chore(deps): update dependency dispatcharr to v0.30.0

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change
dispatcharr	tool.uv.sources	minor	v0.24.0 → v0.30.0

---

Release Notes

Dispatcharr/Dispatcharr (dispatcharr)

v0.30.0

Compare Source

Dispatcharr Release Notes - v0.30.0

✨ New Features

Per-User DVR Access Levels

• Admins can set a single DVR Access level on the user Permissions tab: none, view, or manage. (Closes #​1535)
  • view (the default for standard users) allows channel-scoped listing and playback of recordings
  • manage is opt-in and unlocks the full DVR experience (recordings, recurring and series rules, stop/extend, metadata, artwork, and comskip). System comskip settings remain admin-only
• Streamer accounts are excluded from DVR. The DVR nav item and manage actions in DVR / Guide follow the same gates

Per-User VOD Movie and Series Access

• Admins can turn Movies and Series on or off independently on the user Permissions tab (Enable Movies / Enable Series). (Closes #​1188) - Thanks @​brendongl:
  • Both default on, so existing users keep access after upgrade
  • When a kind is disabled, that user no longer sees it in the web UI, REST catalog, or XC listings, and playback for that kind is blocked

Series Rules: Treat Untagged Episodes as New

• An optional per-rule Treat untagged episodes as new switch for series rules in mode new, useful for guides that only mark repeats. - Thanks @​v8eta:
  • Mode new still defaults to requiring an EPG <new/> tag
  • When enabled, programmes carrying neither <new/> nor <previously-shown/> are also treated as new
  • Programmes tagged <previously-shown/> stay excluded; an explicit <new/> still wins. Existing rules and default behaviour are unchanged
  • The rule editor preview matches what the scheduler would record

Original Air Date in DVR Fallback Filenames

• When a programme has no usable season/episode, TV fallback path templates can include {original_air_date} from the EPG, normalized to YYYY-MM-DD. (Fixes #​1518) - Thanks @​nilleiz:
  • Missing metadata resolves to an empty value without substituting broadcast or recording dates
  • The placeholder is available only for the TV fallback template

Responsive Table Column Sizing

• Channels and Streams tables share available width as ratios between content columns. Dragging a divider transfers space only to the adjacent column, with limits that scale to the table width. (Fixes #​1169)
• Each table includes a reset-widths action. Channels prioritizes the Name column by default; Streams adapts its budget to visible columns

Auto Channel Sync: No Profiles

• The per-group Channel Profiles control includes a No Profiles option. Sync still creates and updates channels but leaves profile membership entirely manual. - Thanks @​raclo:
  • Clearing the selection keeps the historical default of assigning all profiles
  • Selecting one or more real profiles keeps the previous reconciliation behaviour

Empty Channel Profiles and Add to Profile

• Creating a channel profile can Start empty instead of backfilling every channel. (Closes #​1080) - Thanks @​Veneziaisking:
  • Selected channels can be added to another profile from the Channels toolbar without changing the source profile

Persistent Table Working State (Per Tab)

• Channels and Streams filters, sort order, and the Channels profile dropdown persist for the browser tab and restore when you navigate within that tab
• Closing the tab clears them. Page size, column sizing, and column visibility remain stored across sessions as before

🔄 Changes & Improvements

VOD Navigation

• Standard users with movie and/or series access enabled now see VODs in the sidebar (both flags default on)
• /vods redirects to Channels when both are off. When only one kind is allowed, the type control is hidden and the catalog is locked to Movies or Series

Channel Profiles & Tables

• Creating or duplicating a channel profile selects it in the Channels table (and remembers that choice for the tab)
• Channels and Streams header actions are icon-only with tooltips (Edit, Delete, Add, Add to Profile, and related controls)
• M3U and EPG source type filters clear when the tab closes (same pattern as other working table filters)

Dummy EPG Consistency

• Custom dummy, fallback templates, and standard filler programmes now share one generation path for XMLTV export, the EPG grid, and XC single-channel EPG, so filler text and metadata stay consistent across those surfaces

Original Air Date Handling

• Original air date is stored and exposed more consistently from XMLTV and Schedules Direct, so the programme API, UI Original Air, and exported <previously-shown start="..."> align across guide types

Docker, FFmpeg, and Comskip

• The Docker base image is pinned to FFmpeg 8.1.2. Tracking ffmpeg:latest had moved to FFmpeg 9 / NVENC API 13.1, which breaks NVENC on legacy GPUs (for example Pascal) capped at older drivers
• Comskip is built from current upstream instead of the distro package

Error Reporting

• The frontend error boundary shows a diagnostic recovery panel with a copyable report. Stacks are decoded against a production sourcemap only when an error occurs and a report is requested

🐛 Bug Fixes

DVR & Series Rules

• Fixed TV recording filenames losing season/episode after an EPG refresh replaced the programme row. Bookings keep S/E from the snapshot when the live guide row is gone. (Fixes #​1307) - Thanks @​v8eta
• Fixed series rules double-booking when an identity-less recording later matched an identifiable listing after a small start-time nudge. - Thanks @​v8eta
• Fixed series rules scheduling a second recording when XMLTV nudges programme start/end between refreshes. - Thanks @​v8eta
• Fixed series rules resolving the wrong EPG copy when the same tvg_id exists on multiple sources, and rules that silently scheduled nothing when the channel used an override EPG. New rules pin a specific EPG source. (Fixes #​1529)
• Fixed scheduling an in-progress programme leaving the recording stuck in Upcoming instead of starting immediately

