NZBGet Release Notes

What's Changed

• Merge pull request #826 from nzbgetcom/develop by @dnzbk in #831
• v26.3-testing by @dnzbk in #832
• Fix: guard addEventListener and Status.status accesses by @dnzbk in #834
• Fix: feed category priority and consolidate category resolution by @dnzbk in #835
• Update DirectUnpack description and WriteLog default value by @dnzbk in #837
• Fix: JSON-RPC param reader by @dnzbk in #843
• Fix WebUI crash on startup with non-English languages by @dnzbk in #845
• 7zip 26.02 / Unrar 7.23 update by @phnzb in #847
• Add per-feed certificate verification option by @dnzbk in #846
• Fix printf format specifiers for int64 and size_t by @xbmc4lyfe in #856
• Fix broken sanitizer flags, segfault crashes and data races by @dnzbk in #851
• Fix: preserve category for compressed archives in NzbDir subdirectories by @dnzbk in #860
• Fix System tests due to their rare random failures by @xbmc4lyfe in #859
• Fix error message for OS release retrieval on Linux by @simons-public in #864
• Fix: SkipWrite causes infinite spin loop by @dnzbk in #871
• Add AI-Assisted Contributions Policy by @phnzb in #873
• Add support for extension i18n by @dnzbk in #872
• Remove about_caption from generate_locales and EXTENSIONS.md by @dnzbk in #874
• Fix Download Remaining Files (From History) Doesn't work for Health failed files by @xbmc4lyfe in #870
• fix(i18n): translate leftover English in pl and hu locale files by @dnzbk in #876
• Fix UnpackPassFile is never consulted for 7z archives with encrypted headers by @dnzbk in #877
• Fix tests skipping without assertions when unrar/7z unavailable by @dnzbk in #878
• chore: cleanup sources.cmake, gitignore, and cmake policy warnings by @dnzbk in #880
• Fix functional test suite on Python 3 and modern pytest by @xbmc4lyfe in #883
• Bump par2-turbo to v1.4.0-20260803, pass -T flag, and clamp stage progress by @dnzbk in #885
• Fix parsing of the filename from the Content-Disposition header by @xbmc4lyfe in #865
• Fix cppcheck errors identified in CI and add .clang-tidy / .clangd configs for consistent static analysis by @dnzbk in #811
• Fix feed preview for new (unsaved) feeds by @dnzbk in #893
• Harden web auth token generation and unpack-dir symlink handling by @dnzbk in #894
• Fix Windows Debug build by @dnzbk in #895
• Update rapidyenc to v1.1.1-20260821 by @dnzbk in #896
• Fix about message generation by @dnzbk in #897
• Prefer episode identity for RSS duplicate keys by @xbmc4lyfe in #868
• Fix par2 status translation by @dnzbk in #901
• Fix missing path separator in auto-detected config template path by @wolph in #902
• Fix 'Clear' btn translation by @dnzbk in #904
• Add v26.3 changelog by @dnzbk in #905
• Release v26.3 by @dnzbk in #907
• v27 Testing by @dnzbk in #908
• Fix DirectUnpack finalization after PAR failure by @xbmc4lyfe in #869
• Fix duplicate extension config entries by @xbmc4lyfe in #867
• Set the speed limit in the global display unit by @wolph in #903

New Contributors

• @xbmc4lyfe made their first contribution in #856
• @simons-public made their first contribution in #864
• @wolph made their first contribution in #902

Full Changelog: v26.2...testing

What's Changed

Caution

Version 26.3 is the final release supporting legacy architectures and older OS baselines:

• Linux MIPS (mipseb, mipsel)
• Linux PowerPC e500 (ppc500)
• Linux kernel < 3.2 (Kernel 2.6.x series is now deprecated)
• macOS < 12.0 (Monterey 12+ will be our new baseline)

Features:

• Added support for extension i18n #872
• Added per-feed certificate verification option #846
• Updated 7-Zip to 26.02 and UnRAR to 7.23 #847

Bug fixes:

