Seerr Release Notes

3.5.0 - 2026-09-28

Warning

Breaking change: Plex and Jellyfin library API endpoints (#3321)

GET /settings/plex/library and GET /settings/jellyfin/library no longer accept the sync or enable query parameters, and reading libraries no longer changes their enabled state. If you have scripts, integrations, or third-party clients that use these to sync or toggle libraries, switch to:

Sync libraries: POST /settings/plex/library/sync and POST /settings/jellyfin/library/sync

Enable or disable a library: PUT /settings/plex/library/{libraryId} and PUT /settings/jellyfin/library/{libraryId}

The web UI already uses the new endpoints, so only direct API consumers are affected. Because of that limited scope, this ships in a minor release rather than a major one.

🚀 Features

• (api) Send a Seerr user agent on outbound requests (#3395) - (a123d20)
• (notifications) Add support for ntfy.sh tags (#3350) - (92bad10)
• (notifications) Add embed poster option for Gotify (#3332) - (afb17aa)
• (overriderules) Apply override rules to advanced requests (#2164) - (794743a)
• (settings) Hide already requested media (#1855) - (6f5a177)
• (users) Add search box for user lookup by username or email (#2482) - (aae8816)
• Add a demo feature (#3017) - (38581ca)
• Add support for custom plex metadata provider guid scheme in scanner (#3316) - (7baed83)

🐛 Bug Fixes

• (api) Stop library reads from resetting enabled flags (#3321) - (985ddef)
• (auth) Refresh avatar on Quick Connect login (#3504) - (d4eeea8)
• (datasource) Break import cycle mistyping postgres timestamps (#3449) - (d7b08bd)
• (datasource) Register entities and subscribers explicitly (#3375) - (0f79ee6)
• (db) Remap leftover Overseerr DELETED status after migration (#3510) - (2bebae8)
• (db) Drop stale auth unique on sqlite push subscriptions (#3391) - (5f4cb1e)
• (discover) Fix tv title sorting and validate sortBy per media type (#3305) - (2759058)
• (jellyfin-api) Update Authorization headers for Jellyfin (#3502) - (de57e7a)
• (login) Hide quick connect button for emby servers (#3369) - (d103787)
• (override-rules) Keep values set by advanced requesters (#3539) - (b919443)
• (override-rules) Match default *arr server by id (#3428) - (7fae95b)
• (plex) Limit concurrent watchlist metadata requests (#3251) - (103976d)
• (request) Render anime notice alert in a div instead of a p (#3331) - (1fd35f9)
• (requests) Serialize requests for the same title (#3380) - (cc6f5c7)
• (requests) Stop editing a request from re-requesting covered seasons (#3379) - (10483e2)
• (requests) Enforce the quota when editing a request (#3378) - (8f0a977)
• (requests) Skip seasons with no episodes when requesting all seasons (#2698) - (1dbf19b)
• (requests) Scope download status to requested seasons on request cards (#3412) - (c604bcc)
• (requests) Serialize request creation per user (#3377) - (d7dc7bd)
• (requests) Stop editing a request from stealing another's season (#3376) - (17fc4cc)
• (requests) Reset orphaned season statuses when a request is deleted (#3279) - (970bb54)
• (requests) Enforce pending and failed states on request routes (#3385) - (9f6403e)
• (scanner) Confirm orphan candidates against the servers before declining (#3399) - (34b28d0)
• (server) Respond instead of hanging on proxy route errors (#3501) - (a53f49b)
• (settings) Mutate the query-string status key for modal immediately (#3432) - (5af32cb)
• (sonarr) Apply configured series type to non-anime requests (#3329) - (42bee2a)
• (sonarr) Decouple anime root folder routing from seriesType (#3328) - (93c0b6a)
• (subscriber) Keep issue comment lookups on the owning save's connection (#3536) - (68e01b9)
• (subscriber) Keep request status updates on the owning save's connection (#3366) - (059008c)
• (tv) Prevent phantom specials from blocking season request (#3351) - (7997f75)
• (ui) Stop the slideover backdrop flashing back on close (#3451) - (df743f4)
• (ui) Stop appear leaking onto the DOM in Modal and SlideOver (#3446) - (da4b555)
• (ui) Don't mark empty collections as available (#3431) - (92f8404)
• (webpush) Resolve push subscription bugs for multi-device and shared browsers (#3142) - (59d5947)
• Fix empty discordId in comment webhooks (#3467) - (e73825b)
• Prevent hideAvailable/hideBlocklisted from filtering person results (#3434) - (0be53e6)
• Stop masking connection failures across media server sync and login (#3324) - (4d17e08)
• Keep library settings when renamed on media server (#3323) - (c9f2ac5)
• Changes the suggested url from plex's "hosted" app (#3250) - (d3c070e)

