feat: integrate outstanding SeerrNG work and security fixes by snapetech · Pull Request #175 · snapetech-org/seerrng

snapetech · 2026-10-08T13:17:30Z

Description

This PR forward-integrates the remaining non-recovery branches into main: the issue-fix batch, reader groupings, cross-platform setup assistance, ROMarrNG DAT catalog and contract v2 support, ecosystem integrations, request sync improvements, and SeerrNG Phase 2 work. PRs #172 and #173 were merged separately; this branch carries the updated main ancestry.

It also includes the security and CodeQL fixes found during triage:

Game Library routes limit each authenticated user to 120 requests per minute while preserving the existing 4-per-minute Steam sync limit.
The workspace override and lockfile now resolve Next.js 16.3.8 rather than the vulnerable 16.3.6.
The pnpm override and lockfile resolve Handlebars 4.7.10, fixing Dependabot alerts feat(watchlist): add local list filters #315–feat(discover): add precise rating and provider filters #317 (two critical and one medium).
CodeQL alerts were reviewed and documented. The rate-limit finding (docs(plex): clarify self-hosted Web App URL #481) is fixed in source; reviewed outbound-request alerts are false positives, and Navidrome MD5 use is required by Subsonic token authentication.
Combined CI found and removed a duplicate datCatalog capability declaration that prevented the merged code from building.

This also addresses issue #179. The new IMDb profile IDs are accepted, but IMDb returns an AWS WAF verification challenge to server-side watchlist requests, which had been reported as a generic “not public” error. IMDb supports exporting a list as CSV, so users can now import that export from their SeerrNG settings. The browser sends only validated IMDb title IDs; the server resolves and requests them through the normal request permissions and approval flow. Imported lists are manual and are excluded from scheduled IMDb fetching. The automated-access diagnostic also points users to this fallback. See IMDb’s list export instructions.

The alert history and dispositions are recorded in docs/maintainers/codeql-triage-2026-10-08.md.

AI Disclosure: OpenAI Codex was used to audit reported findings, implement and verify fixes, reconcile branch integration, and update documentation and release notes. The maintainer authorized the merge and release work.

How Has This Been Tested?

Reproduced the IMDb access failure as an HTTP 202 AWS WAF verification challenge; the existing test verifies this is reported distinctly from a private or unavailable list.
Added and passed a route regression test that imports IMDb title IDs, verifies they are submitted through MediaRequest.request as the signed-in owner, and confirms the list becomes manual. Added a test that invalid IDs are rejected.
Added and passed a scheduler regression test verifying manual IMDb imports are skipped by recurring server-side fetching.
IMDb external request-list tests: 17 passed. CSV parser tests: 4 passed.
pnpm typecheck:server, pnpm typecheck:client, ESLint on changed TypeScript files, formatting, and pnpm i18n:check passed.
pnpm release-notes:preview --base origin/main --head HEAD passed.
Hosted CI run 37859037274 passed the application build, all four unit shards, Playwright, all six Cypress shards, both CodeQL languages, i18n, docs checks, and release-note validation on the prior candidate. Its earlier run exposed Cypress fixture and selector failures; these were corrected and the rerun passed. After syncing the latest main and adding Handlebars 4.7.10, hosted CI run 37860129776 passed on the current head. pnpm audit --prod reports no known vulnerabilities in the updated lockfile. No local production build was run; hosted CI performs it.

Screenshots / Logs (if applicable)

No screenshots were captured during this integration. The new settings control is covered by typechecks and hosted CI; no new visual review or live-provider round trip is claimed.

Release Notes

I added a release-note fragment under release-notes/.
This change is internal-only and does not need a user-facing release note.
The fragment includes audience, area, action, and breaking-change status.
I previewed the release text with pnpm release-notes:preview.

Checklist:

I have read and followed the contribution guidelines.
Disclosed any use of AI (see our policy)
I have updated the documentation accordingly.
All new and existing tests passed in hosted CI.
Successful build pnpm build in hosted CI.
Translation keys pnpm i18n:check
Database migration (if required): no migration required; provider is stored in the existing varchar column.

Fixes #159. AI-assisted with OpenAI Codex.