Dummy EPG & Guides

• Fixed custom dummy EPG leaving a channel empty until shortly before a dated event. Filler now runs from the current time (or export lookback) through the event and after
• Fixed dummy EPG grid and XC endpoints ignoring channel name overrides and stream-based regex parsing, and ignoring export-window bounds for on-demand dummy programmes
• Fixed dummy EPG fallback templates generating a full-day grid when a narrower export window was requested
• Fixed XC short EPG returning (and building) a full multi-day dummy grid instead of honouring the requested limit
• Fixed TV Guide showing stale or wrong channel logos after bulk-adding channels. (Fixes #​955)

Live Streaming & Player

• Fixed the live web player stopping permanently on a transient network error; it now reconnects with backoff. (Fixes #​1566) - Thanks @​jstevenscl
• Fixed live proxy failover sticking on the last backup after every stream was tried once. After a successful connection, rotation can wrap back to the first stream after a short cooldown. (Fixes #​310)
• Fixed manual stream switches not clearing failover bookkeeping on the worker that owns the channel, so automatic failover could still skip streams marked tried

VOD & XC Playback

• Fixed XC VOD playback returning 500 instead of 401/403 on bad credentials or blocked networks. - Thanks @​brendongl
• Fixed XC VOD episode streaming returning 500 for a stale or missing episode ID; missing episodes now return 404. - Thanks @​jstevenscl

Channels, Logos & Auto Sync

• Fixed Channels table crashing or getting stuck refreshing when stale client state contained invalid rows
• Fixed deleting the currently selected channel profile crashing the Channels page
• Fixed Auto Channel Sync failing or clearing logos when a provider supplies an oversized logo URL (for example embedded base64). Channel creation continues without a logo, and a valid existing logo is kept. - Thanks @​raclo
• Fixed uploading a logo with the same filename as an existing one silently keeping the old image. The UI now prompts to confirm overwrite; API clients get 409 unless overwrite=true. (Fixes #​330)
• Fixed bulk channel creation and VOD import failing when provider-supplied logo names exceed 255 characters. (Fixes #​1470)
• Fixed artwork URLs without a trailing slash returning the SPA HTML shell instead of the image (channel logos, VOD images, Schedules Direct posters). (Fixes #​1590)

Docker, Redis & Stability

• Fixed busy Docker deployments failing new live streams with Too many open files while the UI and healthcheck still looked healthy. Web workers now raise their open-file limit after startup (default 65536, overridable with DISPATCHARR_NOFILE). (Fixes #​1554) - Thanks @​brendongl
• Fixed Redis idle clients and connection pools accumulating open sockets under load; idle clients time out and pools are bounded
• Fixed live-proxy background work starting in Celery and Daphne processes that do not serve streams
• Fixed Celery Beat missing future recordings when /etc/localtime was bind-mounted from a non-UTC host
• Fixed Comskip aborting on decoder init in Docker. It now runs with a single decoder thread, and failures log returncode, command, and stderr. (Fixes #​1251)
• Fixed forgot-password Docker instructions omitting -it on docker exec, so changepassword could not accept interactive input. - Thanks @​andreyan-andreev

EPG, Schedules Direct & Logging

• Fixed Schedules Direct guide refresh silently dropping channels on transient API failures (false "up to date" or placeholder titles). Batched requests now retry with backoff
• Fixed application log timestamps always showing UTC even when the UI display timezone differed. Logs now follow the configured display timezone. (Fixes #​1439) - Thanks @​nagelm

Login & UI

• Fixed login always sending you to /channels instead of the page you originally requested, and flashing the login form on page load when a valid session already existed. (Fixes #​715, Fixes #​1526, Fixes #​1576)
• Fixed VODs double-fetching the catalog on mount when page size or single-type access was still settling

v0.29.0

Compare Source

✨ New Features

VOD Mature Content Filtering

• VOD movies now store and honor an adult / mature flag from Xtream Codes providers, the same way live streams do
• Non-admin users with Hide Mature Content enabled no longer see adult movies in the movies API or XC VOD listings
• Existing libraries are backfilled from previously synced provider data where available

Redirect as Default for VOD and Catch-up

• When Redirect is the global default stream profile, VOD and catch-up playback can hand clients straight to the provider URL instead of proxying through Dispatcharr
• First requests without an existing session redirect to a capacity-aware provider URL; clients that already have a session keep proxying as before
• Stream settings note that Redirect as the default also applies to VOD and catch-up

M3U & EPG Source Type Filters

• The M3U and EPG source tables on M3U & EPG Manager now include a type filter (M3U/XC for playlists; XMLTV/Schedules Direct/Dummy for EPG), matching the checklist-style filter used on the Channels page
• Selections persist per table across reloads, and a Reset option appears once anything is unchecked

VOD Artwork Proxy for Backdrops and Episode Stills

• Movie backdrops, series artwork, and episode stills are served through Dispatcharr's image proxy (with nginx caching), so clients get consistent, proxied artwork URLs instead of raw provider links. (Closes #​863, Fixes #​1174)
• The VOD UI prefers cached poster URLs when available

