v0.15.2 — Vite Security Hotfix

Security Hotfix for the 0.15 Release Train

Bumps vite out of the vulnerable 7.0.0–7.3.1 range, resolving three high-severity advisories:

• GHSA-4w7w-66w2-5vf9 — Path traversal in optimized deps .map handling
• GHSA-v2wj-q39q-566r — server.fs.deny bypass with queries
• GHSA-p9ff-h696-f583 — Arbitrary file read via dev server WebSocket

Only the frontend build tooling is affected; no runtime code changes. Dev server users should upgrade promptly.

v0.15.1 — OWASP Hardening & EPG Matching Fix

Security Hardening (OWASP Top 10)

Injection & SSRF (A03/A10)

• ffmpeg protocol whitelist on all invocations — blocks file://, data://, concat: and other dangerous protocols
• URL scheme validation at input time on M3U, Xtream Codes, and EPG source endpoints — only http:// and https:// allowed
• Zip backup path canonicalization — defense-in-depth resolve() check alongside existing traversal guards

Authentication (A01/A07)

• Login rate limiting — 5 attempts per minute per IP via slowapi on both local and Dispatcharr login endpoints
• Client IP in login failure logs — includes X-Forwarded-For for forensics
• NIST 800-63B password policy — dropped composition rules (uppercase/lowercase/number), replaced 33-word list with 10k common passwords, uniform 8-char minimum for all users including admin-created

Security Misconfiguration (A05)

• Security headers — X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin
• CORS tightened — explicit method and header allow lists instead of wildcards

Logging (A09)

• 500 response scrubbing — global handler returns generic "Internal server error" to clients, real error stays in server logs
• Validation error log redaction — Authorization/Cookie headers and auth endpoint request bodies redacted from logs

Bug Fix

• EPG matching fixed — channel names with number prefix (e.g., 535 | ESPN) were normalizing to 535espn instead of espn, causing zero matches against EPG data

Stats

• Backend: 2263 tests passing
• Frontend: 1027 tests passing
• 22 files changed, ~10.5k lines added (mostly the 10k common passwords list)

v0.15.0

New Features

Export & Publish

Generate M3U/XMLTV playlists from channel profiles and publish to cloud targets (S3, WebDAV, etc.) on a cron schedule. Includes channel selector, playlist preview, cloud target management, and publish history.

Low FPS Detection

Streams below a configurable threshold (5/10/15/20 FPS) are flagged with an amber icon and deprioritized in Smart Sort. Always on with zero overhead — configurable in Settings → Maintenance.

Black Screen Detection

Optional ffmpeg signalstats check after each probe flags dark/blank streams with a purple icon. Configurable sample duration (3-30s) in Settings → Maintenance.

Normalize Names Engine

Tag-based rules engine for cleaning up stream names during bulk channel creation. YAML import/export, edit/revert controls, drag-and-drop priority ordering.

Backup & Restore

Full configuration backup/restore from Settings, with restore option during first-run setup wizard.

Merge Channels

Combine two or more channels into one, consolidating their streams.

Auto-Creation Enhancements

• EPG logo source action, Probe Streams action, Set Channel Profile action
• Smart Sort option in rule sort dropdown, rule selection in Auto-Create schedule
• Separate stream sort from channel sort per rule

Other

• PUID/PGID support for Docker container user identity
• Server-side migration of EPG matching, stream normalization, and edit consolidation
• TV Guide print view

Security & Auth

• JWT authentication in Swagger UI with /swagger redirect
• Auth hardening — secured backup endpoints, improved token handling
• Debug bundle for troubleshooting auth issues
• Fixed npm audit vulnerabilities (brace-expansion, flatted, picomatch)
• Updated all GitHub Actions to Node.js 24-compatible versions

UI/UX Improvements

• Simplified Add Action/Condition UX in auto-creation rules
• Set Logo from M3U, improved logo buttons, EPG TVG-ID suffix filter
• Push-down renumbering fix, menu overflow fix, task card grid fix
• Settings UI consistency — compact dropdowns, unified admin section CSS, proper field ordering
• Fixed radio buttons, undefined CSS variables, and card backgrounds in admin tabs

Backend & Reliability

• Scoped reprobe to last scheduled probe's channel groups
• Capped Dispatcharr HTTP client connection pool
• Prober self-healing — auto-creates if not initialized, removes false restart prompts
• Fixed persistent 503 when stream prober not initialized
• Fixed assign_logo from EPG and duplicate rule priorities
• Wired ffmpeg config CRUD to real persistence module