• Fixed missing path separator in auto-detected config template path #902
• Fixed feed preview for new (unsaved) feeds #893
• Fixed RSS episode duplicate keys #868
• Hardened web auth token generation and unpack-dir symlink handling #894
• Fixed WebUI crash on startup with non-English languages #845
• Fixed WebUI runtime errors from unguarded addEventListener and Status.status accesses #834
• Fixed feed category priority and consolidated category resolution #835
• Fixed JSON-RPC param reader #843
• Fixed category not preserved for compressed archives in NzbDir subdirectories #860
• Fixed SkipWrite causing an infinite spin loop #871
• Fixed "Download Remaining Files" not working for Health-failed files from History #870
• Fixed UnpackPassFile not being consulted for 7z archives with encrypted headers #877
• Fixed parsing of the filename from the Content-Disposition header #865
• Fixed error message for OS release retrieval on Linux #864
• Fixed segfault crashes and data races #851
• Fixed printf format specifiers for int64 and size_t #856
• Translated leftover English strings in Polish and Hungarian locale files #876
• Updated DirectUnpack description and WriteLog default value #837

For developers:

• Added AI-Assisted Contributions Policy #873
• Bumped par2-turbo to v1.4.0-20260803 #885
• Updated rapidyenc to v1.1.1-20260821 #896
• Fixed functional test suite on Python 3 and modern pytest #883
• Fixed rare random failures in System tests #859
• Fixed tests skipping without assertions when unrar/7z unavailable #878
• Fixed cppcheck errors in CI and added .clang-tidy / .clangd configs for consistent static analysis #811

What's Changed

Features:

WebUI internationalisation (i18n) and unit switching #813

Added client-side i18n engine with locale loading, language detection, and DOM translation via data-i18n attributes;

Unit switching for network speed display (MB/s <-> Mb/s);

Added per-language translation files for 20 languages;

Added an indicator icon alignment in the Downloads table headers;

Improved text readability — config description help blocks now preserve original formatting from nzbget.conf;

Improved layout adaptability and responsiveness;

Added support for ~/.config config locations #794

Added 'This Year' total to bandwidth usage on statistics #801

Added Clear button to History page #804

nserv: log datetime #717

Bug fixes:

Fixed handling of server speed tests bound to a specific server #781

Fixed auto-category overriding manual category via CLI #787

Fixed SystemHealth validators #791

Fixed SkipWrite option #792

Fixed iPadOS file uploads and sanitized DOM inputs to prevent XSS vulnerability #793

Fixed macOS dark mode readable text and NZB file association #795

Fixed RSS feed text fragmentation causing whitespace loss in element content #796

Fixed WebUI RSS "Add" dialog ignoring item-level category when CategorySource is NZBFile or Auto #827

Prevented symlink attacks and TOCTOU races in daemon startup #798

Fixed new-version flag to only trigger on same update channel #800

Fixed iOS auto-capitalizing the login username field #805

Suppressed WriteLog info/warning health checks and added LoggingValidator tests #803

Fixed hanging server speed tests #807

Fixed resource leaks in socket/listener and script pipe error paths #797

Fixed WebUI "InternalError: allocation size overflow" on very large file uploads #818

For developers:

Fixed missing nzbget.h include order in Cleanup.cpp #782

CI: added build-disabled-pch job to verify compilation works without PCH #783

CI: changed 7-zip sources from 7-zip.org to GitHub #786

CI: fixed latest artifacts creation #790

Updated 7-Zip to 26.01 and UnRAR to 7.21 #802

Bumped UnRAR to 7.22 (Windows/macOS only) #822

What's Changed

Merge pull request #778 from nzbgetcom/develop by @dnzbk in #779

v26.2-testing by @dnzbk in #780

Fix handling of server speed tests bound to a specific server by @dnzbk in #781

Fix missing nzbget.h include order in Cleanup.cpp by @sbraz in #782

Add build-disabled-pch job to verify compilation works without PCH by @dnzbk in #783

CI: change 7-zip sources from 7-zip.org to GitHub by @phnzb in #786

Fix: prevent auto-category from overriding manual category via CLI by @dnzbk in #787

CI: fix latest artifacts creation by @phnzb in #790

Fix SystemHealth validators by @dnzbk in #791

Fix SkipWrite option by @dnzbk in #792

Add support for ~/.config config locations by @dnzbk in #794

Fix iPadOS files upload and sanitize DOM inputs to prevent XSS vulnerability by @dnzbk in #793

nserv: log datetime by @sanderjo in #717

Fix macOS dark mode readable text and NZB file association by @dnzbk in #795

Resolve text fragmentation issues by @bket in #796

Fix resource leaks in socket/listener and script pipe error paths by @bket in #797

Prevent symlink attacks and TOCTOU races in daemon startup by @bket in #798

Fix: only flag new-version if same update channel by @dnzbk in #800

Add a 'This Year' total to bandwidth usage on statistics by @dnzbk in #801

7zip 26.01 / Unrar 7.21 update by @phnzb in #802

Fix: prevent iOS from auto-capitalizing the login username field by @jayhostetter in #805