Stream Profile {channelId} Token

• Stream Profile parameters now support a {channelId} substitution token alongside {streamUrl} and {userAgent}, so a single profile can embed the channel's ID in ffmpeg (or other) arguments. (Closes #​1252)

🔄 Changes & Improvements

Settings & Navigation

• Settings opens as a slide-over panel from the sidebar instead of a separate accordion page. Back returns to the main nav while keeping your last settings section active
• Main sidebar groups render as flat, labeled sections, and the sidebar's collapsed/expanded state is remembered across reloads
• Connections and Logs are merged into a single Connect page under System; the log viewer sits in a collapsible section at the bottom of that page

Tables & Forms

• Stream Profiles, Output Profiles, and User-Agents tables on Settings grow to fit their content instead of clipping to a fixed height
• The user form Allowed IPs description clarifies that the field only further restricts access within global Network Access; it cannot widen the global allowlist
• Usernames and XC passwords accept a small set of path-safe special characters (., _, @, -) in addition to letters and numbers. - Thanks @​write-erase

Performance

• The default User-Agent string is cached for hot paths (logo proxies, provider requests), reducing repeated settings lookups during streaming and refresh

🐛 Bug Fixes

DVR & Comskip

• Fixed Comskip hardware acceleration passing an unsupported Intel flag. The former Quick Sync option is now Hardware assist (hwassist); previously saved qsv values are treated as hwassist. NVIDIA still uses CUDA/cuvid. (Fixes #​1503)
• Fixed scheduled recordings silently failing to start when a brief database error hit at fire time. The start guard now retries briefly before giving up. (Fixes #​1464) - Thanks @​nagelm

Live Streaming

• Fixed a stable stream that went dead mid-playback hanging forever instead of reconnecting. Health-driven reconnects now reopen the same URL and still count toward the normal retry/failover budget. (Fixes #​1493)

VOD & Series

• Fixed VOD list sync wiping movie/series detail (plots and related metadata) after an M3U/XC refresh, so opening a title soon after sync no longer skipped re-fetching missing detail
• Fixed artwork for shared movies/series/episodes preferring the wrong provider or mixing proxied and raw URLs. Resolution now prefers the active provider relation, then shared metadata, then the synced VOD logo
• Fixed the Series modal flashing the previous provider's episodes and loading slowly on large shows when switching providers
• Fixed Season 0 (specials) being merged into Season 1 in XC series info and in the Series modal; specials now keep their own season/tab
• Fixed VOD series refresh crashing when a provider returns episodes as a JSON array instead of an object. (Fixes #​934)
• Fixed the VOD logo/poster proxy using a generic User-Agent that some image hosts reject. It now uses your configured default User-Agent. - Thanks @​gianlucalauro

M3U Accounts & Profiles

• Fixed M3U refresh status updates overwriting the default profile and clobbering XC expiration dates. (Fixes #​1430)
• Fixed manual expiration on a Standard M3U account reverting to a leftover XC date after converting the account type
• Fixed the account form and default-profile editor fighting over expiration while both are open; the unsaved date stays in sync either way
• Fixed the Auto Channel Sync Configure modal crashing on groups whose channel profile IDs were stored as numbers
• Fixed M3U profile regex preview (and live URL rewrites) stalling the server on catastrophic patterns. Preview inputs are length-capped and substitutions time out like Auto Channel Sync rename

EPG & Guides

• Fixed hand-assigned / override EPG on channels (common with auto-sync) being ignored for programme import and Schedules Direct mapped fetches, and XMLTV lagging after mapping changes. (Fixes #​1485)
• Fixed bare XMLTV <episode-num> values without a system attribute being dropped on import. (Fixes #​1491)
• Fixed Schedules Direct Extra Debugging staying on after SD returned code 2055 when a cached token skipped a new login. The toggle now clears and the request is retried without the debug header

Logos & Output

• Fixed Logo Manager resetting a custom name whenever the Logo URL field was focused or blurred. The name is only suggested from the URL when the name field is empty. (Fixes #​845)
• Fixed direct-link M3U output stripping the VLC-style @ from multicast UDP URLs, which broke joining those streams in players like VLC. (Fixes #​1406) - Thanks @​haroldm

UI & Environment

• Fixed M3U and EPG source tables using a fixed height with a nested scrollbar. They now size to their content (with an empty state) and only scroll once they reach the viewport height. - Thanks @​nagelm
• Fixed the public IP in the sidebar staying stale for up to an hour after the server's IP changed (for example after a VPN reconnect). The cached value still shows immediately, then re-verifies in the background. (Fixes #​1395) - Thanks @​floppy-disk

