Dispatcharr Files

✨ New Features

VOD Mature Content Filtering

• VOD movies now store and honor an adult / mature flag from Xtream Codes providers, the same way live streams do
• Non-admin users with Hide Mature Content enabled no longer see adult movies in the movies API or XC VOD listings
• Existing libraries are backfilled from previously synced provider data where available

Redirect as Default for VOD and Catch-up

• When Redirect is the global default stream profile, VOD and catch-up playback can hand clients straight to the provider URL instead of proxying through Dispatcharr
• First requests without an existing session redirect to a capacity-aware provider URL; clients that already have a session keep proxying as before
• Stream settings note that Redirect as the default also applies to VOD and catch-up

M3U & EPG Source Type Filters

• The M3U and EPG source tables on M3U & EPG Manager now include a type filter (M3U/XC for playlists; XMLTV/Schedules Direct/Dummy for EPG), matching the checklist-style filter used on the Channels page
• Selections persist per table across reloads, and a Reset option appears once anything is unchecked

VOD Artwork Proxy for Backdrops and Episode Stills

• Movie backdrops, series artwork, and episode stills are served through Dispatcharr's image proxy (with nginx caching), so clients get consistent, proxied artwork URLs instead of raw provider links. (Closes [#863], Fixes [#1174])
• The VOD UI prefers cached poster URLs when available

Stream Profile {channelId} Token

• Stream Profile parameters now support a {channelId} substitution token alongside {streamUrl} and {userAgent}, so a single profile can embed the channel's ID in ffmpeg (or other) arguments. (Closes [#1252])

🔄 Changes & Improvements

Settings & Navigation

• Settings opens as a slide-over panel from the sidebar instead of a separate accordion page. Back returns to the main nav while keeping your last settings section active
• Main sidebar groups render as flat, labeled sections, and the sidebar's collapsed/expanded state is remembered across reloads
• Connections and Logs are merged into a single Connect page under System; the log viewer sits in a collapsible section at the bottom of that page

Tables & Forms

• Stream Profiles, Output Profiles, and User-Agents tables on Settings grow to fit their content instead of clipping to a fixed height
• The user form Allowed IPs description clarifies that the field only further restricts access within global Network Access; it cannot widen the global allowlist
• Usernames and XC passwords accept a small set of path-safe special characters (., _, @, -) in addition to letters and numbers. - Thanks @write-erase

Performance

• The default User-Agent string is cached for hot paths (logo proxies, provider requests), reducing repeated settings lookups during streaming and refresh

🐛 Bug Fixes

DVR & Comskip

• Fixed Comskip hardware acceleration passing an unsupported Intel flag. The former Quick Sync option is now Hardware assist (hwassist); previously saved qsv values are treated as hwassist. NVIDIA still uses CUDA/cuvid. (Fixes [#1503])
• Fixed scheduled recordings silently failing to start when a brief database error hit at fire time. The start guard now retries briefly before giving up. (Fixes [#1464]) - Thanks @nagelm

Live Streaming

• Fixed a stable stream that went dead mid-playback hanging forever instead of reconnecting. Health-driven reconnects now reopen the same URL and still count toward the normal retry/failover budget. (Fixes [#1493])

VOD & Series

• Fixed VOD list sync wiping movie/series detail (plots and related metadata) after an M3U/XC refresh, so opening a title soon after sync no longer skipped re-fetching missing detail
• Fixed artwork for shared movies/series/episodes preferring the wrong provider or mixing proxied and raw URLs. Resolution now prefers the active provider relation, then shared metadata, then the synced VOD logo
• Fixed the Series modal flashing the previous provider's episodes and loading slowly on large shows when switching providers
• Fixed Season 0 (specials) being merged into Season 1 in XC series info and in the Series modal; specials now keep their own season/tab
• Fixed VOD series refresh crashing when a provider returns episodes as a JSON array instead of an object. (Fixes [#934])
• Fixed the VOD logo/poster proxy using a generic User-Agent that some image hosts reject. It now uses your configured default User-Agent. - Thanks @gianlucalauro

M3U Accounts & Profiles

• Fixed M3U refresh status updates overwriting the default profile and clobbering XC expiration dates. (Fixes [#1430])
• Fixed manual expiration on a Standard M3U account reverting to a leftover XC date after converting the account type
• Fixed the account form and default-profile editor fighting over expiration while both are open; the unsaved date stays in sync either way
• Fixed the Auto Channel Sync Configure modal crashing on groups whose channel profile IDs were stored as numbers
• Fixed M3U profile regex preview (and live URL rewrites) stalling the server on catastrophic patterns. Preview inputs are length-capped and substitutions time out like Auto Channel Sync rename

