stage/)
  • mkdocs/mkdocs-material from runtime (documentation tools not needed)

Added

  • requirements.txt - Minimal runtime dependencies
  • Simplified Makefile with Docker-focused commands

[0.9.0] - 2025-01-25

Fixed

  • Docker image now works - Complete rewrite of Dockerfile to properly build all components
  • Angular frontend included - Web UI was missing from previous Docker builds
  • scanfs binary included - File system scanner now properly built and included
  • PUID/PGID permissions - Improved entrypoint script for proper user/group handling
  • Python 3.11 support - Updated from Python 3.8 (EOL) to Python 3.11
  • TypeScript build errors - Fixed type conflicts in Angular build

Changed

  • Dockerfile: Complete multi-stage build that includes:
    • Stage 1: Angular frontend build (Node 12)
    • Stage 2: scanfs binary build (PyInstaller)
    • Stage 3: Python runtime with all components
  • pyproject.toml: Updated Python version constraint from ~3.8 to ^3.8 (allows 3.8-3.12)
  • package.json: Updated node-sass version for build compatibility
  • tsconfig.json: Added skipLibCheck to resolve type definition conflicts
  • entrypoint.sh: Enhanced permission handling for mounted volumes

Added

  • docker-compose.dev.yml: Development compose file for easy local testing
  • MODERNIZATION_PLAN.md: Documentation of codebase architecture and future roadmap

Technical Notes

  • Base image: python:3.12-slim-bookworm
  • Node version for Angular build: 12.22 (required for Angular 4.x compatibility)
  • Uses pip for Python dependency management (faster, smaller)
  • Multi-architecture support preserved (amd64, arm64, arm/v7)

Known Issues

  • Angular 4.x is outdated but functional; upgrade to modern Angular would require significant work
  • Some seedbox providers may have issues with the scanfs binary due to /tmp mount restrictions (see GitHub issues #97, #136)

Previous Releases

See the original repository for earlier changelog entries: https://github.com/ipsingh06/seedsync/releases