feat: Jellyseerr webhook as alternative notification source#86
Merged
retardgerman merged 7 commits intomainfrom Mar 23, 2026
Merged
feat: Jellyseerr webhook as alternative notification source#86retardgerman merged 7 commits intomainfrom
retardgerman merged 7 commits intomainfrom
Conversation
Adds POST /seerr-webhook that handles MEDIA_AVAILABLE events from Jellyseerr's built-in webhook, as an alternative to the Jellyfin webhook plugin. Uses the same WEBHOOK_SECRET (Authorization header), sends to JELLYFIN_CHANNEL_ID, and supports TMDB metadata, IMDb/Letterboxd buttons, Jellyfin search Watch Now link, and DM notifications for pending requests.
Seerr webhook now resolves the target Discord channel by matching the Jellyfin library CollectionType (movies/tvshows) against JELLYFIN_NOTIFICATION_LIBRARIES, instead of always sending to the hardcoded JELLYFIN_CHANNEL_ID. Falls back to JELLYFIN_CHANNEL_ID when no library match is found or no libraries are configured. Library list is cached for 10 minutes to avoid repeated N+1 Jellyfin API calls on every webhook invocation.
- Log error message when Jellyfin library fetch fails in resolveChannelForMediaType - Warn when library channels are configured but Jellyfin credentials are missing - Include error detail in TMDB fetch failure log - Replace empty catch block in findLibraryByAncestors with debug log - Include imdbId in OMDb failure log - Include value preview in JELLYFIN_NOTIFICATION_LIBRARIES parse failure log
Introduces BIND_HOST env var (default 127.0.0.1) so bare-metal installs no longer expose port 8282 on all network interfaces. Docker Compose sets BIND_HOST=0.0.0.0 so container port mapping continues to work. - Validates BIND_HOST with net.isIP() before listen, exits early with an actionable error message on invalid values - Adds dedicated EADDRNOTAVAIL branch in the server error handler - Registers BIND_HOST in the Joi validation schema and DEFAULTS constant
- Add note that bare-metal binds to 127.0.0.1 by default and how to override with BIND_HOST - Add BIND_HOST=0.0.0.0 to all manual Docker run and Docker Hub examples - Fix incorrect security claim: brute-force lockout has been in place since v1.4.3 - Add .markdownlint.json to suppress false positives (duplicate headings in changelog, inline HTML in contributors table, long lines)
- Remove partial API key from debug log in seerr request handler - Fix ReDoS in cleanTitle(): drop leading \s* from bracket-ID regexes, trim whitespace separately - Add botControlLimiter (10 req/min) to /start-bot and /stop-bot routes - Replace regex-based sanitizeTranslationHtml() with DOM-based allowlist parser (closes bypass vectors for nested tags and non-standard close tags) - Add permissions: contents: read to docker-publish.yml workflow - Re-parse URLs through new URL() after getSeerrApiUrl() in config-test routes so CodeQL can trace the sanitized value to the axios call site
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| // Regex-based HTML stripping is inherently bypass-prone; parsing via the | ||
| // browser's own HTML parser is the only reliable approach. | ||
| const div = document.createElement("div"); | ||
| div.innerHTML = str; |
Check failure
Code scanning / CodeQL
DOM text reinterpreted as HTML High
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #84
Documentation written with AI assistance; all code manually verified.