Suppress WriteLog info/warning health checks and add LoggingValidator tests by @dantraynor in #803

Fix: resolve hanging server speed tests by @dnzbk in #807

Add Clear button to History page by @dantraynor in #804

WebUI i18n, unit switching, and other improvements by @dnzbk in #813

Fix: only show news-server translation hint when description mentions it by @dnzbk in #815

Fix WebUI "InternalError: allocation size overflow" on very large file uploads by @neuhaus in #818

Fix: FreeBSD linker issue by @phnzb in #820

Fix: translate RSS feed table headers and resolve WebUI i18n initialization race conditions by @dnzbk in #816

Unrar 7.21 update (Windows / macOS) by @phnzb in #822

Fix WebUI: NewsServers TypeError, overflow of labels and modal dialogs by @dnzbk in #823

New Contributors

@jayhostetter made their first contribution in #805

@dantraynor made their first contribution in #803

@neuhaus made their first contribution in #818

Full Changelog: v26.1...testing

What's Changed

Features:

Improved archived NZB handling suppor #763

Added NzbDirArchiveScan option to configure scanning archives (zip, rar, 7z, etc.) in NzbDir for .nzb files;

Added NzbDirArchiveAction option to define the post-scan behavior (move or delete) for processed archives.

Switched yEnc implementation to rapidyenc for SIMD acceleration #751.

Bug fixes:

Docker: Fixed entrypoint to run as PID 1 #731;

POSIX: Ensured daemon ownership for files created at startup #726;

Fixed missing log file on startup #753;

Fixed 0-byte file created if article download fails and renaming an ongoing download leads to needless par repair #768;

Fixed SIGFPE crash in JoinFile when file segments are empty #772.

For developers:

Switched to std::filesystem and fixed Linux 2.6.32 compatibility #745;

Updated OpenSSL to 3.5.5 (Linux/FreeBSD/Android), UnRAR to 7.20, and 7-Zip to 26.00 (remains 25.01 on macOS Mojave for compatibility) #742;

Updated par2-turbo to v1.4.0 #752.

What's Changed

Features:

SystemHealth: Advanced configuration and environment diagnostics #722

Added validation methods to check for conflicting settings, suboptimal values, and missing dependencies;

Introduced a status reporting mechanism (Info/Warning/Error) to guide users toward better configuration;

Enhanced detection of filesystem and hardware compatibility issues at startup;

Added SystemHealthCheck option to enable/disable configuration validation.

Support for processing compressed NZB archives #711

Added support for importing NZB files directly from compressed archives (e.g., RAR, ZIP, GZIP);

Archives dropped into the NzbDir (watch folder) or uploaded via the WebUI are now automatically processed.

Hardlinking during Direct Rename, allowing immediate access to files #614

Added HardLinking option to create hardlinks in the destination directory during download;

Added HardLinkingIgnoreExt to exclude specific file types from being hardlinked.

WebUI and Settings page improvements #676

Added the LICENSES tab;

Added social media links to the INFO page;

Fixed the position of the "Save all changes" button - it’s now aligned with the sidebar;

Centered content on large screens (content is now centered instead of stretched full-width);

Added a dedicated scroll area for the main content - the main content can now be scrolled independently of the sidebar and the "Save all changes" button.

Windows release binaries and installer signing by SignPath #699.

Bug fixes:

Fixed potential deadlocks and Undefined Behavior (UB) #686;

Fixed JSON parser to correctly handle nested arrays and objects #702;

Fixed UU decoding issues #710;

Fixed ScriptOrder having no effect for extensions #714;

Added environment size check to log a warning if it exceeds the system limit on POSIX #721.

For developers:

NSERV improvements #674

Handle AUTHINFO USER & AUTHINFO PASS as defined in RFC;

Added the STAT request support.

Updated OpenSSL to 3.5.4 #720;

macOS pipeline #703

x86_64 build: change runner to macos-14;

universal build: update build and sign steps to run on macos-14.

Docker #723

Updated the image to Alpine 3.22;

Updated 7zip to 25.01.

What's Changed

Features:

Automatic category detection from NZB file metadata #615:

The API method append now has a new argument:

AutoCategory (bool) - If true, the category will be automatically detected from the NZB file (if available);

Extended web UI with "Auto-detect category" checkbox in upload dialog;

Introduced a CategorySource option for RSS feeds, providing granular control over where category information is retrieved;

Added an option to disable the _unpack intermediate folder when unpacking.

