Skip to content

posterizarr

v3.0.0 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 13d Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

arr imagemagick posters

Affected surfaces

auth

ReleasePort's take

Moderate signal
editorial:auto 12d

Posterizarr 3.0.0 introduces true parallel processing that cuts long‑running jobs from hours to minutes and adds a Setup Wizard for easier onboarding.

Why it matters: Parallel libraries reduce runs from 30 min → 5 min and 48 h → 6 h, delivering up to ~86 % faster processing; the new wizard streamlines initial configuration.

Summary

AI summary

Posterizarr now uses true parallel processing for massive speed boosts and adds a setup wizard, per‑library language overrides, WebP galleries, security hardening, and bug fixes.

Changes in this release

Security High

Switches Emby, Jellyfin, and Plex API keys from URL parameters to header‑based authentication to prevent log leakage (Closes #596).

Switches Emby, Jellyfin, and Plex API keys from URL parameters to header‑based authentication to prevent log leakage (Closes #596).

Source: llm_adapter@2026-07-14

Confidence: high

 —
Security High

Makes API keys mandatory for all webhook triggers, blocking unauthenticated POST requests.

Makes API keys mandatory for all webhook triggers, blocking unauthenticated POST requests.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Adds a step‑by‑step Setup Wizard for initial server, schedule, and library configuration.

Adds a step‑by‑step Setup Wizard for initial server, schedule, and library configuration.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Introduces per‑library language customization for asset ordering.

Introduces per‑library language customization for asset ordering.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Enables WebP thumbnail engine in the WebUI for smoother poster galleries.

Enables WebP thumbnail engine in the WebUI for smoother poster galleries.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Dependency Low

Updates Node.js runtime to `node:current-alpine3.24` for Docker users (Closes #589).

Updates Node.js runtime to `node:current-alpine3.24` for Docker users (Closes #589).

Source: llm_adapter@2026-07-14

Confidence: high

 —
Performance Medium

Processes libraries concurrently, reducing 30‑minute runs to 5 minutes and 48‑hour runs to 6 hours.

Processes libraries concurrently, reducing 30‑minute runs to 5 minutes and 48‑hour runs to 6 hours.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Adds timeouts to image‑download HTTP calls to prevent indefinite hangs (Closes #603).

Adds timeouts to image‑download HTTP calls to prevent indefinite hangs (Closes #603).

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Resolves ImageMagick pipe deadlocks causing large runs to hang indefinitely (Closes #604).

Resolves ImageMagick pipe deadlocks causing large runs to hang indefinitely (Closes #604).

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Corrects rendering of non‑Latin (CJK/Cyrillic) titles that previously appeared blank.

Corrects rendering of non‑Latin (CJK/Cyrillic) titles that previously appeared blank.

Source: llm_adapter@2026-07-14

Confidence: high

 —
Full changelog

Posterizarr v3.0.0 — Finally Fast! 🚀

This is a massive under-the-hood update! The entire architecture has been completely rebuilt to introduce true parallel processing. While you might not see massive visual changes immediately, the entire stack is now significantly stronger, safer, and insanely fast.

🚀 What's New?

  • Massive Speed Boosts: The script now processes your libraries concurrently! A 30-minute run now takes 5 minutes.
    A 48-hour run now takes 6 hours.
    You can even tune exactly how many ParallelJobs your CPU is allowed to handle!

  • Brand New Setup Wizard: Setting up Posterizarr for the first time? You'll be greeted by a gorgeous new step-by-step onboarding wizard to get your servers, schedules, and libraries linked in seconds.

  • Per-Library Language Customization: Have an anime library that needs Japanese assets, but want English for everything else? You can now override language orders on a per-library basis!

  • WebP UI Galleries: The WebUI now utilizes a dedicated WebP thumbnail engine, meaning scrolling through massive poster galleries is smoother, faster, and saves a ton of bandwidth.

🛡️ Security Hardened & Stability

  • Header-Based Auth: Emby, Jellyfin, and Plex API keys are no longer passed as URL parameters. Your private tokens will never accidentally leak into logs again (Closes #596).
  • Strict Webhooks: API keys are now mandatory for all webhook triggers, keeping your instance safe from unauthenticated POST requests.
  • No More Provider Hangs: Built-in timeouts on image downloads ensure stalled providers (like TMDB/TVDB outages) no longer freeze the script!
  • Deadlock Fixes: Fixed the infamous ImageMagick pipe deadlocks so large runs no longer hang indefinitely (Closes #604).

🐛 Bug Squashed

  • Fixed an issue where non-Latin (CJK/Cyrillic) titles would render completely blank.
  • Fixed misleading "TMDB API response is null" errors.
  • Intelligent request throttling added to Plex/Emby API calls to stop servers from rate-limiting the script on massive libraries.
  • Node.js updated to node:current-alpine3.24 for Docker users (Closes #589).

⚠️ Action Required
Because of the massive engine overhaul, please make sure you pull the latest changes and review your ParallelJobs setting in the WebUI to ensure it matches your hardware capabilities!

ParallelJobs: Determines how many asset creations run concurrently. Default is 5.

WARNING: ImageMagick is highly CPU/RAM intensive. 
Do not set higher than your logical CPU cores. 
If running on low-power NAS or Raspberry Pi, lower to 1 or 2 to avoid running out of memory.

What's Changed

  • sync main to insider build by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/593
  • Port two bugfixes from stable/PR #600 to the v3 rewrite by @andrejkurlovic in https://github.com/fscorrupt/posterizarr/pull/601
  • Add per-library language override support by @andrejkurlovic in https://github.com/fscorrupt/posterizarr/pull/602
  • fix: add timeout to image-download HTTP calls to prevent indefinite hangs by @andrejkurlovic in https://github.com/fscorrupt/posterizarr/pull/603
  • Posterizarr v3.0.0 - The Core Overhaul! by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/605

New Contributors

  • @andrejkurlovic made their first contribution in https://github.com/fscorrupt/posterizarr/pull/601

Full Changelog: https://github.com/fscorrupt/posterizarr/compare/2.2.52...3.0.0

Security Fixes

  • Header‑Based Auth prevents API keys from leaking into logs (Closes #596)
  • Mandatory API keys for all webhook triggers block unauthenticated POST requests
  • Timeouts on image downloads stop stalls caused by provider outages
  • Deadlock fix eliminates indefinite hangs with ImageMagick during large runs (Closes #604)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track posterizarr

Get notified when new releases ship.

Sign up free

About posterizarr

Automated poster maker for Plex/Jellyfin/Emby.

All releases →

Related context

Beta — feedback welcome: [email protected]