diff --git a/CHANGELOG.md b/CHANGELOG.md index 48048373..14ffb8ee 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,7 @@ # [Unreleased] +# [3.3.0-beta.1] - 2026-07-03 + ## Backend ### Added diff --git a/backend/pyproject.toml b/backend/pyproject.toml index e7d4321f..bd9f0609 100644 --- a/backend/pyproject.toml +++ b/backend/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "auto-bangumi" -version = "3.3.0" +version = "3.3.0-beta.1" description = "AutoBangumi - Automated anime download manager" requires-python = ">=3.13" dependencies = [ diff --git a/docs/changelog/3.3.md b/docs/changelog/3.3.md index c3879f35..90d935f9 100644 --- a/docs/changelog/3.3.md +++ b/docs/changelog/3.3.md @@ -1,65 +1,71 @@ -# [3.3] - Unreleased +# [3.3] — Beta + +3.3 is the largest AutoBangumi release in a while: a fully async backend architecture, aria2 promoted to a first-class download backend, movie/OVA/special support, per-bangumi release preferences, a hardened security stack, and a WebUI that updates over SSE instead of polling. REST API behavior is backward-compatible; existing databases upgrade automatically (migrations v9–v14). + +## Highlights + +- **aria2 is now a first-class backend** — real add/query/rename/manage support with honest duplicate detection (reconciled against aria2's live state), collision-safe filesystem renames, and offset resolution via a persisted gid↔bangumi mapping. Previously aria2 could only add torrents; organization silently did nothing. +- **Movies / OVA / Specials** — the parser recognizes 剧场版/劇場版/电影版/Movie and OVA/OAD/SP/Special tokens (`episode_type`); movies are organized as flat `Title (Year)` folders with TMDB `search/movie` fallback, specials go to Season 0. Multi-file movie torrents keep distinct filenames (largest file gets the clean name). +- **Per-bangumi release preference** — set a preferred subtitle group and/or resolution per series; when multiple groups release the same episode, only the best match is downloaded instead of all of them. +- **Notifications beyond "new episode"** — typed events for RSS feed failures (on state change, not every tick), download-add failures, and offset needs-review; `{{title}}`-style message templates now work for every provider, not just webhook. +- **Offset suggestions you can apply** — season/episode offset mismatches are detected from real parsed episodes and applied with one call (`POST /api/v1/bangumi/apply-offset/{id}`, single or bulk). +- **SSE-driven WebUI** — status, downloader, and log views subscribe to `/api/v1/events/stream` instead of three polling loops; a dead downloader can no longer freeze the stream (bounded fetch with explicit degraded payload). ## Backend — Architecture -The backend went through an architecture refactor focused on modernization and robustness (REST API behavior is unchanged): +The backend went through a modernization refactor (REST API behavior unchanged): -### Changes +- Database layer fully asynchronous: repositories and `Database` on `sqlite+aiosqlite` (WAL + busy_timeout); no synchronous DB calls on the event loop +- The `Program` god object replaced by a lifespan `AppContext` composition root with a generic `PeriodicTask`/`Scheduler`; startup is awaited and a failed migration aborts boot explicitly +- Composition over inheritance throughout (`RSSEngine`/`TorrentManager`/`Renamer`/… take constructor-injected dependencies) +- Table-driven migrations (`database/migrations.py`) with `already_applied` guards; old databases upgrade identically +- `Downloader` Protocol with capability flags; qBittorrent login session reused across operations with automatic re-auth on 401/403 (#1039, #900) +- Config changes uniformly through `AppContext.reload_settings()` — HTTP client, notifier, scheduler, and parser caches all reset consistently -- Database layer fully asynchronous: repositories and `Database` migrated to `sqlite+aiosqlite` (WAL + busy_timeout enabled), removing synchronous DB calls from the event loop -- Composition over inheritance: `Database` no longer subclasses `Session`; `RSSEngine`/`TorrentManager`/`Renamer`/`SeasonCollector`/`SearchTorrent`/`RSSAnalyser` now take their dependencies via constructor injection -- The `Program` god object was replaced by the lifespan composition root `AppContext` plus a generic `PeriodicTask`/`Scheduler`; startup is now awaited (a failed migration aborts startup explicitly), and downloader retries run as supervised background tasks -- Migrations are now table-driven (`database/migrations.py`, declarative `already_applied` guards), replacing the hardcoded per-version if-chain; version numbers and SQL are unchanged, so existing databases upgrade as before -- Downloaders implement a `Downloader` Protocol with capability flags; aria2's partial support is now declared honestly instead of crashing the loop with `NotImplementedError` -- Config changes now go through `AppContext.reload_settings()` uniformly (this restores re-application of RSS rules) -- Security: session storage gained expiry cleanup, token comparison switched to constant-time comparison +## Backend — Features -### Features +- Security config model: login IP allowlist, MCP CIDR allowlist + Bearer Token dual authentication, `Authorization: Bearer` support on auth endpoints +- Manual air-weekday API with calendar-refresh lock (`PATCH /api/v1/bangumi/{id}/weekday`, migration v9) +- Configurable TMDB / bgm.tv API base URLs for users behind restrictive networks (#1040, #1042) +- Per-provider parser choice for custom search providers; the OpenAI parser now rescues titles the regex parser fails on instead of replacing it entirely +- Unauthenticated `GET /health` liveness