Code Quality

• Fixed 128 TypeScript strict mode errors — tsc --noEmit now reports zero errors
• Removed ~2,000+ lines of dead code across backend and frontend
• Consolidated duplicate formatDate implementations, migrated 161 console.log calls to structured logger

v0.14.0

v0.14.0

Dummy EPG Engine

• Full dummy EPG system: create profiles with custom programs, assign to channels by group
• Group-based channel assignment with visual channel picker
• YAML export/import for dummy EPG profiles with overwrite support
• Auto-refresh after channel creation so EPG assignment succeeds in one pipeline run

Black Screen Detection

• Detect black screens during stream probing via FFmpeg frame analysis
• Black screen results visible in probe history, channel cards, and notifications
• Notification center shows black screen count indicator
• Propagate detection setting to running prober in real-time

Scheduled Tasks

• Failed stream re-probe task: automatically retry failed streams on a schedule
• Struck stream cleanup task: remove streams stuck in bad states
• Group picker for Run Now dialog

Auto-Creation Improvements

• Per-rule skip_struck_streams option
• Provider order and channel number sort options
• assign_profile action now available in the UI
• probe_on_sort and orphan_action included in YAML import/export
• Template variable expansion for assign_tvg_id and assign_logo actions
• Batched verify-and-retry for EPG assignments after pass 2

UI/UX

• Consolidated channel and toolbar actions into three-dot menus
• Pattern builder for normalization rules with annotation canvas
• Substitution pairs editor component

Bug Fixes

• Fix normalization regex_replace $1 backreference substitution
• Fix regex sort putting non-matching streams at bottom instead of top
• Fix EPG not assigned on initial channel creation
• Fix M3U profile toggle sending partial data causing 400 error
• Fix show_notifications=False blocking external alerts (Telegram/Discord/Email)
• Fix probe success alerts blocked by min_failures filter
• Fix M3U account deletion not cleaning up shared groups or linked account references
• Fix bulk create modal double-counting duplicate streams
• Dummy EPG profile delete cascade and import fixes

Infrastructure

• Configurable HTTP/HTTPS ports via environment variables
• Removed pydantic-settings dependency
• Removed batch_size from stream prober (uses only max_concurrent_probes)
• Architecture documentation with Mermaid diagrams

v0.13.1

v0.13.1 — Security, Stability & UX

New Features

• URL Hash Routing — Active tab and settings sub-page now persist in the URL hash (#settings/normalization, #m3u-manager, etc.). Supports page refresh, bookmarks, and browser back/forward navigation.
• Renumber All Groups Enhancement — Per-group starting number overrides in the Renumber All Groups modal, letting you customize where each group's numbering begins.

Security

• ~22 CodeQL Alerts Resolved — Unused variables/imports, overly permissive file permissions, stack trace exposure, SSRF hardening, command injection taint flow, clear-text logging separation.
• TLS Certificate Permissions — All cert/chain files tightened from 0o640 to 0o600 (owner-only access).
• Cloudflare SSRF Hardening — Regex-validated API paths, httpx base_url pattern to keep host fixed and untainted.
• Stack Trace Exposure — Probe error messages, EPG refresh errors, and CSV import errors no longer leak exception details to HTTP responses.
• Information Exposure — Internal error details removed from HTTP responses across channels, TLS routes.
• Password Validation — Restructured to prevent sensitive data flowing to printed output.

Bug Fixes

• Auto-Creation: set_channel_number — Fixed backend validation failure caused by frontend sending value in wrong field.
• Auto-Creation: Rule Save Errors — Save failures now show a toast notification instead of crashing the entire tab.
• Sort Field/Regex Reset — sort_field and sort_regex can now be properly cleared back to default values.

