Seerr Release Notes

Library scans and availavilit sync fetched the full /tv/:id payload including aggregate_credits and cached it for 12 hours in the same unbounded cache the interactive TV detail page uses, so a full scan left most of a library resident until the TTL expired. Scanners and availability sync now request only keywords and external_ids, which is everything they read, and write to a separate LRU-bounded cache with a 15 minute TTL, so scan lookups age out on their own instead of evicting traffic of manual browsing. The interactive cache gains a key-count backstop against the unbounded growth, and aggregate_credits.crew and credits.cast are stripped before caching since nothing in the codebase readss that either.

fix #3307

3.4.0 - 2026-07-28

This release patches a path traversal vulnerability in the avatar image proxy.

Exploitation vectors:

A malicious or compromised Jellyfin/Emby media server returning a crafted HTTP response.

A man-in-the-middle attacker intercepting the connection to the media server, if it is configured over HTTP instead of HTTPS (the default setting).

🛡️ Security

Patch GHSA-mc6w-69r3-62h8 - Path Traversal leading to Remote Code Execution vulnerability (in seerr's ImageProxy) - (f484791)

🚀 Features

(PlexImportModal) Add user details sync functionality (#2977) - (902b88e)

(api) Support userId when creating issues (#3100) - (5f2722d)

(external-links) Add Simkl media link (#3121) - (5ae70d0)

(notifications) Add Discord thread ID support (#3065) - (6e9ba06)

(requests) Allow admins to bypass user quota limits (#2026) - (72536da)

Allow to disable version check (#3137) - (73937c0)

Add jellyfin/emby quick connect authentication (#2212) - (74c8db4)

🐛 Bug Fixes

(availability-sync) Prevent false removals for merged-version Plex items (#3224) - (46d8033)

(discover) Use added sort in recent requests slider (#3202) - (8ccd0f6)

(email) Respect hosts file for SMTP connections (#3082) - (b660201)

(i18n) Fallback to server locale for "Default" user lang in notifs (#3190) - (ef9edc8)

(next) Add next-env.d.ts to .gitignore (#3282) - (3279393)

(notifications) Make the Discord IDs available even when the notification is disabled on Seerr (#3139) - (a8f1780)

(proxy) Proxy clients built before proxy init (#3196) - (8ad191f)

(scanners) Decline orphaned requests when media is removed from servarr (#3191) - (2e0e4ce)

(subscriber) Await request status updates (#3223) - (f481b56)

(ui) Revalidate request list after approving or declining a request (#3283) - (e810b98)

(webpush) Guard subscriptions request until user loads (#3113) - (6829850)

Support for IPv6 address literals in HOST env var (#2614) - (0adbf50)

Prevent cross-instance external ID collisions (#3203) - (8e02d92)

Close manage movie sidebar without back reopening (#2590) - (0a1f703)

Availability sync demotion and orphan season rollup edge cases (#3148) - (784faa9)

📖 Documentation

(blog) Rootless design and PUID/PGID rationale (#3105) - (bf5323f)

(blog) Fix "monitorNewItems" feature description and previous post author (#3103) - (4e7a227)

Update truenas migration section to include chown (#3143) - (ebac489)

Add TrueNAS migration guidance (#3107) - (8b062ed)

⚙️ Miscellaneous Tasks

(actions) Update github actions (#3041) - (0438710)

(dev) Add devenv setup (#3138) - (d2ffe4f)

(i18n) Update translations from Weblate - (4b65ab5)

(i18n) Update translations from Weblate - (1926095)

(i18n) Update translations from Weblate - (d051deb)

(i18n) Update translations from Weblate - (8d351bc)

(i18n) Update translations from Weblate - (3f33842)

(i18n) Update translations from Weblate - (6c8527f)

(i18n) Update translations from Weblate - (ab26f06)

(i18n) Update translations from Weblate - (0a305f6)

(i18n) Update translations from Weblate - (32249f2)

(i18n) Update translations from Weblate - (2a249a8)

(release) Prepare v3.4.0 - (2dbe886)

(release) Prepare 3.4.0 release - (b21049a)

New Contributors ❤️

@aaamoeder made their first contribution

@kouellette made their first contribution

@u61d made their first contribution

@thraizz made their first contribution

@john-fletcher made their first contribution

@Gilmoursa made their first contribution

@atoy3731 made their first contribution

@nightt5879 made their first contribution

Proxying for axios relied on the per-instance httpAgent/httpsAgent, which axios.create() snapshots from axios.defaults at construction time. API clients constructed at import (such as BaseScanner.tmdb, avalabilitySync.tmdb) are built before createCustomProxyAgent runs, so they snapshotted no proxy agent and bypassed the proxy permanently, while clients created per-request afterwards were proxied. This fix resolves the agent per request from a live module-level holder via a stable interceptor that is registered on the default instance and every ExternalAPI client, so construction order no longer matters. forceIpv4First has been moved to the same path logic as well. fix #3193

3.3.0 - 2026-06-02

🚀 Features

(db) Add DB_POOL_SIZE environment variable for postgres connection pool (#2990) - (f093c69)
(i18n) Add server-side i18n for notification agents (#2731) - (cd257ba)
(notification) Add support for public seerr logo in email (#3036) - (a8f147d)
(notifications) Support multiple Discord IDs (#2712) - (63175f5)
Add plex media ratingKey and ratingKey4k to webhook payload and… (#1812) - (9b7b50b)
Add route to fetch user by jellyfin id (#2074) - (15296a0)
Filter out "Thanks" credits when looking at a person's credits (#2370) - (d024849)