🔒 Security

• Django admin deep paths (such as /admin/login/) are blocked by nginx when admin is disabled, without breaking XC streams whose username is admin
• Django admin login shares the same per-IP rate limit as JWT/API login (3/minute), keyed from the trusted client IP
• M3U and EPG caches include the request origin in their keys so absolute logo/stream/guide URLs from one Host cannot leak into another client's playlist or guide. (Fixes #​1390)
• Channel profile membership updates can no longer change another user's profile by ID; non-admins only see and edit profiles assigned to them
• Channel and VOD image proxy hardens remote artwork fetches against SSRF and same-origin active content (validated outbound targets, capped redirects, content-type from file bytes, SVG sandboxing). Dead artwork responses are briefly cached so workers do not stampede upstream
• Live connection telemetry (channel/VOD/catch-up stats and related WebSocket pushes) and the system-events API are admin-only; standard users still receive EPG and general notifications
• Client IP detection trusts forwarded headers only from private-network proxies by default (Docker/Traefik-style setups), so spoofed headers from public peers are ignored. Optionally set DISPATCHARR_TRUSTED_PROXIES to a specific proxy CIDR, or none to disable header trust. (Closes #​1410)
• First-time web setup (initialize-superuser) only accepts local/private networks by default unless DISPATCHARR_SETUP_ALLOWED_IP is set for remote/VPS install
• Updated Django 6.0.6 → 6.0.7 for security fixes (cached Set-Cookie exposure, GDALRaster over-read, and header injection via domain validation)
• Updated frontend npm dependencies for known vulnerabilities:
  • brace-expansion 5.0.6 → 5.0.9 (High: DoS via exponential/unbounded brace expansion, including a bypass of the prior mitigation) (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895)
  • js-yaml 5.1.0 → 5.2.2 (Moderate/High: quadratic/exponential YAML parse DoS) (GHSA-g796-fgmg-93mv, GHSA-724g-mxrg-4qvm, GHSA-pm4m-ph32-ghv5)
  • nanoid 3.3.16 → 3.3.18 (High: infinite loop when a custom generator is called with size zero) (GHSA-2v37-7h3g-55p8)
  • postcss 8.5.13 → 8.5.23 (High: path traversal in source map auto-loading) (GHSA-r28c-9q8g-f849)
  • react-router / react-router-dom 7.17.0 → 7.18.2 (Moderate/High: open redirect, XSS, constructor injection, route-matching DoS, RSC CSRF bypass) (GHSA-wrjc-x8rr-h8h6, GHSA-h8fp-f39c-q6mh, GHSA-337j-9hxr-rhxg, GHSA-chx6-hx7r-mcp5, GHSA-qwww-vcr4-c8h2)

Reverse proxy users: Review your proxy config after upgrading.

• Allow (or pass through) the new VOD artwork paths used for backdrops and episode stills: /api/vod/movies/{id}/image/, /api/vod/series/{id}/image/, and /api/vod/episodes/{id}/image/. If your proxy only whitelists specific /api/... locations, add these or artwork may fail to load.
• Client IP, network access, login rate limits, and related checks now honor X-Real-IP / X-Forwarded-For only from trusted proxies. Private/loopback peers are trusted by default (typical Docker/Traefik setups). If your outer proxy connects from a public IP, or you want to narrow trust, set DISPATCHARR_TRUSTED_PROXIES to that proxy's IP or CIDR (for example 172.18.0.0/16). Use none to ignore forwarded headers entirely. If this is wrong, public clients can show up as a local/private IP (often the proxy itself), which can bypass Network Access rules, skew login rate limits, and mislabel connections in Stats and logs. Confirm real client IPs after upgrading.

v0.28.2

Compare Source

✨ New Features

Extra Schedules Direct Debugging

• EPG source settings include an Extra Schedules Direct Debugging toggle for use only when Schedules Direct support asks you to enable it. If SD reports an unexpected debug connection, the toggle turns itself off automatically.

🔄 Changes & Improvements

Schedules Direct Settings UI

• Auto-Apply EPG Logos now appears in the shared middle column for both XMLTV and Schedules Direct sources, matching the XMLTV layout. SD-specific options (logo style, posters, debug) stay in the right panel.

Schedules Direct Posters & Auth

• Programme poster requests reuse a shared SD session across workers instead of each process logging in separately, which reduces unnecessary token calls and is more reliable under load.

Image Cache Layout

• Logo and poster caches now live under /data/cache/ instead of /data/logo_cache. On startup, an existing /data/logo_cache folder is moved once to /data/cache/logos so previously downloaded logos are kept.
• Channel and VOD logos are cached at /data/cache/logos for 24 hours.
• Schedules Direct programme posters use a separate cache at /data/cache/sd_posters for 14 days, so the same artwork is not re-downloaded as often and counts less against SD's daily image limit.

🐛 Bug Fixes

Schedules Direct Posters

• Fixed programme artwork requests continuing after Schedules Direct's daily image download limit was reached. Dispatcharr now detects that limit, stops further image fetches for the source until the next day (UTC), and avoids retrying images SD has already reported as missing.
• Fixed poster links sometimes not being saved after an EPG refresh when artwork metadata was incomplete, so programmes that still need artwork can pick up posters on the next run.

Schedules Direct Authentication & Lineups

• Fixed unclear or misleading errors when Schedules Direct is offline, busy, or rejecting logins from too many IPs. Messages now describe the situation more clearly, including when you should not keep retrying.
• Fixed Dispatcharr repeatedly requesting new SD tokens after credential or account failures that will not clear on their own (bad password, account lock, login/IP limits). Those cases now cool down until you change credentials or the lockout expires, instead of hammering /token.
• Fixed lineup add/remove not fully respecting Schedules Direct's daily change limit. The UI blocks remove when no changes remain for the day, and deletes that hit the limit are handled cleanly.