Internal

• 1002 frontend unit tests, 1826 backend tests — all passing
• 14 new E2E tests for hash routing

v0.13.0

v0.13.0 — Backend Refactor + Auto-Creation Enhancements

Backend Refactor

• Modular router architecture: 20 domain-focused router modules extracted from monolithic main.py
• Router registry pattern with all_routers list for clean app initialization
• Comprehensive test suite with 136 backend tests

Auto-Creation Enhancements

• Remove From Channel action — removes a stream from its current channel
• Set Stream Priority action — sets stream priority within a channel
• Stream Name (Regex) sort — sort matched streams by regex capture group
• Fix channel number double-consumption in renumber pass
• Fix renumber double-counting for merged streams

UI Improvements

• Renumber All Groups — bulk renumber channels across all groups at once
• Active Task Pinning — running tasks pinned to top of notification list
• Stream probe alerts respect notification type filters

Security

• Fix all npm audit high-severity vulnerabilities (vitest 1→4, minimatch/ajv overrides)

v0.12.6

New Features

Auto-Creation Enhancements

• Global exclusion filters with M3U group dropdown for auto-creation settings
• Normalized name conditions — new global and not-in condition types, plus in-group matching
• Date expansion in regex — auto-creation conditions can now match date patterns in stream names (community contribution by @lpukatch)
• Filter chips in execution log viewer for faster navigation
• Debug logging for YAML import pipeline to troubleshoot auto-creation rules
• Renamed "Provider" to "M3U Account" throughout the UI for clarity

Merge Streams Improvements

• Core-name fallback for auto-lookup when exact name match fails
• Call sign fallback for auto-lookup using channel call signs
• Deparen and word-prefix matching for smarter name resolution
• Max streams per provider setting to limit how many streams come from a single M3U account
• Enriched execution log with normalization context and merge guidance

Stream Probing

• Profile-aware probing with configurable distribution strategy across M3U accounts
• Per-account ramp-up model — gradually increases probe load per provider
• Configurable retry settings for probe failures
• Strike rule for streams with consecutive probe failures
• Expanded retry coverage for transient HTTP 200 failures, I/O errors, and Invalid data found errors
• Improved probe logging and stale group alerts

Notifications

• Regex exclude filters for M3U digest notifications — suppress noise from known patterns

UI/UX

• GitHub and User Guide links added to the header
• XC account editing no longer requires re-entering the password for non-credential changes

Bug Fixes

• Fix channels disappearing when auto-channel-sync turned off in Dispatcharr — auto-created channels are now visible even after disabling auto-sync
• Fix probe schedule ignoring user's channel group selection
• Fix max_streams_per_provider not enforcing against existing channel streams
• Fix struck-out streams crash from unpaginated channel lookup
• Fix tag cache not invalidating after tag changes (#27)
• Fix call-sign fallback false positives in merge_streams
• Fix core-name index excluding channels with no tags to strip
• Fix renumber functions broken after group reorder
• Fix merge_streams not finding channels by normalized name
• Fix assign_epg sending wrong field to Dispatcharr; add EPG matching
• Fix dual probe notifications, probe badges, and Dispatcharr connection logging
• Fix probe ramp-down treating all failures as overload
• Fix multi-stream selection lost across search filters
• Fix multi-stream drop on group headers and insert zones
• Fix number input fields in Settings that block editing
• Validate target group required for Create Channel actions (#20)
• Fix search clearing selected streams (#21)
• Fix smart sort M3U ordering for bulk/multi-channel sort
• Fix misleading merge_streams execution log when no channel found

Documentation

• Comprehensive User Guide with screenshots for all features
• AND/OR order of operations explanation with examples
• Profile-aware probing and distribution strategy documentation

v0.12.5

v0.12.5 — FFMPEG Builder, Performance Fix, Channel Badges & More

🆕 FFMPEG Builder (New Tab)

A full visual FFMPEG command builder for IPTV stream transcoding:

• Input source configuration — URL, file, or device input with protocol options
• Video codec settings — H.264, H.265/HEVC, VP9, AV1 with full parameter control (bitrate, CRF, preset, profile, tune)
• Audio codec settings — AAC, AC3, MP3, Opus, FLAC with bitrate, sample rate, and channel layout
• Video filters — Scale, deinterlace, denoise, sharpen, framerate conversion, crop/pad
• Audio filters — Volume normalization, loudnorm, equalizer, compressor, channel mixing
• Stream mapping — Select specific video/audio/subtitle streams from multi-stream sources
• IPTV-optimized presets — Low-latency HLS, passthrough, AC3 audio, and more one-click presets
• Live command preview — Real-time ffmpeg command generation with annotated explanations for every flag
• Stream probing — Probe any media source via ffprobe to detect codecs, resolution, bitrate
• Command validation — Validates configuration for errors and warnings before generating
• ECM integration — Push generated profiles directly to Dispatcharr as stream profiles
• Saved profiles — Save/load FFMPEG configurations with persistence to database
• Bundled reference docs — Full ffmpeg, codec, and filter documentation available in-app

