Repository navigation
Release v1.6.3: decouple DMs from channel announcements, fix season artwork - #135
Merged
Merged
Conversation
Resolves the import conflict in jellyfinWebhook.js: keeps both the isDiscordLinkableUrl import from dev and the notificationMetadata imports from this branch.
Channel-announcement and DM logic lived in one function with bare early returns, so disabling channel notifications for a content type silently also skipped the "request available" DM. Add independent JELLYFIN_NOTIFY_MOVIES/SERIES channel toggles (already existed as config keys but were only honored by the poller, never the webhook path) and restructure processAndSendNotification so the DM block always runs regardless of the channel-announce outcome.
- Help text pointed "above" at NOTIFY_ON_AVAILABLE, which is actually further down the page than the new movie/series toggles. - Trim multi-line rationale comments per project convention (the why belongs in the PR description, not the code).
The CI audit job gates the Docker build via `needs: audit`, so the failing `npm audit --audit-level=high` also blocked the dev image from being published. All 8 advisories (2 high, 6 moderate) were already fixed in versions the existing ranges in package.json allow, so the lockfile was simply stale. package.json is unchanged, including the undici override, which never was the blocker.
… and burst entries - Resolve parent series provider IDs inside processAndSendNotification so the poller and WebSocket paths get the fix too, not only the webhook. - Drop the legacy sentNotifications rekey: series:tmdb:<child ID> can collide with a real series and hand its entry to the wrong show. - Track permanent dedup per item (item:<identity>) and keep the series-level entry as a 1h burst window (burst:<seriesKey>). With the corrected series key, a single 5-year series entry would have blocked every later episode. - Season and episode test payloads carry the series ID as SeriesProvider_tmdb. - Fall back to the series IMDb ID for children when TMDB has none.
- Persist item dedup keys only after the batch was actually sent, and record items covered by an already-sent higher-level post. - Send season/episode payloads without SeriesId once and stop, instead of falling through into the debouncer when no response object is passed. - Validate SeriesId, prune expired entries from the series metadata cache, cache a missing TMDB ID only for 15 minutes, and say in every fallback warning what the user loses. - Log which key matched when a duplicate is suppressed via legacy history.
- Each debouncer closure keeps a reference to its own batch and takes the item keys present at send time, so a late trailing call can neither persist a newer batch's keys nor delete its entry. - Blocked items are only marked as sent when the post covered them: a series post covers everything, a season post only episodes of its seasons. - Only skip the Jellyfin lookup when the payload already has a series TMDB ID.
fix: use parent series metadata for season notifications
npm audit --audit-level=high started failing in CI after new advisories for axios (high) and proxy-addr (critical). Both fixes are within the existing version ranges, so only the lockfile changes.
retardgerman
changed the title
Node.js 18 (Docker image) and 20 (CI) are end of life and get no fix for the Brotli vulnerability CVE-2026-111497. Node.js 22 keeps the linux/arm/v7 image, which Node.js 24 no longer provides.
Node.js 22 crashes with "Illegal instruction" when npm ci runs under QEMU arm64 emulation on the CI runner. Dependencies are pure JavaScript, so they are now installed in a build stage on the native build platform and copied into each target image.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
v0.25.0with Subresource Integrity instead of loading@latestfrom the CDN.npm auditadvisories, including issues in undici, joi, axios and proxy-addr. No configuration change needed.