First major post-launch stabilization update.
- Migration from SQLite to PostgreSQL.
- Backup flow with pg_dump.
- Do not send JWT to external stream URLs.
- Performance and i18n improvements.
Updates Visual Overview
Quick summary of the changes in v1.0.1, v1.1.0, v1.1.2, and v1.2.0 so you can review improvements by area without opening each markdown file.
Area Filters
Security hardening and major Android TV improvements.
- Server-side sanitization and validation for endpoints.
- EPG and update-dialog fixes on Android TV.
- Fixed app-version upload URL handling.
- nginx/custom.conf support for upload limits.
Fix consolidation and multi-platform expansion.
- Password reset, SMTP tooling, 2FA, and API keys.
- Stricter URL and streaming proxy/subtitle rules.
- Admin/reseller/user panel UX and i18n improvements.
- Android TV improvements and Android Phone launch.
- Media watcher and automatic TV provider sync.
Major release: 9+ security fixes, subscription system, DRM overhaul, 77K+ RPS.
- Bcrypt API keys, IP spoofing patched, Stripe idempotency, 2FA hardened, rate limiting.
- End-user subscriptions, packages, category-based access, billing tracking.
- Dynamic sidebar by category, subscription flow, admin Stripe settings, list view fixes.
- ClearKey DRM fixed (DASH rewrite), device persistence, HEVC 10-bit, EPG.
- Auto v1.1.2→v1.2.0 migration (44 tables), API encryption layer, 82 tests.
Recommended Upgrade Path
1
If you are on 1.1.x: upgrade directly to 1.2.0. Backup your database
first, then rebuild backend/frontend with --no-cache, and rebuild Android apps.
2
Post-upgrade: Regenerate Master API Keys (old keys are invalidated). Enable
public_redeem_enabled and public_demo_enabled in admin settings if needed.
3
If you are on 1.0.0 SQLite: migrate data to PostgreSQL using the full guide and validate media mounts, then apply v1.2.0.
4
If you use proxy mode: verify nginx/custom.conf and recreate the
proxy profile to keep upload limits and clean routes.