Fixes #160. AI-assisted with OpenAI Codex.

Update the guard to preserve the approved per-user hide preference for managers. AI-assisted with OpenAI Codex.

release-note: none

Use descriptor defaults for English and omit the full locale catalog from the shared app entry. Add fallback regression coverage and a performance release note. AI assistance: Codex helped implement and verify this change.

Scope service help text checks to the open dialog. Return the reader delivery object and empty groups from the responsive fixture. Record final verification and the Cypress safety limitation in the checkpoint. AI assistance: Codex helped with the test repairs and verification. release-note: none

release-note: none

Read live progress from qBittorrent, Transmission, Deluge, and TorrentNG and stream it to open request and media pages over SSE. A shared poller asks only for the info hashes that connected browsers are displaying and stops when nobody is watching. SeerrNG never writes to the clients. Includes the NG ecosystem integration plan that tracks this work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Remove the YunoHost sync workflow, post-commit sync hook, and release manifest updater, and document that existing installs stay on their last published package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Index the Tunerr XMLTV guide with a streaming parser, find upcoming airings by catalog title, and let users request one airing or a whole series. Approval creates a Tunerr recording rule through the authenticated deck API; a Live TV Sync job tracks rule history, re-creates rules removed in Tunerr, and removes finished airings. SeerrNG only schedules against Tunerr versions that report the title_equals, start_window, and rules_only_recorder features. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Non-admin media responses alias download IDs, so live progress now uses opaque, user-scoped subscription tokens issued with each media response. Administrators may still subscribe by info hash. Streams report torrents a client stopped reporting so stale figures clear. Adds login failure diagnostics to two flaky-prone route tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Add an On Live TV button and dialog to movie and series pages, a Recordings page for requesters and managers, and a Live TV (IPTV Tunerr) section under Settings → Services. Document setup and how recordings are tracked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

release-note: none Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Request single tracks through the slskdN wishlist with the usual approval rules, track them with a Soulseek Sync job, list and fix slskdN library-health issues for an album, and identify songs with SongID. Each slskdN feature is probed separately so plain slskd or slskr installs report it as unavailable. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Offer unmatched playlist tracks to Soulseek from the bulk request dialog, add Track Requests and Identify a Song pages, a manager-only Library Health dialog on album pages, and a Soulseek (slskdN) section under Settings → Services. Document setup. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Carry the *arr queue's protocol and download client through download status so administrators can see whether a request is downloading via a torrent client, Usenet, or a direct source such as ChaptarrNG. The non-admin projection already drops both fields. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Pass ROMarrNG's per-file datVerified verdict through the software asset sanitizer and request views, and show DAT Verified (or how many files matched) beside Download copy. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Let users follow teams from IPTV Tunerr's sports schedule. Live TV Sync maps each matched upcoming game to its nearest guide airing and creates a normal recording request, skipping games the user already requested. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

release-note: none Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Build per-user swipe decks for movies, series, and books from SeerrNG's own catalogs (TMDB recommendations and trending, Open Library subjects and trending), skipping owned, requested, and already-swiped titles. Record want/pass/seen swipes with undo for passes, keep per-user taste notes and request preferences, and optionally let Claude reorder the deck with short reasons. Ranking failures and refusals keep catalog order. Adds @anthropic-ai/sdk 0.131.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

github-actions · 2026-10-08T13:42:10Z

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

# Conflicts: # docs/using-seerr/software-acquisition.md # server/api/software/romarrng.contract.test.ts # server/api/software/romarrng.ts

github-actions · 2026-10-08T23:28:16Z

This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged.

