docs(ci): make release changelog lookup version-aware, add 3.3 changelog, fix docker-compose PGID/PUID

Derive the release changelog path from the release version instead of
hardcoding 3.2.md, so the workflow keeps working after 3.3 ships. Add
docs/changelog/3.3.md summarizing the 3.3.0 section of CHANGELOG.md.
Fix docker-compose.yml's PGID/PUID falling back to shell substitution
that never runs in a compose file, using numeric defaults instead, and
drop the obsolete top-level 'version' key. Fix README's Python badge to
3.13 to match backend/pyproject.toml's requires-python.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTnuEgR78cBk32bLNKar3z

.github/workflows/build.yml

@@ -350,9 +350,12 @@ jobs:
       - name: Read changelog
         id: changelog
         run: |
-          if [ -f docs/changelog/3.2.md ]; then
+          # Derive the changelog file from the release version's major.minor (e.g. 3.3.0-beta.1 -> 3.3.md)
+          CHANGELOG_VERSION=$(echo "${{ needs.version-info.outputs.version }}" | grep -oE '^[0-9]+\.[0-9]+')
+          CHANGELOG_FILE="docs/changelog/${CHANGELOG_VERSION}.md"
+          if [ -f "$CHANGELOG_FILE" ]; then
             echo "body<<EOF" >> $GITHUB_OUTPUT
-            cat docs/changelog/3.2.md >> $GITHUB_OUTPUT
+            cat "$CHANGELOG_FILE" >> $GITHUB_OUTPUT
             echo "EOF" >> $GITHUB_OUTPUT
           fi
 

README.md

@@ -6,7 +6,7 @@
     <img title="docker build version" src="https://img.shields.io/docker/v/estrellaxd/auto_bangumi" alt="">
     <img title="release date" src="https://img.shields.io/github/release-date/estrellaxd/auto_bangumi" alt="">
     <img title="docker pull" src="https://img.shields.io/docker/pulls/estrellaxd/auto_bangumi" alt="">
-    <img title="python version" src="https://img.shields.io/badge/python-3.11-blue" alt="">
+    <img title="python version" src="https://img.shields.io/badge/python-3.13-blue" alt="">
 </p>
 
 <p align="center">

docs/changelog/3.3.md

@@ -0,0 +1,65 @@
+# [3.3] - Unreleased
+
+## Backend — Architecture
+
+The backend went through an architecture refactor focused on modernization and robustness (REST API behavior is unchanged):
+
+### Changes
+
+- Database layer fully asynchronous: repositories and `Database` migrated to `sqlite+aiosqlite` (WAL + busy_timeout enabled), removing synchronous DB calls from the event loop
+- Composition over inheritance: `Database` no longer subclasses `Session`; `RSSEngine`/`TorrentManager`/`Renamer`/`SeasonCollector`/`SearchTorrent`/`RSSAnalyser` now take their dependencies via constructor injection
+- The `Program` god object was replaced by the lifespan composition root `AppContext` plus a generic `PeriodicTask`/`Scheduler`; startup is now awaited (a failed migration aborts startup explicitly), and downloader retries run as supervised background tasks
+- Migrations are now table-driven (`database/migrations.py`, declarative `already_applied` guards), replacing the hardcoded per-version if-chain; version numbers and SQL are unchanged, so existing databases upgrade as before
+- Downloaders implement a `Downloader` Protocol with capability flags; aria2's partial support is now declared honestly instead of crashing the loop with `NotImplementedError`
+- Config changes now go through `AppContext.reload_settings()` uniformly (this restores re-application of RSS rules)
+- Security: session storage gained expiry cleanup, token comparison switched to constant-time comparison
+
+### Features
+
+- qBittorrent client session reuse: the login session is reused across operations with automatic re-authentication on 401/403, cutting redundant logins significantly (#1039, #900)
+- Configurable TMDB / bgm.tv API base URLs, for users behind restrictive networks (#1040, #1042)
+
+### Bugfixes
+
+- Fixed an httpx connection pool leak on downloader authentication failure
+- Fixed OpenAI parsing blocking the event loop (switched to `AsyncOpenAI`)
+- Fixed `build_rss_rule`'s `mustNotContain` splitting the filter string by character instead of OR-ing each item as a regex term
+- Removed a large amount of dead code (the old notification stack, the SIGALRM decorator, empty transmission stubs, etc.)
+
+## Backend
+
+### Features
+
+- Added a `Security` config model, supporting login IP allowlists, MCP IP allowlists, and Bearer Token authentication
+- Added an IP allowlist check middleware for the login endpoint (`check_login_ip`)
+- The MCP security middleware is now configurable: supports CIDR allowlist + Bearer Token dual authentication
+- Auth endpoints support `Authorization: Bearer` tokens, bypassing cookie login
+- Added a manual air-weekday API for bangumi (`PATCH /api/v1/bangumi/{id}/weekday`), supporting a lock to prevent the calendar refresh from overwriting it
+- Database migration v9: added a `weekday_locked` column to the `bangumi` table
+
+### Bugfixes
+
+- Fixed a qBittorrent downloader SSL issue: decoupled HTTPS protocol selection from certificate verification, so self-signed certificates no longer break the connection (#923)
+- Fixed a logic error in `torrents_rename_file`'s rename-verification loop where `continue` should have been `break`
+- Fixed the config API's `_sanitize_dict` to redact only string values, avoiding mishandling of non-string fields
+
+### Changes
+
+- Refactored the auth module: extracted a shared `_issue_token` method, removing 3 duplicated JWT-issuing code paths
+- `get_current_user` simplified to three-tier authentication (DEV bypass → Bearer Token → Cookie JWT)
+- `LocalNetworkMiddleware` renamed to `McpAccessMiddleware`, now reads its allowlist from config instead of a hardcoded RFC 1918 range
+
+### Tests
+
+- Added 101 unit tests covering security, auth, config, downloader, and the MockDownloader module
+
+## Frontend
+
+### Features
+
+- Added calendar drag-and-drop scheduling: drag an "Unknown" series into a weekday column to set and lock its air day
+  - Shows a purple pin icon after dropping, with a cancel button on hover
+  - Locked series are not overwritten by calendar refreshes
+  - Uses vuedraggable for smooth drag animation
+- Added a security settings component (`config-security.vue`) for configuring IP allowlists and tokens in the WebUI
+- Added `Security` frontend type definitions and initial config

docs/resource/docker-compose/AutoBangumi/docker-compose.yml

@@ -1,5 +1,3 @@
-version: "3.4"
-
 services:
   AutoBangumi:
     image: "ghcr.io/estrellaxd/auto_bangumi:latest"
@@ -15,6 +13,6 @@ services:
       - 223.5.5.5
     environment:
       - TZ=Asia/Shanghai
-      - PGID=$(id -g)
-      - PUID=$(id -u)
+      - PGID=${PGID:-1000}
+      - PUID=${PUID:-1000}
       - UMASK=022