Skip to content

Release v2.4.3 - #14

Merged
Gasi-Code merged 11 commits into
mainfrom
newdev
Sep 17, 2026
Merged

Release v2.4.3#14
Gasi-Code merged 11 commits into
mainfrom
newdev

Conversation

@Gasi-Code

@Gasi-Code Gasi-Code commented Sep 17, 2026

Copy link
Copy Markdown
Contributor

v2.4.3

🔌 Automated Discord bot invite

  • Dashboard Step 1 now builds the OAuth2 invite URL itself from the entered Client ID (Send Messages | Embed Links | Pin Messages) — no more manual OAuth2 URL Generator step.
  • A second button deep-links straight to the app's Bot tab for the still-manual "enable Server Members Intent" step (Discord's API has no way to automate this).
  • Missing-intent startup failures now surface a dedicated, translated error with a working deep-link to the exact settings page, instead of a generic failure or silent hang.
  • Setup instructions trimmed from 7 steps to 5 to match.

🐛 Fixes

  • BOT_LANGUAGE is now seeded from the language chosen on the register screen on first run, instead of always defaulting regardless of the selected UI language.

🧹 Cleanup

  • Removed dead config and code accumulated across past releases: PRIVATE_MESSAGE_MODE, WEBHOOK_DEBOUNCE_MS, the unused EMBED_SHOW_*/EMBED_COLOR_* schema entries (including a 93-line dead UI block wired to non-existent DOM elements), the unused lodash.debounce dependency, and 161 unreferenced locale keys.
  • A one-time startup migration now strips these orphaned keys from existing config/config.json files, extended to also cover the embed show/colour keys.
  • Removed the broken npm run create-translation script reference (the script never existed in the repo).

🔒 Security

  • Resolved 10 dependency vulnerabilities (axios, body-parser, follow-redirects, form-data, joi, discord.js/undici, ws) via npm audit fix plus an overrides pin for qs. 0 known vulnerabilities.
  • Corrected package.json's license field from ISC to the actual AGPL-3.0-only.

📚 Docs

  • README hero row now shows the bot in action (/search result + a "now available" notification) instead of only dashboard screenshots.
  • Docker Tags table and Security section no longer reference a stale version number.

All 360 tests green.

🤖 Generated with Claude Code

https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U

Gasi-Code and others added 11 commits September 16, 2026 08:04
@Gasi-Code @claude
fix: resolve 10 dependency vulnerabilities, correct README/package.json
6995b9e 
- npm audit fix (axios, body-parser, follow-redirects, form-data, joi,
  discord.js/undici, ws) + an npm "overrides" pin for qs (express's own
  qs@6.14.2 was still in the vulnerable range) — 0 known vulnerabilities.
- package.json "license" field was "ISC", despite the project actually
  being AGPL-3.0 (LICENSE file, README, GitHub) — corrected to
  "AGPL-3.0-only".
- README.md/README.de.md: Docker Tags table and Security section
  referenced the stale "v2.3.0" instead of the current version; reworded
  to stay accurate across future releases without needing another edit.

All 352 tests still pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code @claude
docs(readme): add hero screenshots showing the bot in action in Discord
c456849 
Both READMEs previously went straight from the badges into a 47-row
feature table with no visual proof of what the product actually feels
like to use — the only screenshots further down were of the dashboard
config wizard, not the bot itself. Added a two-image row right after
the top badges: a /search result and a "now available" notification,
captured live via browser automation against a real Questorr test bot.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code @claude
docs(readme): replace static hero with live GIFs of Discord + setup w…
55c4108 
…izard

Static screenshots only showed the dashboard config UI, not what using
the bot actually feels like. Recorded live via browser automation
against the real Testserver bot and a real dashboard instance:

