aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-02-19Merge pull request #16263 from jellyfin/fix/replace-pull-request-targetAndrew Rabert
Mitigate pull_request_target privilege escalation
2026-02-19Mitigate pull_request_target privilege escalationAndrew Rabert
Hotfix — replaces pull_request_target with pull_request to stop granting write permissions and secrets to fork PRs. Some workflows will break; can be fixed properly later.
2026-02-18Upgrade Swashbuckle to v10Shadowghost
2026-02-18Fix malformed query string in StreamInfo.ToUrl() causing 500 error via proxiesCosmin Dumitru
StreamInfo.ToUrl() generated URLs like `/master.m3u8?&DeviceId=...` (note `?&`) because `?` was appended to the path and all parameters started with `&`. When the first optional parameter (DeviceProfileId) was null, the result was a malformed query string. This is harmless when clients hit Jellyfin directly (ASP.NET Core tolerates `?&`), but when accessed through a reverse proxy that parses and re-serializes the URL (e.g. Home Assistant ingress via aiohttp/yarl), `?&` becomes `?=&` — introducing an empty-key query parameter. ParseStreamOptions then crashes on `param.Key[0]` with IndexOutOfRangeException. Changes: - StreamInfo.ToUrl(): Track query start position and replace the first `&` with `?` after all parameters are appended, producing valid query strings - ParseStreamOptions: Guard against empty query parameter keys - Tests: Remove .Replace("?&", "?") workaround that masked the bug Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-18Merge pull request #16104 from jellyfin/renovate/tmdblib-3.xNiels van Velzen
Update dependency TMDbLib to v3
2026-02-18Optimize item count calculation for named itemsShadowghost
2026-02-17Fix cleanup for BDMVShadowghost
2026-02-17Merge pull request #16249 from jellyfin/renovate/ci-depsBond-009
2026-02-17Update actions/stale action to v10.2.0renovate[bot]
2026-02-16Enforce permissions on BoxSetsShadowghost
2026-02-16Add the filename to the exception's trace to facilitate error resolution ↵Loïc CORBASSON
(see #12254, #9508, ...)
2026-02-16Fix library performanceShadowghost
2026-02-16Cleanup orphan itemsShadowghost
2026-02-15Fix Extra refreshShadowghost
2026-02-15Migrate PrimaryVersionId to GUID and fix assignmentShadowghost
2026-02-15Try fixing orphan versions againShadowghost
2026-02-15Fix orphaned alt version cleanupShadowghost
2026-02-15Remove split queriesShadowghost
2026-02-15Fix buildBond_009
2026-02-15Merge pull request #16242 from jellyfin/renovate/coverlet.collector-8.xBond-009
Update dependency coverlet.collector to v8
2026-02-15Update dependency TMDbLib to v3renovate[bot]
2026-02-15Merge pull request #16236 from theguymadmax/fix-season-unknownBond-009
Fix episodes appearing in Season Unknown incorrectly and prevent unnecessary virtual season creation
2026-02-15Fix ordering of cleanup in migrationShadowghost
2026-02-15Merge remote-tracking branch 'upstream/master' into perf-rebasedShadowghost
2026-02-15Add cleanup for orphaned versionsShadowghost
2026-02-15Update dependency coverlet.collector to v8renovate[bot]
2026-02-14Use artist images for music library thumbnailtheguymadmax
2026-02-14Merge pull request #16144 from DerMaddis/series-production-yearBond-009
TmdbSeriesProvider: Set ProductionYear field
2026-02-14Merge pull request #16235 from jellyfin/renovate/ci-depsBond-009
Update github/codeql-action action to v4.32.3
2026-02-14Merge pull request #15138 from kevgrig/issue15137Bond-009
Add moveToTop option to IPlaylistManager.AddItemToPlaylistAsync
2026-02-14Merge branch 'master' into issue15137Bond-009
2026-02-14Update Jellyfin.Api/Controllers/PlaylistsController.csBond-009
2026-02-14Merge pull request #14709 from loop95/fix-artist-kairon-irseBond-009
Fix: Add 'Kairon; IRSE!' to artist whitelist
2026-02-14Merge pull request #16214 from jellyfin/renovate/asynckeyedlock-8.xBond-009
Update dependency AsyncKeyedLock to 8.0.2
2026-02-14Merge pull request #16217 from jellyfin/renovate/microsoftBond-009
Update Microsoft to 10.0.3
2026-02-14Merge pull request #16216 from jellyfin/renovate/dotnet-monorepoBond-009
Update dependency dotnet-ef to v10.0.3
2026-02-14Backport pull request #16231 from jellyfin/release-10.11.ztheguymadmax
Skip image checks for empty folders Original-merge: 8cd3090ceedbefd680b26dc28266ae9a6e5d652a Merged-by: Bond-009 <bond.009@outlook.com> Backported-by: Bond_009 <bond.009@outlook.com>
2026-02-14Backport pull request #16227 from jellyfin/release-10.11.zdfederm
Reattach user data after item removal during library scan Original-merge: be712956932a9337f0706fd8ef68eb53feb3f4ff Merged-by: Bond-009 <bond.009@outlook.com> Backported-by: Bond_009 <bond.009@outlook.com>
2026-02-14Backport pull request #16226 from jellyfin/release-10.11.zdfederm
Deduplicate provider IDs during MigrateLibraryDb migration Original-merge: 58c330b63d5e373ed1d9260a75d837922ca68830 Merged-by: Bond-009 <bond.009@outlook.com> Backported-by: Bond_009 <bond.009@outlook.com>
2026-02-14Backport pull request #16116 from jellyfin/release-10.11.zsaltpi
Fix TMDB image URLs missing size parameter Original-merge: caa05c1bf2c55053a65091886f0ddf78865fc72c Merged-by: Bond-009 <bond.009@outlook.com> Backported-by: Bond_009 <bond.009@outlook.com>
2026-02-13Apply review feedbacktheguymadmax
2026-02-13Fix episodes appearing in Season Unknown incorrectly and prevent unnecessary ↵theguymadmax
virtual season creation
2026-02-13Update github/codeql-action action to v4.32.3renovate[bot]
2026-02-13add to CONTRIBUTORS.mdDerMaddis
2026-02-13TmdbSeriesProvider: Set ProductionYear in SearchResult mappersDerMaddis
2026-02-12Update dependency AsyncKeyedLock to 8.0.2renovate[bot]
2026-02-12Fix filename truncation when bracketed tags appear mid-filenametyage
2026-02-10Update Microsoft to 10.0.3renovate[bot]
2026-02-10Update dependency dotnet-ef to v10.0.3renovate[bot]
2026-02-10Merge pull request #16202 from JPVenson/feat/devcontainerupdateNiels van Velzen
Fix container and updated
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-09 03:30:30 +0000