v0.9.12

Update v0.9.12

• Tag: v0.9.12

• GitHub: https://github.com/cenodude/CrossWatch/releases/tag/v0.9.12

This release has upgrade notes.

• Webhook URLs changed. After upgrading, every webhook user must copy the new webhook URL into their media server.

• Recommended action: clear existing cache from Settings → Maintenance → Clear Everything.

• Review Settings → Security if you run CrossWatch behind a reverse proxy.

Highlights

• Progress (experimental)

  • Sync resume position between Plex, Emby, and Jellyfin.

  • Supports one-way and two-way sync.

  • Configured per pair.

• History sync: better reliability

  • Preserves watched metadata more consistently when providers return sparse history.

  • Reduces duplicate history entries caused by ID drift.

• Security: hardened defaults

  • Webhook endpoints now require a unique URL token.

  • Secret redaction and path validation were tightened.

Fixes & improvements

• History Sync: preserved sparse provider metadata

  • Prevents later runs from shrinking or fragmenting history state.

  • Ref: https://github.com/cenodude/CrossWatch/issues/117

• History Sync: improved ID reconciliation

  • CrossWatch now prefers TMDb → IMDb → TVDb when reconciling the same title across providers.

  • Helps avoid duplicate entries and false add/remove decisions.

• Plex profiles: fixed per-instance whitelist persistence

  • Ref: https://github.com/cenodude/CrossWatch/issues/126

• Plex profiles: fixed extra PLEX-P01 entry in settings

  • Ref: https://github.com/cenodude/CrossWatch/issues/129

• Upgrade migration: fixed Migrate flow

  • The upgrade modal now runs the required migration correctly.

  • Ref: https://github.com/cenodude/CrossWatch/issues/130

• History indexing: faster on Jellyfin, Emby, and Trakt

  • Ref: https://github.com/cenodude/CrossWatch/issues/125

• Provider throttling: added configurable rate limiting

  • Applies to SIMKL, Trakt, and MDBList.

  • Ref: https://github.com/cenodude/CrossWatch/issues/128

• Security: hardened auth, files, and API handling

  • Fails closed if config.json exists but cannot be loaded or parsed.

  • Hardens TMDb artwork caching against path traversal and unintended overwrites.

  • Redacts common secrets in UI logs.

  • Restricts TLS certificate downloads to valid X.509 cert files.

  • Avoids leaking internal details through API error responses.

  • Strengthens path validation for file listing.

  • Ref: https://github.com/cenodude/CrossWatch/issues/123