endpoint (`{status, version, db_ok}`) and a Docker `HEALTHCHECK` +- Auth stack migrated from unmaintained `python-jose`/`passlib` (CVE-2024-33663, CVE-2024-33664) to PyJWT + bcrypt — existing passwords, including >72-byte ones, keep working -- qBittorrent client session reuse: the login session is reused across operations with automatic re-authentication on 401/403, cutting redundant logins significantly (#1039, #900) -- Configurable TMDB / bgm.tv API base URLs, for users behind restrictive networks (#1040, #1042) +## Backend — Fixes -### Bugfixes +- Failed torrent adds now actually retry on the next RSS tick; "already added" duplicates no longer emit failure notifications +- Filter-rejected torrents no longer pollute offset detection +- Season offset can no longer accidentally move regular episodes into Season 0 (Plex/Jellyfin Specials); only true specials land there +- aria2: stale duplicate-tracking rows are reconciled when downloads are removed outside AutoBangumi; metadata-fetching magnets no longer crash the downloader list; renames refuse to overwrite existing files +- qBittorrent SSL: self-signed certificates no longer break the connection (#923) +- Destructive API endpoints converted from GET to POST (CSRF hardening) +- OpenAI parsing no longer blocks the event loop (`AsyncOpenAI`) -- Fixed an httpx connection pool leak on downloader authentication failure -- Fixed OpenAI parsing blocking the event loop (switched to `AsyncOpenAI`) -- Fixed `build_rss_rule`'s `mustNotContain` splitting the filter string by character instead of OR-ing each item as a regex term -- Removed a large amount of dead code (the old notification stack, the SIGALRM decorator, empty transmission stubs, etc.) +## Backend — Performance -## Backend +- Missing database indexes backfilled for **upgrading** installs (previously only fresh databases got them); offset-scanner and preference-dedup queries now index-backed (migrations v13/v14) +- Title parser ~16% faster (all static regex precompiled) +- Renamer fallback lookup batched: 201 → 2 queries at 200 torrents (~11×) +- Notification dispatch parallelized across items (with the underlying HTTP-context race fixed first) -### Features +## WebUI -- Added a `Security` config model, supporting login IP allowlists, MCP IP allowlists, and Bearer Token authentication -- Added an IP allowlist check middleware for the login endpoint (`check_login_ip`) -- The MCP security middleware is now configurable: supports CIDR allowlist + Bearer Token dual authentication -- Auth endpoints support `Authorization: Bearer` tokens, bypassing cookie login -- Added a manual air-weekday API for bangumi (`PATCH /api/v1/bangumi/{id}/weekday`), supporting a lock to prevent the calendar refresh from overwriting it -- Database migration v9: added a `weekday_locked` column to the `bangumi` table +- Calendar drag-and-drop scheduling: drag an "Unknown" series onto a weekday to set and lock its air day +- Component system unified on naive-ui (fixes a theme crash that could blank the Config page; naive-ui 2.44 for Vue 3.5 compatibility) +- RSS page: per-feed and refresh-all buttons; decluttered table (source metadata beside the name, status column shows only state) +- Calendar cards show the series title when no poster is available; bangumi titles wrap to two lines with full-title tooltips +- Security settings UI (IP allowlists, tokens); mobile nav labels no longer truncate; WCAG AA contrast pass; log page copy fixes +- Oversized editor components split into a shared `useBangumiRuleForm` composable -### Bugfixes +## Tooling & CI -- Fixed a qBittorrent downloader SSL issue: decoupled HTTPS protocol selection from certificate verification, so self-signed certificates no longer break the connection (#923) -- Fixed a logic error in `torrents_rename_file`'s rename-verification loop where `continue` should have been `break` -- Fixed the config API's `_sanitize_dict` to redact only string values, avoiding mishandling of non-string fields +- mypy type checking in CI at zero errors; ruff + frontend lint/vitest gates on dev-branch PRs +- E2E suite (real qBittorrent + mock RSS via Docker) green: 67/67 +- `scripts/dev.sh` — one-command seeded development environment +- Backend test suite: 990 tests (was 726 at 3.2) -### Changes +## Upgrade notes -- Refactored the auth module: extracted a shared `_issue_token` method, removing 3 duplicated JWT-issuing code paths -- `get_current_user` simplified to three-tier authentication (DEV bypass → Bearer Token → Cookie JWT) -- `LocalNetworkMiddleware` renamed to `McpAccessMiddleware`, now reads its allowlist from config instead of a hardcoded RFC 1918 range - -### Tests - -- Added 101 unit tests covering security, auth, config, downloader, and the MockDownloader module - -## Frontend - -### Features - -- Added calendar drag-and-drop scheduling: drag an "Unknown" series into a weekday column to set and lock its air day - - Shows a purple pin icon after dropping, with a cancel button on hover - - Locked series are not overwritten by calendar refreshes - - Uses vuedraggable for smooth drag animation -- Added a security settings component (`config-security.vue`) for configuring IP allowlists and tokens in the WebUI -- Added `Security` frontend type definitions and initial config +- Migrations v9–v14 run automatically on first start; a failed migration now aborts startup instead of continuing silently +- `group_tag` keeps its historical meaning (qB rule naming only) — renamed filenames are unchanged, so existing seeding libraries are not touched +- Beta feedback welcome, especially on aria2 setups, movie/special organization, and the new preference dedup