EPG & Guides

• Fixed hand-assigned / override EPG on channels (common with auto-sync) being ignored for programme import and Schedules Direct mapped fetches, and XMLTV lagging after mapping changes. (Fixes [#1485])
• Fixed bare XMLTV <episode-num> values without a system attribute being dropped on import. (Fixes [#1491])
• Fixed Schedules Direct Extra Debugging staying on after SD returned code 2055 when a cached token skipped a new login. The toggle now clears and the request is retried without the debug header

Logos & Output

• Fixed Logo Manager resetting a custom name whenever the Logo URL field was focused or blurred. The name is only suggested from the URL when the name field is empty. (Fixes [#845])
• Fixed direct-link M3U output stripping the VLC-style @ from multicast UDP URLs, which broke joining those streams in players like VLC. (Fixes [#1406]) - Thanks @haroldm

UI & Environment

• Fixed M3U and EPG source tables using a fixed height with a nested scrollbar. They now size to their content (with an empty state) and only scroll once they reach the viewport height. - Thanks @nagelm
• Fixed the public IP in the sidebar staying stale for up to an hour after the server's IP changed (for example after a VPN reconnect). The cached value still shows immediately, then re-verifies in the background. (Fixes [#1395]) - Thanks @floppy-disk

🔒 Security

• Django admin deep paths (such as /admin/login/) are blocked by nginx when admin is disabled, without breaking XC streams whose username is admin
• Django admin login shares the same per-IP rate limit as JWT/API login (3/minute), keyed from the trusted client IP
• M3U and EPG caches include the request origin in their keys so absolute logo/stream/guide URLs from one Host cannot leak into another client's playlist or guide. (Fixes [#1390])
• Channel profile membership updates can no longer change another user's profile by ID; non-admins only see and edit profiles assigned to them
• Channel and VOD image proxy hardens remote artwork fetches against SSRF and same-origin active content (validated outbound targets, capped redirects, content-type from file bytes, SVG sandboxing). Dead artwork responses are briefly cached so workers do not stampede upstream
• Live connection telemetry (channel/VOD/catch-up stats and related WebSocket pushes) and the system-events API are admin-only; standard users still receive EPG and general notifications
• Client IP detection trusts forwarded headers only from private-network proxies by default (Docker/Traefik-style setups), so spoofed headers from public peers are ignored. Optionally set DISPATCHARR_TRUSTED_PROXIES to a specific proxy CIDR, or none to disable header trust. (Closes [#1410])
• First-time web setup (initialize-superuser) only accepts local/private networks by default unless DISPATCHARR_SETUP_ALLOWED_IP is set for remote/VPS install
• Updated Django 6.0.6 → 6.0.7 for security fixes (cached Set-Cookie exposure, GDALRaster over-read, and header injection via domain validation)
• Updated frontend npm dependencies for known vulnerabilities:
• brace-expansion 5.0.6 → 5.0.9 (High: DoS via exponential/unbounded brace expansion, including a bypass of the prior mitigation) (GHSA-3jxr-9vmj-r5cp, GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895)
• js-yaml 5.1.0 → 5.2.2 (Moderate/High: quadratic/exponential YAML parse DoS) (GHSA-g796-fgmg-93mv, GHSA-724g-mxrg-4qvm, GHSA-pm4m-ph32-ghv5)
• nanoid 3.3.16 → 3.3.18 (High: infinite loop when a custom generator is called with size zero) (GHSA-2v37-7h3g-55p8)
• postcss 8.5.13 → 8.5.23 (High: path traversal in source map auto-loading) (GHSA-r28c-9q8g-f849)
• react-router / react-router-dom 7.17.0 → 7.18.2 (Moderate/High: open redirect, XSS, constructor injection, route-matching DoS, RSC CSRF bypass) (GHSA-wrjc-x8rr-h8h6, GHSA-h8fp-f39c-q6mh, GHSA-337j-9hxr-rhxg, GHSA-chx6-hx7r-mcp5, GHSA-qwww-vcr4-c8h2)

Reverse proxy users: Review your proxy config after upgrading.

• Allow (or pass through) the new VOD artwork paths used for backdrops and episode stills: /api/vod/movies/{id}/image/, /api/vod/series/{id}/image/, and /api/vod/episodes/{id}/image/. If your proxy only whitelists specific /api/... locations, add these or artwork may fail to load.
• Client IP, network access, login rate limits, and related checks now honor X-Real-IP / X-Forwarded-For only from trusted proxies. Private/loopback peers are trusted by default (typical Docker/Traefik setups). If your outer proxy connects from a public IP, or you want to narrow trust, set DISPATCHARR_TRUSTED_PROXIES to that proxy's IP or CIDR (for example 172.18.0.0/16). Use none to ignore forwarded headers entirely. If this is wrong, public clients can show up as a local/private IP (often the proxy itself), which can bypass Network Access rules, skew login rate limits, and mislabel connections in Stats and logs. Confirm real client IPs after upgrading.