Schedules Direct users: update as soon as possible. Earlier versions could keep requesting programme artwork after Schedules Direct's daily image download limit was reached, which risks account restrictions. This release stops further image fetches once that limit is hit and improves SD authentication so bad credentials and lockouts are not retried endlessly.

v0.28.1

Compare Source

🐛 Bug Fixes

Docker & First Boot

• Fixed fresh all-in-one (AIO) installs crashing during first-boot database setup when Redis was not ready yet. After the settings cache introduced in v0.28.0, startup migrations could fail with a connection error, leave the database only partly migrated, and loop on restart. Settings reads now fall back to the database when Redis is unreachable so first boot can complete normally. (Fixes #​1459)

v0.28.0

Compare Source

✨ New Features

XC Catch-up (Timeshift) Support

• Dispatcharr now proxies catch-up / timeshift playback from Xtream Codes providers to IPTV clients, so viewers can watch recent programmes from supported channels. (Closes #​133) - Thanks @​cedric-marcoux:
  • Path-style (/timeshift/...) and query-style (/streaming/timeshift.php) catch-up URLs are both supported - Thanks @​dillardblom
  • Catch-up sessions appear on the Stats page in dedicated connection cards (separate from live and VOD), with channel logo, programme preview, playback position, bitrate, and a stop button
  • Cards update in real time, advance to the next EPG programme when playback continues past the original show, and can notify you when sessions start or end
  • Channels and streams with catch-up show a history icon in the Channels and Streams tables (with archive days in the tooltip when known), plus an Only Catch-up filter
  • Multi-provider failover walks catch-up streams in channel order (like live playback), preferring archives that cover the requested programme age
  • Catch-up respects provider connection limits, per-channel access rules, and user stream limits
  • Guide output advertises catch-up availability (tv_archive / archive duration) and can auto-detect how many previous days to include in XMLTV (overridable per user or via URL)
  • Native apps can start, update playhead/pause state, and end catch-up sessions through a REST API that returns a playback URL suitable for headerless video players
• Enable Catchup can be turned off globally in System Settings, or per user on the Permissions tab, to block timeshift playback and stop advertising catch-up to XC clients while still showing catch-up indicators in the web UI

XZ-Compressed EPG and M3U Sources

• EPG sources and uploaded M3U playlists can now use .xz compression alongside .gz and .zip. Auto-import from /data/epgs also picks up .xz files. (Closes #​1414) - Thanks @​MotWakorb

🔄 Changes & Improvements

VOD Playback

• VOD playback now fails over across M3U accounts when the preferred account is at capacity, trying other accounts that carry the same title in priority order (matching live-channel behaviour). Previously a full account returned an error even when another account had free slots. (Closes #​1385) - Thanks @​francescodg89-crypto

Channels & URLs

• The channel list API paginates when only page_size is provided (page 1). Omitting both page and page_size still returns the full list for legacy clients and plugins
• Stream, M3U, and EPG URLs with Docker-style hostnames that include underscores (e.g. http://my_service/) are now accepted. - Thanks @​recurst

Stats

• The Stats page loads live, VOD, and catch-up connection data from a single combined stats endpoint instead of separate requests

Performance

• System and proxy settings used on every stream request are cached so hot paths no longer hit the database on each call
• M3U and XC refreshes on large accounts are faster and use less memory: unchanged streams are touched lightly, filters compile once, playlists stream from disk, and workers reclaim memory after large jobs

Frontend Testing

• Unit test coverage was extended across table components, plugins, backups, settings, forms, modals, Connect, and Plugin Browse. - Thanks @​nick4810

🐛 Bug Fixes

Live Streaming & Failover

• Fixed deleting a channel while it was playing leaving a hung proxy session or stuck provider connection. Manual delete can optionally leave playback running; auto-sync still stops sessions before removing channels. Stats stop still releases connection slots even if the channel row is already gone (Fixes #​870)
• Fixed long output-profile and fMP4 remux/transcode sessions (over about an hour) losing Redis coordination keys and failing for late joiners or format/profile switches
• Fixed failed channel startups leaving ghost "initializing" sessions that blocked playback with a permanent connection-stalled error and never failed over
• Fixed live streaming paths that could exhaust per-worker database connections and cause unrelated pages (including XC/player_api) to hang under load (Fixes #​1418)
• Fixed channels staying stuck on buffering in Stats after a buffering-timeout failover even after the new stream recovered (Fixes #​1449)
• Fixed the default VLC stream profile not failing over when the upstream URL could not be opened (Fixes #​1415)
• Fixed isolated provider disconnects hours apart exhausting the retry budget and switching streams unnecessarily. Retries now reset after 30 minutes of stable playback; three failures within that window still trigger failover
• Fixed failover jumping back to the first stream after a stable session on a backup. Rotation now continues in channel order (matching manual next-stream)
• Fixed preview/join failing with a server error when attaching to an active channel on a different worker while an output profile was starting
• Fixed stream switches in multi-worker setups reporting success or leaving status stuck on the old stream. Switches now wait for confirmation and update the active stream correctly (Fixes #​1412)

