chore: bump version to 3.3.0-beta.1, full release notes for the 3.3 beta

docs/changelog/3.3.md rewritten to cover the complete 3.3 scope (it is
the release body the tag build publishes): architecture, aria2
first-class, movies/specials, preference dedup, notifications, security
stack, PyJWT migration, performance pass, WebUI/SSE work, upgrade notes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GTnuEgR78cBk32bLNKar3z

CHANGELOG.md

@@ -1,5 +1,7 @@
 # [Unreleased]
 
+# [3.3.0-beta.1] - 2026-07-03
+
 ## Backend
 
 ### Added

backend/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "auto-bangumi"
-version = "3.3.0"
+version = "3.3.0-beta.1"
 description = "AutoBangumi - Automated anime download manager"
 requires-python = ">=3.13"
 dependencies = [

docs/changelog/3.3.md

@@ -1,65 +1,71 @@
-# [3.3] - Unreleased
+# [3.3] — Beta
+
+3.3 is the largest AutoBangumi release in a while: a fully async backend architecture, aria2 promoted to a first-class download backend, movie/OVA/special support, per-bangumi release preferences, a hardened security stack, and a WebUI that updates over SSE instead of polling. REST API behavior is backward-compatible; existing databases upgrade automatically (migrations v9–v14).
+
+## Highlights
+
+- **aria2 is now a first-class backend** — real add/query/rename/manage support with honest duplicate detection (reconciled against aria2's live state), collision-safe filesystem renames, and offset resolution via a persisted gid↔bangumi mapping. Previously aria2 could only add torrents; organization silently did nothing.
+- **Movies / OVA / Specials** — the parser recognizes 剧场版/劇場版/电影版/Movie and OVA/OAD/SP/Special tokens (`episode_type`); movies are organized as flat `Title (Year)` folders with TMDB `search/movie` fallback, specials go to Season 0. Multi-file movie torrents keep distinct filenames (largest file gets the clean name).
+- **Per-bangumi release preference** — set a preferred subtitle group and/or resolution per series; when multiple groups release the same episode, only the best match is downloaded instead of all of them.
+- **Notifications beyond "new episode"** — typed events for RSS feed failures (on state change, not every tick), download-add failures, and offset needs-review; `{{title}}`-style message templates now work for every provider, not just webhook.
+- **Offset suggestions you can apply** — season/episode offset mismatches are detected from real parsed episodes and applied with one call (`POST /api/v1/bangumi/apply-offset/{id}`, single or bulk).
+- **SSE-driven WebUI** — status, downloader, and log views subscribe to `/api/v1/events/stream` instead of three polling loops; a dead downloader can no longer freeze the stream (bounded fetch with explicit degraded payload).
 
 ## Backend — Architecture
 
-The backend went through an architecture refactor focused on modernization and robustness (REST API behavior is unchanged):
+The backend went through a modernization refactor (REST API behavior unchanged):
 
-### Changes
+- Database layer fully asynchronous: repositories and `Database` on `sqlite+aiosqlite` (WAL + busy_timeout); no synchronous DB calls on the event loop
+- The `Program` god object replaced by a lifespan `AppContext` composition root with a generic `PeriodicTask`/`Scheduler`; startup is awaited and a failed migration aborts boot explicitly
+- Composition over inheritance throughout (`RSSEngine`/`TorrentManager`/`Renamer`/… take constructor-injected dependencies)
+- Table-driven migrations (`database/migrations.py`) with `already_applied` guards; old databases upgrade identically
+- `Downloader` Protocol with capability flags; qBittorrent login session reused across operations with automatic re-auth on 401/403 (#1039, #900)
+- Config changes uniformly through `AppContext.reload_settings()` — HTTP client, notifier, scheduler, and parser caches all reset consistently
 
-- Database layer fully asynchronous: repositories and `Database` migrated to `sqlite+aiosqlite` (WAL + busy_timeout enabled), removing synchronous DB calls from the event loop
-- Composition over inheritance: `Database` no longer subclasses `Session`; `RSSEngine`/`TorrentManager`/`Renamer`/`SeasonCollector`/`SearchTorrent`/`RSSAnalyser` now take their dependencies via constructor injection
-- The `Program` god object was replaced by the lifespan composition root `AppContext` plus a generic `PeriodicTask`/`Scheduler`; startup is now awaited (a failed migration aborts startup explicitly), and downloader retries run as supervised background tasks
-- Migrations are now table-driven (`database/migrations.py`, declarative `already_applied` guards), replacing the hardcoded per-version if-chain; version numbers and SQL are unchanged, so existing databases upgrade as before
-- Downloaders implement a `Downloader` Protocol with capability flags; aria2's partial support is now declared honestly instead of crashing the loop with `NotImplementedError`
-- Config changes now go through `AppContext.reload_settings()` uniformly (this restores re-application of RSS rules)
-- Security: session storage gained expiry cleanup, token comparison switched to constant-time comparison
+## Backend — Features
 
-### Features
+- Security config model: login IP allowlist, MCP CIDR allowlist + Bearer Token dual authentication, `Authorization: Bearer` support on auth endpoints
+- Manual air-weekday API with calendar-refresh lock (`PATCH /api/v1/bangumi/{id}/weekday`, migration v9)
+- Configurable TMDB / bgm.tv API base URLs for users behind restrictive networks (#1040, #1042)
+- Per-provider parser choice for custom search providers; the OpenAI parser now rescues titles the regex parser fails on instead of replacing it entirely
+- Unauthenticated `GET /health` liveness endpoint (`{status, version, db_ok}`) and a Docker `HEALTHCHECK`
+- Auth stack migrated from unmaintained `python-jose`/`passlib` (CVE-2024-33663, CVE-2024-33664) to PyJWT + bcrypt — existing passwords, including >72-byte ones, keep working
 