📖 Documentation

• (discord) Document the Thread ID notification setting. (#3481) - (7afbb29)
• (docker) Add cap-drop and security-opt to docker command (#3472) - (a4f5eaa)
• Clarify ai disclosure policy further (#3358) - (dea5960)

⚡ Performance

Bound tmdb cache & split scan lookups into their own tier (#3367) - (59ad5f1)

🚜 Refactor

• (avatarproxy) Remove unused auth header from avatarproxy (#3503) - (b211652)
• (ui) Use the Radio component instead of RadioGroup.Option (#3454) - (46d5915)
• (ui) Use headlessui flat named exports (#3453) - (aa8e0de)

🧪 Testing

• (cypress) Stop dirty restartRequired flag cascading across specs (#3368) - (39ff48c)
• Block outbound HTTP in unit tests (#3511) - (abe2f3b)
• Add scanner update rate override for testing (#3241) - (7a76142)

⚙️ Miscellaneous Tasks

• (actions) Update github actions (#3478) - (a3dbbd9)
• (actions) Update github actions (major) (#3471) - (6bf3d04)
• (actions) Update github actions (#3306) - (5a5f059)
• (duplicate-detector) Switch embeddings to bge-small-en-v1.5 (#3541) - (4fd0da0)
• (i18n) Update translations from Weblate - (68c5bc8)
• (i18n) Update translations from Weblate - (5f97227)
• (i18n) Update translations from Weblate - (5c04640)
• (i18n) Update translations from Weblate - (cc592e8)
• (release) Prepare v3.5.0 - (e2f24cb)
• (release) Prepare 3.5.0 release - (cd0fb22)
• Remove third party action dawidd6/action-download-artifact (#3480) - (6fa7473)
• Fix release workflow verify attestation (#3337) - (090c659)
• Exclude .pnpm-store from Docker build context (#3313) - (bd491c7)

New Contributors ❤️

• @atilaszsz made their first contribution
• @aussierk made their first contribution
• @Xyerophyte made their first contribution
• @Knat-Dev made their first contribution
• @britsync07-prog made their first contribution
• @MannXo made their first contribution
• @bartdelange made their first contribution
• @Arul1998 made their first contribution
• @tuvokian made their first contribution
• @peruzzof made their first contribution
• @lichie567 made their first contribution
• @samtheruby made their first contribution

Deleting a title that was still on someone's watchlist got it re-requested on the next sync and on every sync after that, as the only thing sync looked at was the media status. Entries are now recorded per user with the watchlistedAt timestamp Plex reportes, so an entry is acted on once. Removing a title from the watchlist and adding it back produces a new timestamp, which is a new entry, so it gets requested again. Shows track which seasons were handled, so new seasons still come through and re-adding the series resets it.

fix 3222

Library scans and availavilit sync fetched the full /tv/:id payload including aggregate_credits and cached it for 12 hours in the same unbounded cache the interactive TV detail page uses, so a full scan left most of a library resident until the TTL expired. Scanners and availability sync now request only keywords and external_ids, which is everything they read, and write to a separate LRU-bounded cache with a 15 minute TTL, so scan lookups age out on their own instead of evicting traffic of manual browsing. The interactive cache gains a key-count backstop against the unbounded growth, and aggregate_credits.crew and credits.cast are stripped before caching since nothing in the codebase readss that either.

fix #3307

3.4.0 - 2026-07-28

This release patches a path traversal vulnerability in the avatar image proxy.

Exploitation vectors:

A malicious or compromised Jellyfin/Emby media server returning a crafted HTTP response.

A man-in-the-middle attacker intercepting the connection to the media server, if it is configured over HTTP instead of HTTPS (the default setting).

🛡️ Security

Patch GHSA-mc6w-69r3-62h8 - Path Traversal leading to Remote Code Execution vulnerability (in seerr's ImageProxy) - (f484791)

🚀 Features

(PlexImportModal) Add user details sync functionality (#2977) - (902b88e)

(api) Support userId when creating issues (#3100) - (5f2722d)

(external-links) Add Simkl media link (#3121) - (5ae70d0)

(notifications) Add Discord thread ID support (#3065) - (6e9ba06)

(requests) Allow admins to bypass user quota limits (#2026) - (72536da)

Allow to disable version check (#3137) - (73937c0)

Add jellyfin/emby quick connect authentication (#2212) - (74c8db4)