VOD

• Fixed VOD sessions (especially Jellyfin/FFmpeg clients using concurrent byte-range requests) leaving provider connection slots occupied until restart (Fixes #​1426)

Channels & UI

• Fixed Copy URL on the Channels table including web-player output profile parameters. Copied links are now plain stream URLs suitable for external players; Watch still applies player preferences
• Fixed API error toasts dumping raw HTML error pages when the backend returned a 500/502/504. Errors now show a short, readable message (Fixes #​1261) - Thanks @​nagelm
• Fixed the cron builder's every-6-hours / every-12-hours presets saving the wrong expression (e.g. once daily at hour 6 instead of every 6 hours). Hourly schedules now include an Interval control so step patterns are preserved (Fixes #​1320)
• Fixed Auto Channel Sync Find and Replace preview showing literal $1 instead of the substituted capture group, and previewing changes the sync would skip. Preview and rename now match (Fixes #​1332) - Thanks @​CodeBormen
• Fixed bulk channel delete, drag reorder, and inline channel-number edits clearing selection or continuing before the table finished refreshing. - Thanks @​nick4810
• Fixed Backup Manager timestamps not updating when date/time display preferences change until the page was reloaded

EPG & Guides

• Fixed programme times shifting in XMLTV output when PostgreSQL's server timezone was not UTC (common with certain Docker timezone mounts). (Fixes #​651) - Thanks @​nagelm
• Fixed EPG channel parsing progress showing values over 100% when the guide grew larger than the previous import
• Fixed full EPG refreshes racing with per-channel parses, which could wipe or skip guide data for channels matched during a refresh
• Fixed a failed per-channel EPG parse wiping the previous guide for that channel. Failed parses now leave the existing programmes in place
• Fixed cold EPG output rebuilds freezing login, API, and HDHomeRun requests on the same worker until the rebuild finished (Fixes #​1396)

M3U, XC & VOD Refresh

• Fixed XC refreshes that returned no live streams (transient provider failure or empty categories) deleting the entire auto-created channel lineup. Empty results now abort safely and keep the existing channels (Fixes #​1377) - Thanks @​Jacob-Lasky
• Fixed VOD refreshes that returned an empty category list wiping group selections and movie relations, leaving all VOD groups unselected after a later successful refresh
• Fixed M3U refresh completion counts treating every existing stream as "updated". Counts now reflect real metadata changes, and reports include streams marked stale versus removed
• Fixed M3U group processing failing the whole refresh after a single poisoned database connection instead of retrying once
• Fixed XC live streams, panel API, and authenticated XMLTV export crashing when a visible channel had no channel number. Those channels now receive a free number in output

Plugins & Background Workers

• Fixed plugin discovery in multi-worker setups repeatedly reloading every plugin on connect/disconnect events, leaking background threads and degrading workers until restart (Fixes #​1452)
• Fixed Celery background workers sharing the web process database pool, which could corrupt Postgres sessions under concurrent tasks (e.g. M3U/EPG refreshes failing with transaction errors) (Fixes #​1404)
• Fixed worker startup paths holding a database connection permanently from process boot, reducing available connections for streaming and API traffic

API Documentation

• Fixed Swagger/OpenAPI schema generation failing or hanging when multiple requests hit the schema endpoint at once (for example opening Swagger UI)

🔒 Security

• Hardened authentication and file-serving boundaries:
  • Logo and VOD logo cache endpoints no longer allow path traversal outside /data/logos; empty logo URLs return 404 instead of fetching remotely
  • EPG source file upload API is admin-only and rejects filenames that escape the uploads directory
  • M3U account passwords are omitted from API responses for non-admin users
  • Channel bulk rename, EPG apply actions, channel reorder/cleanup, recording control actions, and Connect integration APIs now require admin
  • Creating or modifying system notifications requires admin; users can still list and dismiss notifications visible to them
  • Unused unauthenticated legacy stream routes were removed; live playback continues via the standard proxy stream URL

v0.27.2

Compare Source

✨ New Features

Client Connect Grace Period

• A new Client Connect Grace Period setting controls how long a channel stays up after its buffer is ready but before any viewer connects (default 5 seconds)
• Useful when channels are warmed up ahead of time (for example via the proxy API) so the first tune-in does not start from a cold buffer
• Found under Settings → Proxy → Show Advanced Settings as Client Connect Grace Period

🔄 Changes & Improvements

Live Proxy Timeout Settings

• Live proxy timing is now split into three separate settings, each with a clear purpose:
  • Channel Initialization Timeout (default 60 seconds): how long a channel may spend connecting and cycling through failover streams before giving up during startup
  • Client Connect Grace Period (default 5 seconds): how long a ready channel with no viewers stays up waiting for the first client
  • Channel Shutdown Delay (default 0 seconds): delay after the last viewer disconnects only. It no longer applies when the buffer is ready but no one has tuned in yet
• On upgrade, Channel Initialization Timeout is raised to 60 seconds automatically if your stored value is below 60 (values already at 60 or higher are unchanged). The old 5 second default was too short when a channel has many failover streams to work through or some slow to start sources (such as an HDHR).