🐛 Bug Fixes

(auth) Drop popup.closed check in Plex pin poll (#2941) - (ce9643c)
(availability-sync) Detect deleted seasons when media server retains empty season metadata (#2850) - (9c34864)
(discover) Preserve keyword filter input focus after selection (#2962) - (32169d9)
(docs) Enable trailingSlash to prevent 404 flash on direct navigation (#3039) - (df105b8)
(docs) Switch to SWC minimizer to fix broken runtime bundle - (d88242f)
(docs) Bump openapi docs packages to 5.0.2 (#3027) - (080c68a)
(entity) Set the default value of UpdateDateColumn to CURRENT_TIMESTAMP (#2913) - (86e780e)
(external-link) Replace TMDB ID with IMDB ID for Trakt links (#2934) - (f078da8)
(imdbRadarrProxy) Pass headers and nodeCache as options instead of params (#2900) - (7861db4)
(issuedescription) Fix issue display lists in IssueDescription (#2972) - (ce47cfb)
(media) Clean up watchlist on error card delete (#3073) - (ee915b9)
(media-request) Remove cascade from modifiedBy to prevent user column wipe (#2911) - (2dfea0c)
(ntfy) Save priority field as number instead of string (#3096) - (2fa535d)
(ntfy) Remove undefined fields from ntfy payload (#2931) - (377bf65)
(override-rules) Use find() instead of index lookup for service resolution (#2903) - (5fdedb1)
(plex-watchlist-sync) Handle MediaContainer.Video fallback in watchlist sync (#2992) - (99f8520)
(request) Restore media status correctly when deleting requests (#3064) - (ff88d52)
(scanners) Reset orphaned processing media from deleted Radarr/Sonarr entries (#2757) - (198e4e5)
(scanners) Ignore unknown seasons in availability rollup and skip empty placeholder seasons (#2958) - (ce51f6a)
(search) Replace "TV" with "Series" in search placeholder (#3067) - (c04172a)
(slider) Add async to spring animation (#2978) - (5267611)
(tag) Use inset ring to avoid clipped outlines (#2985) - (cf87205)
(tvrequest) Allow special episodes when partial series requests are disabled (#2973) - (b32ab02)
(users) Correct auth middleware for web push subscription (#3005) - (bd27f2d)
(watchlistsync) Re-request deleted media from watchlist (#3072) - (2588e49)
Update series status to partially available when seasons are missing (#3044) - (4ed29cf)
Add missing "key" to React arrays (#3043) - (4fa2c71)
Send availability notification if media is available before approval (#2819) - (d426e1e)
Normalize webhook payload encoding to support raw JSON inputs (#2641) - (5b45806)

📖 Documentation

(blog) Add v3.3.0 release blog post (#3098) - (759e359)
(fail2ban) Add fail2ban documentation (#2894) - (39e9f1f)
(nixpkgs) Add documentation for nixpkgs 26.05 (#3089) - (5fc7a40)
Add REST API documentation (#2981) - (7aa1470)
Add Terraform/OpenTofu provider page (#2967) - (811126d)

🚜 Refactor

(docs) Move REST API docs to navbar and dedicated sidebar (#3040) - (08b7bd4)
(logs) Align failed login attempt message with failed sign-i… (#2914) - (3e4bf1b)
Replace react-toast-notifications with react-hot-toast (#3004) - (dfde4d3)

⚙️ Miscellaneous Tasks

(actions) Update github actions (#3028) - (6bb402a)
(actions) Update github actions (#2982) - (20dbc30)
(actions) Update github actions (major) (#2947) - (952261b)
(actions) Update taiki-e/install-action action to v2.75.18 (#2961) - (d50bdad)
(actions) Update github actions (#2945) - (60a2a87)
(create-tag) Add gh token to avoid api rate limit in tag version retrieval (#2886) - (85bfdb2)
(i18n) Update translations from Weblate - (73fcfd2)
(i18n) Update translations from Weblate - (788311a)
(i18n) Update translations from Weblate - (6eb43e0)
(i18n) Update translations from Weblate - (656e33f)
(i18n) Update translations from Weblate - (4742018)
(i18n) Update translations from Weblate - (2d4cd03)
(i18n) Update translations from Weblate - (3c249c7)
(i18n) Update translations from Weblate - (4e4e673)
(i18n) Update translations from Weblate (#2906) - (6513915)
(i18n) Update translations from Weblate (#2901) - (56ab94a)
(release) Prepare v3.2.0 - (703faf9)
(release) Merge develop into main - (0621e3d)
(release) Remove git-cliff footer in release changelog (#2986) - (550c3bc)
Cleanup intl polyfills and dev config (#2965) - (ba6ed6c)
Ignore Renovate bot on irrelevant jobs (#2904) - (1d2aa76)

New Contributors ❤️

@defaultdino made their first contribution
@haribo-hyung made their first contribution
@felixschndr made their first contribution
@burakemirsezen made their first contribution
@death2all110 made their first contribution
@fredrikburmester made their first contribution
@marcinjurczak made their first contribution
@Josh-Archer made their first contribution
@Finchow made their first contribution
@kyle-engler made their first contribution
@danjuv made their first contribution
@aldoeliacim made their first contribution

cookie-parser was initialized with settings.clientId (the Plex client
UUID), but express-session signs connect.sid with settings.sessionSecret.

The secrets differ, so cookie-parser's signature check on connect.sid
fails, the cookie is dropped from req.cookies, and the OpenAPI validator
rejects every authenticated request with "cookie 'connect.sid' required"
even though the browser is sending it correctly.

This also matches the signing secret used by the OIDC code-verifier and
state cookies that are stored via res.cookie(..., {signed: true}), which
read back through req.signedCookies during the callback.