The finishing pass: plugins, metadata and subtitles
The scan gets a library working. What makes it feel owned is the poster, the match, and knowing which two plugins are worth the restart.
Media
Film, television, music, YouTube and the shelves that serve them.
14 entriesjob to be done
summarylive
start here2
PracticesThe IFPI wants yt-dlp on the EU's piracy watch list1 OctA submission to the European Commission calls the downloader "a major problem for the music industry" and names four maintainers by GitHub handle, while asking for nothing concrete.
PracticesSonghive is a self-hosted music platform where tracks play from Mastodon30 SepA new AGPL-3.0 project from Fabio Manganiello puts a streaming server and an ActivityPub social layer in one stack, with Subsonic clients, server-side outputs, and Stripe plumbing for artists and instance keepers.
the rest12
2 stories
12 min read
Jellyfin in an evening
What Jellyfin does that a streaming subscription does not, how a household actually uses it, and the install that gets a library playing tonight. The first part of a series.
1 story
Tube Archivist 0.6.0 can run as a non-root user, and the migration is not optional
Tube Archivist v0.6.0, published 25 October, can run under a dedicated non-root user, which meant removing the bundled nginx and serving media from the application. The release calls that a security improvement and a set of breaking changes: HOST_UID and HOST_GID go, ownership is yours to set, TA_BACKEND_PORT gives way to TA_PORT, media URLs changed, and Elasticsearch moves from 8.19.0 to 9.5.5.
2 stories
Plex2Shell: old Plex Media Server builds are being exploited for unauthenticated RCE
Four Plex Media Server bugs chain into unauthenticated remote code execution in builds before 1.43.3.10861. Plex announced the fix in September, a public proof of concept landed on 16 October, and one researcher's honeypot logged exploitation the next morning.
qBittorrent 5.3.0 fixes a WebUI authentication bypass in reverse-proxy setups
qBittorrent 5.3.0 fixes how the WebUI resolves the client address behind a reverse proxy, closing a spoofing bypass of the subnet whitelist, and adds session controls, RSS rule cloning and export, a backup revamp and a CSRF hardening pass.
1 story
Jellyfin 12.2 is a maintenance release with one very sensible refusal
Fifty-one changelog entries: Dolby Vision profile 8 moves to the hvc1 tag, malformed FLAC stops hanging the library, EPUB covers work on Windows, and a missing database now stops the server cold.
2 stories
Seerr v3.5.0 ships one breaking API change and a long request-flow fix list
Two library endpoints stop syncing as a side effect of being read — API consumers move to POST .../sync and PUT .../{id} — and the UI gets ntfy tags, Gotify poster embeds, a hide-already-requested toggle, and fixes across quotas, seasons and duplicate requests.
MeTube 2026.09.27 adds per-download video passwords, and a cancel that actually stops
The self-hosted yt-dlp web UI gains a video-password field for protected videos (pairable with presets), a full row for custom yt-dlp options, Python 3.14 in the image, and a fix so cancelling a download actually sends the right signal.
2 stories
Seerr: the unified Jellyfin–Plex–Emby request manager, seven months on
Jellyseerr and Overseerr merged into one project in February; since then Seerr has ended its feature freeze, patched a critical security release, and kept a steady preview train; the newest branch reworks authentication around OpenID Connect.
Sandopolis is a Sega emulator in Zig, and it serves itself to your LAN in one container
MIT-licensed, alpha, five Sega systems, a Libretro core and a browser build you can run from ghcr.io with one docker run.
2 stories
Jellyfin 12.1 is a bugfix release, and several fixes land on the 12.0 upgrade
Jellyfin 12.1 is 47 fixes six days after 12.0, and several of them touch the migration and the pre-migration backup.
Jellyfin 12.0: modern on the surface, rebuilt underneath
Jellyfin 12.0 makes its Modern layout the default and rebuilds how playlists and collections are stored — and it rewrites your database on first boot, so the backup is the only way back.