Skip to content

boxarr

v2.0.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 3d Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Affected surfaces

auth

Summary

AI summary

Updates fix, feat, and chore across a mixed release.

Full changelog

Added

  • Selectable Box Office Region: New setup dropdown to pick a Box Office Mojo region, driving an ?area=CODE query so charts can track box office beyond US & Canada domestic (#109, #112)
  • Configurable Box Office Timeout: New boxoffice_timeout setting (default 120s, range 5-600) plus a 3-attempt retry with backoff for more resilient Box Office Mojo requests (#110, #113)
  • UI Polish: Async refresh button with a progress endpoint, a week tenure badge, and a recent-weeks grid on the overview page (#105)

Fixed

  • Ignore Button: Fixed single-quote escaping in the overview ignore-button onclick handler so movies with apostrophes in their titles can be ignored (#106, #111)
  • Event-Loop Blocking: Manual box office routes now offload the blocking Box Office Mojo scraper to a worker thread, so a wedged upstream (compounded by request retries) no longer stalls the asyncio event loop and hangs every request, including /api/health
  • Timeout Preservation on Save: Saving configuration from the settings UI now preserves the boxoffice_timeout (and Radarr request timeout) value instead of silently reverting it to the default
  • Correct Auto-Add Match: Auto-add now selects the Radarr lookup result by IMDb id instead of the first candidate, preventing the wrong movie from being added (#115)
  • Year-Boundary Navigation: Fixed previous-week navigation across the year boundary and URL-encoded the overview search links so titles with special characters resolve correctly (#116)
  • XSS Hardening: Escaped dynamic widget output and switched toast rendering to a safe path so untrusted values can no longer inject markup (#117)
  • Sequel Mismatch: The matcher no longer links a charting sequel to the original film already in the library (#118)

Changed

  • Health-Check Logging: Suppressed uvicorn.access log lines for /api/health to keep logs readable under frequent health probes (#107)
  • Config Resilience: A corrupt local.yaml no longer crashes the app — the loader falls back to setup mode, backs up the unreadable file as .broken, and writes config atomically (#119)
  • Weekly JSON Integrity: Weekly page data is now written atomically and read corruption-safe, writers are serialized under a shared lock, and movies deleted from Radarr are un-linked from stored weeks (#120)

What's Changed

  • fix: make Ignore/Unignore buttons clickable on Overview page by @iongpt in https://github.com/iongpt/boxarr/pull/111
  • feat: add selectable Box Office Mojo region by @iongpt in https://github.com/iongpt/boxarr/pull/112
  • fix: make Box Office Mojo timeout configurable with retry-backoff by @iongpt in https://github.com/iongpt/boxarr/pull/113
  • fix: suppress health-check endpoint from Uvicorn access log by @xFlawless11x in https://github.com/iongpt/boxarr/pull/107
  • feat: UI polish — refresh button, week tenure badge, recent weeks grid by @xFlawless11x in https://github.com/iongpt/boxarr/pull/105
  • chore: prepare v1.8.0 release by @iongpt in https://github.com/iongpt/boxarr/pull/114
  • fix: match auto-add search result by IMDb id to avoid adding the wrong movie by @iongpt in https://github.com/iongpt/boxarr/pull/115
  • fix: correct year-boundary week nav and URL-encode overview search params by @iongpt in https://github.com/iongpt/boxarr/pull/116
  • fix: harden XSS sinks in widget, dashboard toasts, and setup JS by @iongpt in https://github.com/iongpt/boxarr/pull/117
  • fix: prevent charting sequels from matching the original film in the library by @iongpt in https://github.com/iongpt/boxarr/pull/118
  • fix: harden config load/save against corrupt local.yaml by @iongpt in https://github.com/iongpt/boxarr/pull/119
  • fix: harden weekly JSON integrity (atomic writes, corruption-safe reads, un-linking) by @iongpt in https://github.com/iongpt/boxarr/pull/120
  • chore: release v2.0.0 by @iongpt in https://github.com/iongpt/boxarr/pull/121

Full Changelog: https://github.com/iongpt/boxarr/compare/v1.7.0...v2.0.0

Security Fixes

  • XSS hardening: escaped dynamic widget output and switched toast rendering to a safe path

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track boxarr

Get notified when new releases ship.

Sign up free

About boxarr

Boxarr is an automated box office tracking application that integrates with Radarr to monitor, add, and manage the latest theatrical releases. It provides a beautiful dashboard showing the current box office top 10, their status in your Radarr library, and allows quality profile management.

All releases →

Beta — feedback welcome: [email protected]