🐛 Bug Fixes

(availability-sync) Prevent false removals for merged-version Plex items (#3224) - (46d8033)

(discover) Use added sort in recent requests slider (#3202) - (8ccd0f6)

(email) Respect hosts file for SMTP connections (#3082) - (b660201)

(i18n) Fallback to server locale for "Default" user lang in notifs (#3190) - (ef9edc8)

(next) Add next-env.d.ts to .gitignore (#3282) - (3279393)

(notifications) Make the Discord IDs available even when the notification is disabled on Seerr (#3139) - (a8f1780)

(proxy) Proxy clients built before proxy init (#3196) - (8ad191f)

(scanners) Decline orphaned requests when media is removed from servarr (#3191) - (2e0e4ce)

(subscriber) Await request status updates (#3223) - (f481b56)

(ui) Revalidate request list after approving or declining a request (#3283) - (e810b98)

(webpush) Guard subscriptions request until user loads (#3113) - (6829850)

Support for IPv6 address literals in HOST env var (#2614) - (0adbf50)

Prevent cross-instance external ID collisions (#3203) - (8e02d92)

Close manage movie sidebar without back reopening (#2590) - (0a1f703)

Availability sync demotion and orphan season rollup edge cases (#3148) - (784faa9)

📖 Documentation

(blog) Rootless design and PUID/PGID rationale (#3105) - (bf5323f)

(blog) Fix "monitorNewItems" feature description and previous post author (#3103) - (4e7a227)

Update truenas migration section to include chown (#3143) - (ebac489)

Add TrueNAS migration guidance (#3107) - (8b062ed)

⚙️ Miscellaneous Tasks

(actions) Update github actions (#3041) - (0438710)

(dev) Add devenv setup (#3138) - (d2ffe4f)

(i18n) Update translations from Weblate - (4b65ab5)

(i18n) Update translations from Weblate - (1926095)

(i18n) Update translations from Weblate - (d051deb)

(i18n) Update translations from Weblate - (8d351bc)

(i18n) Update translations from Weblate - (3f33842)

(i18n) Update translations from Weblate - (6c8527f)

(i18n) Update translations from Weblate - (ab26f06)

(i18n) Update translations from Weblate - (0a305f6)

(i18n) Update translations from Weblate - (32249f2)

(i18n) Update translations from Weblate - (2a249a8)

(release) Prepare v3.4.0 - (2dbe886)

(release) Prepare 3.4.0 release - (b21049a)

New Contributors ❤️

@aaamoeder made their first contribution

@kouellette made their first contribution

@u61d made their first contribution

@thraizz made their first contribution

@john-fletcher made their first contribution

@Gilmoursa made their first contribution

@atoy3731 made their first contribution

@nightt5879 made their first contribution

Proxying for axios relied on the per-instance httpAgent/httpsAgent, which axios.create() snapshots from axios.defaults at construction time. API clients constructed at import (such as BaseScanner.tmdb, avalabilitySync.tmdb) are built before createCustomProxyAgent runs, so they snapshotted no proxy agent and bypassed the proxy permanently, while clients created per-request afterwards were proxied. This fix resolves the agent per request from a live module-level holder via a stable interceptor that is registered on the default instance and every ExternalAPI client, so construction order no longer matters. forceIpv4First has been moved to the same path logic as well. fix #3193

3.3.0 - 2026-06-02

🚀 Features

(db) Add DB_POOL_SIZE environment variable for postgres connection pool (#2990) - (f093c69)
(i18n) Add server-side i18n for notification agents (#2731) - (cd257ba)
(notification) Add support for public seerr logo in email (#3036) - (a8f147d)
(notifications) Support multiple Discord IDs (#2712) - (63175f5)
Add plex media ratingKey and ratingKey4k to webhook payload and… (#1812) - (9b7b50b)
Add route to fetch user by jellyfin id (#2074) - (15296a0)
Filter out "Thanks" credits when looking at a person's credits (#2370) - (d024849)