- search-request-flow.gif: /search -> pick a result -> Request -> success
- help-wizard.gif: /help quick-action buttons (Random Movie)
- queue-status.gif: /queue showing a tracked request's live status
- setup-wizard.gif: the 8-step dashboard wizard, including 'Test
  Connection' / 'Load Profiles & Servers' / 'Load Libraries' actually
  succeeding against the live Seerr/Jellyfin instance

The setup GIF is from a real production dashboard, not a demo -- every
URL/API-key/server-ID field and the User Mapping + Top Users rows are
redacted with a DOM overlay (drawn over the element, real form values
never touched) before each frame, so no LAN IPs or real Discord
usernames are exposed. Superseded the static search-example.png.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code
Revert "docs(readme): replace static hero with live GIFs of Discord +…
a0dd6b7 
… setup wizard"

This reverts commit 55c4108.
@Gasi-Code @claude
chore: repo-wide cleanup of dead code, orphaned config, and stale docs
c96bd42 
Full audit + cleanup of everything flagged as old/unused in the project:

1. Removed PRIVATE_MESSAGE_MODE (dead since ephemeral replies became
   unconditional; docs already called it deprecated/no-op).
2. Removed unused lodash.debounce dependency.
3. CLAUDE.md: removed the api/streamystats.js entry (file was deleted
   long ago) and updated the command/poller lists to match what
   actually exists (queue, subscribe, report + 4 missing pollers).
4. Fixed a stale Dockerfile comment ("required for joi@18+" — installed
   joi is 17.x).
5. Removed the broken `npm run create-translation` script/docs
   references (scripts/create-translation.js never existed in the repo).
6. Added a one-time startup migration (stripOrphanedConfigKeys, with
   tests) that removes legacy keys — STREAMYSTATS_URL/_USER/_PASS,
   PRIVATE_MESSAGE_MODE, WEBHOOK_DEBOUNCE_MS — from existing
   config.json files. updateConfig() only ever merges, so a key
   written while a feature existed never gets cleaned up on its own
   once the feature (and its configTemplate entry) is removed; this
   sweep runs once per install going forward.
7. Removed EMBED_SHOW_BACKDROP/_OVERVIEW/_GENRE/_RUNTIME/_RATING —
   schema + Joi validation only, no dashboard field, never read in
   bot/embeds.js.
8. Removed EMBED_COLOR_MOVIE/_SERIES/_SEASON/_EPISODE_{SINGLE,FEW,MANY}
   — same dead-schema pattern; only EMBED_COLOR_SUCCESS/_SEARCH are
   actually implemented. Corrected the README's "customize per event
   type" claim to describe what's really there.
9. Removed WEBHOOK_DEBOUNCE_MS entirely, including a 93-line dead UI
   block in web/script.js that wired up seconds/ms stepper controls
   for DOM elements (WEBHOOK_DEBOUNCE_SECONDS, debounce-up/down) that
   don't exist anywhere in index.html — the whole block was runtime
   dead code guarded by an always-false `if`.
10. Removed 161 locale keys (template.json/en.json/de.json) with zero
    real references. Verified in two passes: literal t()/tNotif()/wt()/
    data-i18n usage, then a second pass adding getNestedTranslation()
    and the data-i18n-open/-closed attributes I'd missed initially
    (which had produced 3 false positives — config.show_more/_less and
    seerr_webhook_disabled are genuinely used). Cross-checked every
    remaining candidate against known dynamic-key-construction call
    sites (preflight detailKey/label, audit_col, time_ago, webhook
    badge — 31 more false positives) before deleting. Empty parent
    objects pruned; key parity across all three files re-verified
    (0 missing).

