posterizarr releases

What's Changed

• Sync Main to Dev by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/564
• Normalize paths & refine search by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/565

Full Changelog: https://github.com/fscorrupt/posterizarr/compare/2.2.43...2.2.44

What's Changed

• fix: testing mode imagemagick errors by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/562

Full Changelog: https://github.com/fscorrupt/posterizarr/compare/2.2.42...2.2.43

This release brings substantial under-the-hood security improvements to both the backend API and the frontend UI, along with safer logging practices.

🛡️ Security Enhancements

• Frontend XSS Patch (Dependabot #561): Updated postcss to v8.5.10 to resolve a vulnerability where </style> sequences were improperly escaped, preventing potential Cross-Site Scripting (XSS) attacks.
• SSRF Protection: Strengthened internal and external API request handling to block Server-Side Request Forgery attempts across all connected services (Plex, Jellyfin, Emby, TMDB, TVDB, Webhooks).
• Directory Traversal Prevention: Hardened asset uploading, deletion, and folder browsing to strictly restrict access to designated asset directories.
• Command Sanitization: Improved validation of CLI arguments for background tasks (like ImageMagick processing) to prevent argument injection.
• Log Redaction: Sensitive information such as API Keys, tokens, and PINs are now strictly masked in application logs and the downloadable support ZIP (Only Debug log was affected).
• Safe Error Responses: Genericized HTTP server error responses to prevent internal path and stack trace leaks.

🐛 Bug Fixes & Chores

• Fixed and tightened regex rules used for parsing media titles and masking URLs.
• Improved emoji-stripping rules for filename sanitation.
• Removed deprecated internal routing logic and optimized module imports.

What's Changed

• Sync Main to dev by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/559
• chore(security): comprehensive security hardening and logging improvements. by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/560
• fix: update postcss to resolve XSS vulnerability by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/561

Full Changelog: https://github.com/fscorrupt/posterizarr/compare/2.2.41...2.2.42

🚀 UI Improvements

• AutoTriggers Header Upgrade: Added a new compact info box to the AutoTriggers header to provide better guidance on how automatic processing works.
• Asset Replacer Flexibility: You can now leave the Title Text field empty for the asset replacer, allowing for more streamlined manual edits.
• Enhanced Layouts: Fixed flexbox layout issues in the UI and added min-w-0 to prevent layout breaking on long content strings.
• Multilingual Support: Updated translations for English, German, French, Italian, and Portuguese, including new instructional bullets for the AutoTriggers section.

🛠️ Technical Fixes

• Frontend Logic: Updated AssetReplacer.jsx to use nullish coalescing (??) and explicit null/undefined checks for titleText to improve reliability.
• Backend Logic: Refined main.py to handle optional title_text parameters more gracefully during overlay processing.

What's Changed

• Add Action Center guide and FAQ by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/556
• Sync Main to Dev by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/557
• Enhance AutoTriggers UI by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/558

Full Changelog: https://github.com/fscorrupt/posterizarr/compare/2.2.40...2.2.41

What's New?

🖼️ Automated Logo Management

I’ve added a massive new feature set for managing your Plex ClearLogos:

• LogoUpdater: Automatically scan your libraries and fetch high-quality logos from TMDB, TVDB, and Fanart.
• LogoRevert: Changed your mind? Revert mode identifies logos uploaded by Posterizarr and restores the original Plex defaults.
• Multi-Library Support: Run updates or reverts across a single library or your entire collection at once.

🔒 Security Improvements

• Implemented SSRF and Path Traversal protections to ensure external URL fetching and file paths remain secure.
• Sanitized API error responses to improve the security posture of the web interface.

🛠️ Improvements & Fixes

• UI Refactor: Smoother, faster modals for Run Modes and Library browsing.
• Bug Fixes: Resolved issues with duplicate action buttons and improved handling of assets with special characters.

What's Changed

• Sync Main to dev by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/554
• feat: introduce LogoUpdater, LogoRevert, and Security Hardening by @fscorrupt in https://github.com/fscorrupt/posterizarr/pull/555

Full Changelog: https://github.com/fscorrupt/posterizarr/compare/2.2.39...2.2.40

🚀 Features & Improvements

• Enhanced Jellyfin/Emby Search: Expanded the API query fields (Tags, Width, Height, Path, ProviderIds, etc.) and improved search robustness. If a strict series path match fails, the system will now intelligently fallback to search as a movie type to recover the match.
• Smart Season Titling: In Manual Mode, selecting a folder will now auto-set the title to "Season X" (if in season mode) rather than strictly grabbing the base folder name, improving the overlay generation workflow.
• Precise mediaType Routing: The mediaType (movie vs. show) is now explicitly passed through the asset replacement flow from the frontend to the backend, ensuring the correct Poster/Card flags (-MoviePosterCard or -ShowPosterCard) are triggered during upload.
• Expanded Debug Logging: Added more descriptive logging for Jellyfin/Emby search URIs and item resolutions to make troubleshooting easier.

🐛 Bug Fixes

• TMDB Logo Language Check: Fixed a bug where the $lang check would always evaluate to true due to an incorrect -or operator. It now correctly uses -and to filter out null and xx languages. by @kevbentz in https://github.com/fscorrupt/posterizarr/pull/552
• Season Overlay Application: Fixed an issue in the image composition command where the standard $Posteroverlay was being applied to season posters instead of the intended $Seasonoverlay.

⚙️ Maintenance & Under the Hood

• Updated GitHub action runner parameters to force Node 24 (FORCE_JAVASCRIPT_ACTIONS_TO_NODE24).
• Bumped softprops/action-gh-release to v3.

Full Changelog: https://github.com/fscorrupt/posterizarr/compare/2.2.38...2.2.39