🐛 Bug Fixes

(auth) Drop popup.closed check in Plex pin poll (#2941) - (ce9643c)
(availability-sync) Detect deleted seasons when media server retains empty season metadata (#2850) - (9c34864)
(discover) Preserve keyword filter input focus after selection (#2962) - (32169d9)
(docs) Enable trailingSlash to prevent 404 flash on direct navigation (#3039) - (df105b8)
(docs) Switch to SWC minimizer to fix broken runtime bundle - (d88242f)
(docs) Bump openapi docs packages to 5.0.2 (#3027) - (080c68a)
(entity) Set the default value of UpdateDateColumn to CURRENT_TIMESTAMP (#2913) - (86e780e)
(external-link) Replace TMDB ID with IMDB ID for Trakt links (#2934) - (f078da8)
(imdbRadarrProxy) Pass headers and nodeCache as options instead of params (#2900) - (7861db4)
(issuedescription) Fix issue display lists in IssueDescription (#2972) - (ce47cfb)
(media) Clean up watchlist on error card delete (#3073) - (ee915b9)
(media-request) Remove cascade from modifiedBy to prevent user column wipe (#2911) - (2dfea0c)
(ntfy) Save priority field as number instead of string (#3096) - (2fa535d)
(ntfy) Remove undefined fields from ntfy payload (#2931) - (377bf65)
(override-rules) Use find() instead of index lookup for service resolution (#2903) - (5fdedb1)
(plex-watchlist-sync) Handle MediaContainer.Video fallback in watchlist sync (#2992) - (99f8520)
(request) Restore media status correctly when deleting requests (#3064) - (ff88d52)
(scanners) Reset orphaned processing media from deleted Radarr/Sonarr entries (#2757) - (198e4e5)
(scanners) Ignore unknown seasons in availability rollup and skip empty placeholder seasons (#2958) - (ce51f6a)
(search) Replace "TV" with "Series" in search placeholder (#3067) - (c04172a)
(slider) Add async to spring animation (#2978) - (5267611)
(tag) Use inset ring to avoid clipped outlines (#2985) - (cf87205)
(tvrequest) Allow special episodes when partial series requests are disabled (#2973) - (b32ab02)
(users) Correct auth middleware for web push subscription (#3005) - (bd27f2d)
(watchlistsync) Re-request deleted media from watchlist (#3072) - (2588e49)
Update series status to partially available when seasons are missing (#3044) - (4ed29cf)
Add missing "key" to React arrays (#3043) - (4fa2c71)
Send availability notification if media is available before approval (#2819) - (d426e1e)
Normalize webhook payload encoding to support raw JSON inputs (#2641) - (5b45806)

📖 Documentation

(blog) Add v3.3.0 release blog post (#3098) - (759e359)
(fail2ban) Add fail2ban documentation (#2894) - (39e9f1f)
(nixpkgs) Add documentation for nixpkgs 26.05 (#3089) - (5fc7a40)
Add REST API documentation (#2981) - (7aa1470)
Add Terraform/OpenTofu provider page (#2967) - (811126d)

🚜 Refactor

(docs) Move REST API docs to navbar and dedicated sidebar (#3040) - (08b7bd4)
(logs) Align failed login attempt message with failed sign-i… (#2914) - (3e4bf1b)
Replace react-toast-notifications with react-hot-toast (#3004) - (dfde4d3)

⚙️ Miscellaneous Tasks

(actions) Update github actions (#3028) - (6bb402a)
(actions) Update github actions (#2982) - (20dbc30)
(actions) Update github actions (major) (#2947) - (952261b)
(actions) Update taiki-e/install-action action to v2.75.18 (#2961) - (d50bdad)
(actions) Update github actions (#2945) - (60a2a87)
(create-tag) Add gh token to avoid api rate limit in tag version retrieval (#2886) - (85bfdb2)
(i18n) Update translations from Weblate - (73fcfd2)
(i18n) Update translations from Weblate - (788311a)
(i18n) Update translations from Weblate - (6eb43e0)
(i18n) Update translations from Weblate - (656e33f)
(i18n) Update translations from Weblate - (4742018)
(i18n) Update translations from Weblate - (2d4cd03)
(i18n) Update translations from Weblate - (3c249c7)
(i18n) Update translations from Weblate - (4e4e673)
(i18n) Update translations from Weblate (#2906) - (6513915)
(i18n) Update translations from Weblate (#2901) - (56ab94a)
(release) Prepare v3.2.0 - (703faf9)
(release) Merge develop into main - (0621e3d)
(release) Remove git-cliff footer in release changelog (#2986) - (550c3bc)
Cleanup intl polyfills and dev config (#2965) - (ba6ed6c)
Ignore Renovate bot on irrelevant jobs (#2904) - (1d2aa76)

New Contributors ❤️

@defaultdino made their first contribution
@haribo-hyung made their first contribution
@felixschndr made their first contribution
@burakemirsezen made their first contribution
@death2all110 made their first contribution
@fredrikburmester made their first contribution
@marcinjurczak made their first contribution
@Josh-Archer made their first contribution
@Finchow made their first contribution
@kyle-engler made their first contribution
@danjuv made their first contribution
@aldoeliacim made their first contribution