-- qBittorrent client session reuse: the login session is reused across operations with automatic re-authentication on 401/403, cutting redundant logins significantly (#1039, #900)
-- Configurable TMDB / bgm.tv API base URLs, for users behind restrictive networks (#1040, #1042)
+## Backend — Fixes
 
-### Bugfixes
+- Failed torrent adds now actually retry on the next RSS tick; "already added" duplicates no longer emit failure notifications
+- Filter-rejected torrents no longer pollute offset detection
+- Season offset can no longer accidentally move regular episodes into Season 0 (Plex/Jellyfin Specials); only true specials land there
+- aria2: stale duplicate-tracking rows are reconciled when downloads are removed outside AutoBangumi; metadata-fetching magnets no longer crash the downloader list; renames refuse to overwrite existing files
+- qBittorrent SSL: self-signed certificates no longer break the connection (#923)
+- Destructive API endpoints converted from GET to POST (CSRF hardening)
+- OpenAI parsing no longer blocks the event loop (`AsyncOpenAI`)
 
-- Fixed an httpx connection pool leak on downloader authentication failure
-- Fixed OpenAI parsing blocking the event loop (switched to `AsyncOpenAI`)
-- Fixed `build_rss_rule`'s `mustNotContain` splitting the filter string by character instead of OR-ing each item as a regex term
-- Removed a large amount of dead code (the old notification stack, the SIGALRM decorator, empty transmission stubs, etc.)
+## Backend — Performance
 
-## Backend
+- Missing database indexes backfilled for **upgrading** installs (previously only fresh databases got them); offset-scanner and preference-dedup queries now index-backed (migrations v13/v14)
+- Title parser ~16% faster (all static regex precompiled)
+- Renamer fallback lookup batched: 201 → 2 queries at 200 torrents (~11×)
+- Notification dispatch parallelized across items (with the underlying HTTP-context race fixed first)
 
-### Features
+## WebUI
 
-- Added a `Security` config model, supporting login IP allowlists, MCP IP allowlists, and Bearer Token authentication
-- Added an IP allowlist check middleware for the login endpoint (`check_login_ip`)
-- The MCP security middleware is now configurable: supports CIDR allowlist + Bearer Token dual authentication
-- Auth endpoints support `Authorization: Bearer` tokens, bypassing cookie login
-- Added a manual air-weekday API for bangumi (`PATCH /api/v1/bangumi/{id}/weekday`), supporting a lock to prevent the calendar refresh from overwriting it
-- Database migration v9: added a `weekday_locked` column to the `bangumi` table
+- Calendar drag-and-drop scheduling: drag an "Unknown" series onto a weekday to set and lock its air day
+- Component system unified on naive-ui (fixes a theme crash that could blank the Config page; naive-ui 2.44 for Vue 3.5 compatibility)
+- RSS page: per-feed and refresh-all buttons; decluttered table (source metadata beside the name, status column shows only state)
+- Calendar cards show the series title when no poster is available; bangumi titles wrap to two lines with full-title tooltips
+- Security settings UI (IP allowlists, tokens); mobile nav labels no longer truncate; WCAG AA contrast pass; log page copy fixes
+- Oversized editor components split into a shared `useBangumiRuleForm` composable
 
-### Bugfixes
+## Tooling & CI
 
-- Fixed a qBittorrent downloader SSL issue: decoupled HTTPS protocol selection from certificate verification, so self-signed certificates no longer break the connection (#923)
-- Fixed a logic error in `torrents_rename_file`'s rename-verification loop where `continue` should have been `break`
-- Fixed the config API's `_sanitize_dict` to redact only string values, avoiding mishandling of non-string fields
+- mypy type checking in CI at zero errors; ruff + frontend lint/vitest gates on dev-branch PRs
+- E2E suite (real qBittorrent + mock RSS via Docker) green: 67/67
+- `scripts/dev.sh` — one-command seeded development environment
+- Backend test suite: 990 tests (was 726 at 3.2)
 
-### Changes
+## Upgrade notes
 
-- Refactored the auth module: extracted a shared `_issue_token` method, removing 3 duplicated JWT-issuing code paths
-- `get_current_user` simplified to three-tier authentication (DEV bypass → Bearer Token → Cookie JWT)
-- `LocalNetworkMiddleware` renamed to `McpAccessMiddleware`, now reads its allowlist from config instead of a hardcoded RFC 1918 range
-
-### Tests
-
-- Added 101 unit tests covering security, auth, config, downloader, and the MockDownloader module
-
-## Frontend
-
-### Features
-
-- Added calendar drag-and-drop scheduling: drag an "Unknown" series into a weekday column to set and lock its air day
-  - Shows a purple pin icon after dropping, with a cancel button on hover
-  - Locked series are not overwritten by calendar refreshes
-  - Uses vuedraggable for smooth drag animation
-- Added a security settings component (`config-security.vue`) for configuring IP allowlists and tokens in the WebUI
-- Added `Security` frontend type definitions and initial config
+- Migrations v9–v14 run automatically on first start; a failed migration now aborts startup instead of continuing silently
+- `group_tag` keeps its historical meaning (qB rule naming only) — renamed filenames are unchanged, so existing seeding libraries are not touched
+- Beta feedback welcome, especially on aria2 setups, movie/special organization, and the new preference dedup