Proxy Settings UI

• Settings → Proxy now shows day-to-day tuning fields by default: Buffering Timeout, Buffering Speed, Channel Shutdown Delay, and New Client Buffer
• Less frequently changed options are grouped under Show Advanced Settings: Buffer Chunk TTL, Channel Initialization Timeout, and Client Connect Grace Period

v0.27.1

Compare Source

🔄 Changes & Improvements

VOD XC API Output

• The Xtream Codes-compatible get_vod_streams and get_series API endpoints are significantly faster. Typical full-library response times drop from roughly 25 seconds to under 10 seconds on very large catalogs (e.g. 125k+ titles)
• Those endpoints no longer risk exhausting container shared memory on large libraries, which could cause failures on default Docker setups

EPG & XMLTV Export

• XMLTV EPG export is faster and uses far less memory when generating guides for large channel lineups.
• The EPG grid view no longer holds onto extra memory after each request, keeping worker memory stable when browsing programme schedules
• EPG data storage was reorganized so routine EPG operations no longer pull large internal index data into memory unless it is actually needed, improving responsiveness across EPG refreshes, exports, and the channel editor

Channels

• The channel list loads faster when stream details are included (as used by the Channels page), especially as your channel count grows

Dependencies

• Updated requests, gevent, torch, sentence-transformers, and lxml to current versions

🐛 Bug Fixes

Live Streaming

• Fixed live preview and playback timing out after 10 seconds while a channel was still connecting. Startup now respects your configured Channel Initialization Grace Period instead of a hardcoded limit (Fixes #​1380)
• Fixed channels staying in a connecting state longer than necessary. Once the buffer is ready and a viewer is watching, the channel is marked active immediately
• Fixed Xtream Codes live streams failing or using incorrect URLs when the account server URL was pasted from an API page (e.g. including /player_api.php or query parameters). Live playback now builds clean upstream URLs from your account settings (Fixes #​1363)
• Fixed live streaming paths that could hold database connections open during playback and failover, which under load could contribute to slow or failed requests on other pages

DVR & Recording Playback

• Fixed completed DVR recordings failing to play in the built-in video player. Playback now accepts authentication via a ?token= query parameter, which native <video> elements require because they cannot send login headers
• Fixed HLS recording playback rejecting ?token= authentication on the dedicated segment URL route. Token-based clients now work consistently across all recording playback paths
• Fixed in-progress DVR recordings jumping to the live edge shortly after playback starts. You can now watch, pause, and scrub from the beginning while the recording continues (Fixes #​1329)
• Fixed authentication tokens being dropped when recording playback redirects between file and HLS URLs

M3U Accounts & Auto-Sync

• Fixed M3U account refreshes leaving accounts stuck in a fetching or parsing state after failures, and improved recovery when background workers hit database connection errors (Fixes #​1338)
• Fixed legacy M3U account settings stored in an unexpected format causing refresh, profile sync, and auto-sync to fail
• Fixed the auto-sync Range conflict warning incorrectly flagging channels that belong to the override target group when a channel-group override is configured. Genuine conflicts (manual channels, other accounts, pinned numbers) still appear (Fixes #​1331) - Thanks @​CodeBormen
• Fixed failed M3U refresh tasks reporting as failed in the task queue even after the account status was already updated to show the error in the UI

EPG

• Fixed EPG source refreshes leaving sources stuck in a fetching or parsing state after failures, with improved recovery from transient database errors during large guide updates
• Fixed EPG import triggers loading unnecessary data from the source record, making manual and automated EPG imports lighter on memory

API Documentation

• Fixed OpenAPI schema paths for nested M3U profile and filter endpoints containing escaped slashes, which broke code generators for API clients (Fixes #​1384)

🔒 Security

• Updated the Docker base image to FFmpeg 8.1.2, addressing High severity PixelSmash (CVE-2026-8461). A heap out-of-bounds write in FFmpeg's MagicYUV decoder could allow denial of service or remote code execution when a specially crafted media file is processed. Dispatcharr uses FFmpeg for live transcoding, DVR, and related media workflows, so pull the latest image to receive this fix.
• Updated Django from 6.0.5 to 6.0.6 to address five security vulnerabilities related to signed cookies, SMTP email transmission, and cache header handling
• Updated frontend build dependencies to resolve four audit findings:
  • Updated vite from 7.3.2 to 7.3.5, addressing moderate NTLMv2 hash disclosure via UNC path handling on Windows (GHSA-v6wh-96g9-6wx3) and high server.fs.deny bypass on Windows alternate paths (GHSA-fx2h-pf6j-xcff)
  • Updated js-yaml from 4.1.1 to 5.1.0, addressing moderate denial-of-service risk in merge key handling (GHSA-h67p-54hq-rp68)
  • Updated esbuild from 0.27.3 to 0.28.1, addressing low arbitrary file read when running the development server on Windows (GHSA-g7r4-m6w7-qqqr)

v0.27.0

Compare Source

✨ New Features

Manual Server Groups for Shared Connection Limits

• You can now assign M3U accounts to Server Groups so accounts that share the same provider login count against a shared connection limit instead of each account maintaining its own separate counter. (Closes #​1137) - Thanks @​Goldenfreddy0703:
  • A new Server Groups manager on the M3U Accounts page lets you create, rename, and delete groups and see how many accounts belong to each one
  • The M3U account form includes a Server Group picker with an inline option to add a new group
  • Live and VOD playback both respect grouped limits, including profile rotation when one account in the group reaches its cap
  • Accounts in the same group with different provider logins still maintain separate counters — grouping only shares limits when the credentials match
  • Live profile switches move the shared counter when the new profile uses a different login; same-login switches leave the counter unchanged