…hes-main-20261007 # Conflicts: # docs/maintainers/interface-integration-checkpoint.md

snapetech and others added 30 commits October 1, 2026 18:16

feat: add Docker network setup discovery

4df616b

feat: support native service setup assistance

492d5a2

feat: probe native app ports

335abc7

feat(requests): add per-user external list syncing

a5ce1ce

Fixes #159. AI-assisted with OpenAI Codex.

fix(software): fall back when paged game search fails

1c23147

Fixes #160. AI-assisted with OpenAI Codex.

test(ui): cover manager blocklist preference

ead182d

Update the guard to preserve the approved per-user hide preference for managers. AI-assisted with OpenAI Codex.

feat(software): integrate ROMarrNG DAT catalog

e72f113

docs(maintainers): record ROMarrNG DAT integration evidence

d7db566

docs(maintainers): record final ROMarrNG integration validation

4800035

release-note: none

perf: trim the initial English app bundle

a1f0a8d

Use descriptor defaults for English and omit the full locale catalog from the shared app entry. Add fallback regression coverage and a performance release note. AI assistance: Codex helped implement and verify this change.

feat: integrate SeerrNG workflow improvements

f605182

chore: record reader-groupings ancestry

d4d580c

release-note: none

chore: record romarrng branch ancestry

3ee9306

release-note: none

chore: record cross-platform setup ancestry

d13a012

release-note: none

chore: record issue-fix branch ancestry

81ae0d7

release-note: none

chore: record accepted preview ancestry

15e2ce7

release-note: none

chore: stop publishing the YunoHost package

c7a93b8

Remove the YunoHost sync workflow, post-commit sync hook, and release manifest updater, and document that existing installs stay on their last published package. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: record Tunerr recording-rule fork progress

83c1f37

release-note: none Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs: propose fastest-source routing design

135c5c1

release-note: none Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix(security): resolve locked Next.js 16.3.8

22d192f

github-advanced-security Bot found potential problems Oct 8, 2026

View reviewed changes

Comment thread src/components/GameLibrary/index.tsx Fixed

fix(software): remove duplicate DAT capability

dafc4df

github-actions Bot added the merge conflict label Oct 8, 2026

Keith Snape added 2 commits October 8, 2026 11:00

fix: reconcile software catalog contract and migrations

da97fc6

merge: bring integration up to current main

4578abe

# Conflicts: # docs/using-seerr/software-acquisition.md # server/api/software/romarrng.contract.test.ts # server/api/software/romarrng.ts

github-actions Bot removed the merge conflict label Oct 8, 2026

Keith Snape added 4 commits October 8, 2026 11:15

docs: record current integration checkpoint

afb5fdb

fix: close validation races and repair software provider build

1cae413

docs: use existing security release note

3c5d2f0

test: rate limit game library route harness

51fdac1

github-advanced-security Bot found potential problems Oct 8, 2026

View reviewed changes

Comment thread bin/engine-stable-file-read.test.mjs Fixed

Keith Snape added 10 commits October 8, 2026 12:21

fix: stabilize security and season browser checks

99167cd

fix: diagnose IMDb challenges and stabilize settings tests

3945324

test: wait for software catalog settings to settle

c1322ef

test: use stable selectors for async settings actions

131fe45

test: isolate override rule data in services spec

7a30726

test: use complete public settings response in services spec

7f0d976

test: capture services page state in Cypress failure

e99ef8d

test: return nullable settings service fixtures

c62f2e7

fix: import IMDb watchlists when sync is blocked

ada0c5c

test: stabilize ROMarrNG Cypress fixtures

a1afb3f

github-actions Bot added the merge conflict label Oct 8, 2026

Merge remote-tracking branch 'origin/main' into integration/all-branc…

1762efc

…hes-main-20261007 # Conflicts: # docs/maintainers/interface-integration-checkpoint.md

github-actions Bot removed the merge conflict label Oct 8, 2026

fix: update vulnerable Handlebars dependency

cdba239

snapetech merged commit 0b26a4f into main Oct 8, 2026
35 checks passed

snapetech deleted the integration/all-branches-main-20261007 branch October 8, 2026 23:42

Navigation Menu

Repository navigation

feat: integrate outstanding SeerrNG work and security fixes - #175

feat: integrate outstanding SeerrNG work and security fixes#175
snapetech merged 73 commits into
mainfrom
integration/all-branches-main-20261007

snapetech commented Oct 8, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

snapetech commented Oct 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

How Has This Been Tested?

Screenshots / Logs (if applicable)

Release Notes

Checklist:

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

Uh oh!

github-actions Bot commented Oct 8, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

snapetech commented Oct 8, 2026 •

edited

Loading