⚡ Performance: Fix 100% CPU Browser Freeze (#5)

• Fixed critical issue where the browser tab pegged at 100% CPU for users with large stream counts (27,000+)
• Root cause: the app was fetching ALL streams in a tight loop (54+ API requests) on every page load
• Streams now load per-group on demand when expanding a group in the streams pane
• Search fetches only the first page of server-filtered results instead of all pages

🆕 Channel Badges & Stream Status Filters

• New green "good channels" badge on group headers between total and failed counts
• Unified badge styling with consistent border-radius across all group headers
• New stream status filters — filter channel list by failed, working, or unprobed streams

🔒 Auto Token Refresh

• Access tokens now auto-refresh on 401 errors in the HTTP client
• No more random session timeouts forcing page reloads

🎨 UI Improvements

• Replaced inline error messages with toast notifications across panels (bandwidth, popularity, watch history, guide)
• CSS color token refinements across all tabs for better contrast and visual hierarchy
• Auto-creation ActionEditor: auto-sets find_channel_by when switching to existing channel target

🆕 Portable Auto-Creation YAML Import/Export

• YAML exports now include human-readable group names and M3U account names alongside numeric IDs
• Importing on a different instance resolves names to local IDs automatically (case-insensitive)
• Warnings shown for unresolvable names instead of silent failures

🔧 CLI Password Reset

• New reset_password.py utility for resetting user passwords from the command line
• Interactive mode (lists users, prompts for password) and non-interactive mode for scripting
• Usage: docker exec -it ecm-ecm-1 python /app/reset_password.py

⚙️ Backend

• Task engine: separate send_alerts control from show_notifications
• Dispatcharr client: create_stream_profile support for ECM integration
• New FFmpegProfile database model for saved FFMPEG configurations

📝 Documentation

• Updated README with full API endpoint tables and Swagger/OpenAPI docs
• Updated User Guide with all features through v0.12.x

🧪 Testing

• 15 new backend unit test files for FFMPEG builder modules
• 1 FFMPEG API integration test
• 14 new FFMPEG builder E2E test specs
• 8 new stream loading unit tests
• 5 new stream loading E2E tests
• All 981 frontend unit tests pass, all 33 channel E2E tests pass

Closes #5

v0.12.2

Logo Manager

• Logo upload — Files now upload directly to Dispatcharr via multipart endpoint, stored and served by Dispatcharr (not ECM)
• Logo URL display — Logo Manager shows the accessible Dispatcharr cache URL instead of raw file paths
• Logo search — Client-side filtering since Dispatcharr ignores the search parameter
• All logos loaded — Paginates through Dispatcharr's 1000/page cap to load every logo
• Pagination — Choose 25, 50, 100, or 250 per page with full page navigation controls
• Layout fix — Content area scrolls properly between fixed header and pagination bar

CI Pipeline

• Eliminated redundant Docker builds — Trivy and DAST scans reuse the AMD64 build cache (4 → 2 builds)
• Added ARM64 Trivy scan — both architectures are vulnerability-scanned before manifest publish
• Manifest publish gated on all scans passing

Infrastructure

• Entrypoint creates /config subdirectories before chown (fixes PermissionError on volume mounts)

Housekeeping

• Dispatcharr API reference added to memory docs
• Beads sync-branch moved to dedicated beads branch

v0.12.1

v0.12.1

Codebase Deduplication

• Removed duplicate @keyframes spin from 8 CSS files (consolidated in shared/common.css)
• Replaced duplicate loading/error CSS with shared loading-state and error-banner classes
• Renamed conflicting @keyframes pulse to @keyframes status-pulse in StatusIndicator
• Extracted shared httpClient.ts (fetchJson/fetchText/buildQuery) — eliminated duplicate HTTP utilities across api.ts and autoCreationApi.ts
• Consolidated 16+ formatting functions into shared utils/formatting.ts — removed duplicates from 10 component files
• Replaced 48 hardcoded rgba(100,108,255,...) values with CSS custom properties (--accent-5 through --accent-80) across all three themes

Quality Condition Dropdown

• Changed quality condition input from free-form number to a dropdown with standard resolution presets: UHD/4K (2160p), FHD/1080p, HD/720p, SD/480p, 360p

Stats

• ~320 net lines removed across 44 files
• All 675 unit tests pass, all 19 Playwright smoke tests pass