Dispatcharr Files

🔄 Changes & Improvements

VOD XC API Output

• The Xtream Codes-compatible get_vod_streams and get_series API endpoints are significantly faster. Typical full-library response times drop from roughly 25 seconds to under 10 seconds on very large catalogs (e.g. 125k+ titles)
• Those endpoints no longer risk exhausting container shared memory on large libraries, which could cause failures on default Docker setups

EPG & XMLTV Export

• XMLTV EPG export is faster and uses far less memory when generating guides for large channel lineups.
• The EPG grid view no longer holds onto extra memory after each request, keeping worker memory stable when browsing programme schedules
• EPG data storage was reorganized so routine EPG operations no longer pull large internal index data into memory unless it is actually needed, improving responsiveness across EPG refreshes, exports, and the channel editor

Channels

• The channel list loads faster when stream details are included (as used by the Channels page), especially as your channel count grows

Dependencies

• Updated requests, gevent, torch, sentence-transformers, and lxml to current versions

🐛 Bug Fixes

Live Streaming

• Fixed live preview and playback timing out after 10 seconds while a channel was still connecting. Startup now respects your configured Channel Initialization Grace Period instead of a hardcoded limit (Fixes [#1380])
• Fixed channels staying in a connecting state longer than necessary. Once the buffer is ready and a viewer is watching, the channel is marked active immediately
• Fixed Xtream Codes live streams failing or using incorrect URLs when the account server URL was pasted from an API page (e.g. including /player_api.php or query parameters). Live playback now builds clean upstream URLs from your account settings (Fixes [#1363])
• Fixed live streaming paths that could hold database connections open during playback and failover, which under load could contribute to slow or failed requests on other pages

DVR & Recording Playback

• Fixed completed DVR recordings failing to play in the built-in video player. Playback now accepts authentication via a ?token= query parameter, which native <video> elements require because they cannot send login headers
• Fixed HLS recording playback rejecting ?token= authentication on the dedicated segment URL route. Token-based clients now work consistently across all recording playback paths
• Fixed in-progress DVR recordings jumping to the live edge shortly after playback starts. You can now watch, pause, and scrub from the beginning while the recording continues (Fixes [#1329])
• Fixed authentication tokens being dropped when recording playback redirects between file and HLS URLs

M3U Accounts & Auto-Sync

• Fixed M3U account refreshes leaving accounts stuck in a fetching or parsing state after failures, and improved recovery when background workers hit database connection errors (Fixes [#1338])
• Fixed legacy M3U account settings stored in an unexpected format causing refresh, profile sync, and auto-sync to fail
• Fixed the auto-sync Range conflict warning incorrectly flagging channels that belong to the override target group when a channel-group override is configured. Genuine conflicts (manual channels, other accounts, pinned numbers) still appear (Fixes [#1331]) - Thanks @CodeBormen
• Fixed failed M3U refresh tasks reporting as failed in the task queue even after the account status was already updated to show the error in the UI

EPG

• Fixed EPG source refreshes leaving sources stuck in a fetching or parsing state after failures, with improved recovery from transient database errors during large guide updates
• Fixed EPG import triggers loading unnecessary data from the source record, making manual and automated EPG imports lighter on memory

API Documentation

• Fixed OpenAPI schema paths for nested M3U profile and filter endpoints containing escaped slashes, which broke code generators for API clients (Fixes [#1384])

🔒 Security

• Updated the Docker base image to FFmpeg 8.1.2, addressing High severity PixelSmash (CVE-2026-8461). A heap out-of-bounds write in FFmpeg's MagicYUV decoder could allow denial of service or remote code execution when a specially crafted media file is processed. Dispatcharr uses FFmpeg for live transcoding, DVR, and related media workflows, so pull the latest image to receive this fix.
• Updated Django from 6.0.5 to 6.0.6 to address five security vulnerabilities related to signed cookies, SMTP email transmission, and cache header handling
• Updated frontend build dependencies to resolve four audit findings:
• Updated vite from 7.3.2 to 7.3.5, addressing moderate NTLMv2 hash disclosure via UNC path handling on Windows (GHSA-v6wh-96g9-6wx3) and high server.fs.deny bypass on Windows alternate paths (GHSA-fx2h-pf6j-xcff)
• Updated js-yaml from 4.1.1 to 5.1.0, addressing moderate denial-of-service risk in merge key handling (GHSA-h67p-54hq-rp68)
• Updated esbuild from 0.27.3 to 0.28.1, addressing low arbitrary file read when running the development server on Windows (GHSA-g7r4-m6w7-qqqr)