🔄 Changes & Improvements

EPG Auto-Match

• EPG auto-matching has been overhauled for large libraries — faster, lower memory use, and more reliable results:
  • Single-channel auto-match now runs in the background and reports results over the WebSocket, so large EPG sources no longer hit HTTP timeouts
  • Single-channel and selected-channel auto-match always run, even when a channel already has EPG assigned; match-all still only processes channels without EPG
  • Rematching to the same EPG no longer triggers unnecessary saves or program refreshes
  • Matching streams EPG data instead of loading the full catalog into memory, bounds ML validation to a small candidate set, and skips slow ML when a strong fuzzy match is already reliable
  • Bulk matching uses fewer passes over the catalog and batched database updates instead of one query per channel

EPG Channel Search

• The EPG picker in the channel editor now works more like a normal search box. - Thanks @​FiveBoroughs:
  • Type several words at once (e.g. sky uk) and it finds channels where every word appears somewhere in the name or TVG-ID
  • Word order does not matter, and accents are ignored so decale matches Décalé

Schedules Direct

• Guide refreshes now fetch schedule data only for mapped channels instead of the entire lineup, reducing unnecessary API calls when unmapped stations change
• Mapping a channel now triggers a targeted guide fetch so guide data appears immediately without waiting for the next full source refresh
• Bulk assignment of three or more Schedules Direct stations without guide data queues one batched fetch instead of separate API sessions per station
• The lineup search country dropdown now loads the full Schedules Direct country list through the backend instead of failing in the browser and falling back to a hardcoded short list. - Thanks @​sethwv
• Program poster images now include the User-Agent header Schedules Direct requires, so posters load correctly instead of failing silently

Plugin Repository

• Plugin repository manifests now support separate download and metadata base URLs, so repo authors can serve release zips and manifest/icon files from different origins without hard-coding absolute URLs everywhere. Manifests that use only a single base URL behave exactly as before. - Thanks @​sethwv

M3U & Live Streaming

• XC live streams now build upstream URLs from current account credentials at tune-in instead of reusing the URL stored during sync, so playback stays correct after credential or profile changes and when Server Groups rotate between accounts
• Channel stream switches and live playback now verify pooled connection capacity before switching and clean up stale slot assignments left behind after a channel stops

Database

• Pooled database connections now rotate on a configurable lifetime (default 10 minutes, overridable via DATABASE_POOL_CONN_MAX_LIFETIME; set to 0 to disable), preventing idle connections from accumulating indefinitely while still reusing warm connections within the window. (Fixes #​1343)
• PostgreSQL connections are now labeled by process role (e.g. uWSGI worker, Celery worker, DVR worker) in database monitoring tools, making it easier to see which Dispatcharr process owns each connection

Performance

• EPG programme refresh for large XMLTV sources now processes data in batches instead of holding the entire guide in memory first, sharply reducing peak memory use during big EPG updates
• VOD movie and series matching during sync no longer scans the entire no-ID catalog on every batch — lookups are scoped to the current batch, reducing memory and database time per chunk
• XC live channel refresh releases the full provider catalog from memory sooner and cleans up after each batch, keeping memory use lower during large live syncs
• Connect event dispatch no longer loads the entire plugin catalog on every client connect/disconnect when no plugins subscribe to the event

🐛 Bug Fixes

Live Streaming & Channel Teardown

• Fixed live channels staying running with no clients after disconnect, which could leave upstream connections and provider slots occupied indefinitely
• Fixed client reconnect during channel teardown wedging the channel across workers, causing reconnect loops and orphaned upstream connections. (Fixes #​1342)
• Fixed channels not stopping promptly when the last client disconnects and then reconnects within the shutdown grace period. The timer now resets from the latest disconnect instead of the first one
• Fixed zombie ffmpeg processes surviving teardown and immediately recreating Redis buffer data after orphan cleanup ran
• Fixed rapid channel switching leaving persistent empty buffer entries in Redis
• Fixed live channels returning errors or failing to start cleanly during active teardown when clients retune quickly
• Fixed stale stream assignments after a channel stopped causing the next tune-in to skip connection accounting and reach the provider without incrementing counters

Database Connections & Responsiveness

• Fixed database connection leaks during live streaming, VOD playback, plugin actions, and system event handling that could exhaust the per-worker connection pool and cause 503 errors on unrelated pages under load. (Fixes #​1345)
• Fixed system events and plugin hooks blocking streaming paths while waiting on slow Connect integrations or third-party plugin code
• Fixed plugin discovery leaving idle database connections open after worker startup
• Fixed VOD playback and background VOD stats refresh holding database connections for the entire duration of a stream

EPG Auto-Match

• Fixed incorrect channel assignments from global ML similarity scoring — validation now checks the fuzzy best match instead of scoring the entire catalog
• Fixed the auto-match spinner in the channel editor sticking after errors or early task exits
• Fixed bulk auto-match completion re-applying every match and queueing redundant program-parse tasks even when assignments were unchanged

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.