All 355 tests pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code @claude
fix: extend orphaned-key migration to cover the embed show/colour keys
e1b6c9a 
stripOrphanedConfigKeys() only listed the keys removed in the original
cleanup pass (Streamystats, PRIVATE_MESSAGE_MODE, WEBHOOK_DEBOUNCE_MS).
The EMBED_SHOW_*/EMBED_COLOR_* keys removed from the schema in the same
cleanup round were never added, so a config.json that had ever set one
of them would keep carrying it forever — exactly the bug this migration
exists to fix.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code @claude
feat: automate Discord bot invite + surface missing-intent errors cle…
971dc9d 
…arly

Discord gives no public API to create an application/bot or toggle the
Server Members privileged intent — verified against current docs and
GitHub issues, so those two steps stay manual. Everything downstream of
having a Client ID is now automated:

- Dashboard Step 1 builds the OAuth2 invite URL itself from the entered
  Client ID (Send Messages | Embed Links | Pin Messages — permission
  bitfield 2251799813703680, computed from Discord's own permissions doc
  and cross-checked against a Node BigInt calc after a web search and a
  WebFetch summary disagreed on the Pin Messages bit value; Pin Messages
  only became its own permission bit on 2026-02-23, split off from
  Manage Messages). No more manual OAuth2 URL Generator step.
- A second button deep-links straight to the app's Bot tab
  (developers/applications/<id>/bot) for the still-manual "enable
  Server Members Intent" step.
- Setup instructions trimmed from 7 steps to 5 to match.
- bot/botManager.js: new exported isDisallowedIntentsError() (tested),
  checked from three places (login().catch, client 'error', client
  'shardError' — discord.js's promise-rejection behavior for this error
  has been inconsistent across versions per discordjs/discord.js#9621)
  so a missing intent reliably surfaces a `DISALLOWED_INTENTS`-coded
  error instead of a generic failure or silent hang.
- routes/botRoutes.js propagates that code to the frontend; the
  dashboard shows a dedicated, translated error box with a working
  deep-link to the exact settings page instead of a raw error toast.
- README/README.de also corrected: they documented `Read Message
  History` where the dashboard actually needs `Pin Messages` (the bot
  pins the /help wizard message) — now both match the real permission
  set used by the invite link.

All 360 tests pass (5 new).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code @claude
fix: use verified /applications/new deep-link for "create application…
b978e71 
…" button

Plan said to link straight to the new-application form instead of the
general portal list; the implementation used the generic list URL
without verifying /new actually resolves. Checked now (curl: 200, no
redirect) and wired it in.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code @claude
fix: seed BOT_LANGUAGE from the register-screen language on first run
f3b23c4 
The login/register screen's language selector only ever controlled how
that screen rendered itself (a client-side/localStorage preference) —
it never reached the server, so BOT_LANGUAGE stayed on the "en" default
even for an admin who registered with German selected. The dashboard
ended up correctly German (client-side), but the bot kept replying in
English until someone noticed and changed Step 7 → Bot Language by hand.

register-form now sends the active language alongside username/password;
utils/auth.js's register() seeds both LANGUAGE and BOT_LANGUAGE from it
on account creation (validated against the two locales Questorr actually
ships). Step 7 still overrides this at any time afterward.

All 360 tests still pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code @claude
fix: revert dev-portal button to the general applications list
ee9ddea 
/applications/new does not actually open a "create new application"
flow in Discord's portal (a client-rendered SPA — my earlier curl check
only confirmed a 200 status, not that the frontend router treats it as
a distinct route). User-confirmed by testing: landing on the general
list and clicking "New Application" there is what actually works.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code @claude
chore(release): bump version to v2.4.3
1a3ef6a 
Automated Discord bot invite + missing-intent errors, BOT_LANGUAGE
first-run seeding, dead code/config cleanup, dependency vulnerability
fixes, and doc corrections accumulated since v2.4.2. Bumps
package.json/package-lock.json, the app.js config-export version
string, the Dockerfile OCI image label, both READMEs' version badge
and pinned-version example, and adds the v2.4.3 CHANGELOG entry
(EN + DE). All 360 tests pass.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0155eLKT3tazo8Urzgbs1c6U
@Gasi-Code
Gasi-Code merged commit a633982 into main Sep 17, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Gasi-Code