This allows for immediate access to files during the unpacking process #617.

Bug fixes:

Fixed macOS x64 Mojave support #613.

For developers:

• Integrated the Boost.Filesystem library for cross-platform file system operations.

We're using Boost.Filesystem to ensure compatibility with older systems
and plan to transition to the std::filesystem library in the future #636;

• Updated unrar:

Linux: from 7.11 to 7.13;

macOS: from 7.11 to 7.12;

Windows: from 7.11 to 7.13.

What's Changed

Features:

Added support for extracting file size from the description field in RSS feeds, providing more info upfront #580

Bug fixes:

OpenSSL memory leaks and vulnerabilities associated with older SSL/TLS protocols #591

Fixed memory leaks caused by unreleased per-thread OpenSSL resources.

Security Improvement: updated to use the latest and most secure TLS protocol supported by the client and server, mitigating known vulnerabilities in older SSL/TLS protocols.

RSS feed segfault. Improved memory safety and prevent potential undefined behavior (UB) #569

Correctly parse yEnc headers with combined name/ypart lines #571

Data race in ExtensionManager that could cause application crashes #577

Added additional checks for missing server configuration options to prevent errors in webui #581

Prevented showing of negative age caused by incorrect dates in NZB file #583

Improved parsing of yEnc subjects without surrounding quotes, e.g. "[34/44] - id.bdmv yEnc (1/1)" #584

For developers:

Upgraded par2-turbo to v1.3.0 #586

Added support for newer versions of the libxml2 library (v2.12+), ensuring the application continues to work on modern systems #575

Updated OpenBSD tests workflow to 7.7 #573

Refactored Util::StrToNum by improving performance, safety and minimizing memory usage #578

Using the system’s built-in regex library instead of an older version #589

Resolved some analyzer warnings #590

Building the app without TLS support is now deprecated and will be removed in future releases.

What's Changed

Features:

Completion and downloaded data statistics #544

added a new "Statistics" page to display completion and download volume analytics for news-servers.

the API method "resetservervolumes" now allows for selective resetting of counters. Arguments:

ServerId (int) - Server ID to reset.

Counter (string) - Specifies which counter to reset. The behavior depends on the value of this argument:

"CUSTOM" (case-sensitive) - Resets only the custom counter associated with the server. Use this option to clear custom statistics while preserving overall download volume data.

"" (empty string) - Resets all counters associated with the server, including the overall download volume and any custom counters.

the API method "servervolumes" now returns 2 additional properties:

CountersResetTime (int) - Date/time of the last reset of all counters (time is in C/Unix format).

ArticlesPerDays (struct[]) - Per-day amount of failed and success articles since program installation. Contains an array of structs with following fields:

Failed (int) - Amount of failed articles.

Success (int) - Amount of success articles.

Flatpak support #550

Snap support #559

Added support of running Docker image rootless #541

Bug fixes:

Deobfuscation: handle hashed filenames with a length of 16 or more #548

Direct unpack failures when processing non-archive files #549

Fixed found memory leaks, potential ub, buffer overflows, cppcheck and compiler warnings #552 #561

Correctly decode Unicode escape sequences in JsonDecode #560

For Developers:

Updated Docker, Libraries, Unpackers #555

updated Docker base image (alpine:3.19.1 -> alpine:3.21.3) and Dockerfile

updated and synced libraries versions for all installers (previous versions specified for Linux installers):

LibXML2 2.12.4 -> 2.13.5

ncurses 6.4 -> 6.5

Gzip 1.3.1

OpenSSL 3.1.2 -> 3.4.1

Boost 1.84

updated unpackers for installers:

7-Zip 24.05 -> 24.08

UnRAR 7.0 -> 7.11 (Windows x32 7.01, no newer version available)

updated FreeBSD build script and workflow to build on Ubuntu 24.04

Fixed app build, using Xcode CMake generator #538

Fixed TOOLCHAIN_PREFIX were not used by the project (warning) #543

Fixed a build issue on systems lacking native atomic library support #562

Removed GnuTLS support #554

Reasons for removing GnuTLS support:

Maintenance overhead. Maintaining support for two SSL/TLS libraries (OpenSSL and GnuTLS) significantly increases our maintenance burden. Currently, we exclusively use OpenSSL in all production builds.

Boost.Asio incompatibility. The Boost.Asio library, which can be used for cross-platform socket and TLS handling, does not support GnuTLS. Our planned migration of network logic to Boost.Asio makes GnuTLS support redundant.