chore(release): release v1.10.0

[TimilsinaBimal]

No description provided.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
watchly	Ready	Preview, Comment	May 7, 2026 7:42am

General fix: When reading data from the DOM and reusing it in another sensitive context (here, as a URL for navigation), validate and normalize it rather than trusting the raw string. Ensure that only expected schemes, hostnames, and path characters are allowed, and avoid interpreting arbitrary text as a protocol URL.

Best specific fix here: Validate the url read from addonUrl before using it to build the stremio:// URL. A robust approach is:

1. Trim the string and ensure it is non-empty.
2. Normalize it as an HTTP(S) URL first via the URL constructor to ensure it has the expected scheme and structure.
3. Extract the host and path from the normalized URL, and reconstruct the stremio:// URL from those parts, rather than doing a naive string replace.
4. If parsing fails or the scheme is not http or https, abort (or show an error) instead of navigating.

This preserves functionality (it still converts an HTTP(S) addon URL into a stremio:// URL) but prevents arbitrary text from becoming an unchecked custom-protocol URL. All changes are confined to app/static/js/modules/form-success.js, specifically around lines 25–27. No new imports are needed.

Concretely, we will replace:

const url = document.getElementById('addonUrl').textContent;
window.location.href = `stremio://${url.replace(/^https?:\/\//, '')}`;

with logic that:

• Reads and trims the text;
• Uses new URL(...) to parse it (falling back to https:// if no scheme is provided);
• Verifies the protocol is http: or https:;
• Builds stremio:// using urlObj.host + urlObj.pathname + urlObj.search + urlObj.hash;
• Handles parsing errors by not redirecting (optionally using showError if we want minimal behavior change; to avoid new behavior we can just silently return).

---

General fix: never return raw exception text to the client. Log full diagnostic details on the server, and return a generic, non-sensitive message to users.

Best fix here (without changing functionality flow): in app/api/endpoints/oauth.py, update the except block in trakt_callback so _oauth_error_page receives a static user-safe message instead of str(e). Keep server-side logging for troubleshooting; ideally log with traceback (logger.exception) to preserve debugging value.

Concretely, replace:

• logger.error(f"Trakt OAuth callback failed: {e}")
• return HTMLResponse(_oauth_error_page("Trakt", str(e)))

with:

• logger.exception("Trakt OAuth callback failed")
• return HTMLResponse(_oauth_error_page("Trakt", "An internal error occurred. Please try again."))

No new imports or dependencies are required.

To fix this safely, keep detailed exception information in server-side logs, but return a generic error message to the browser. This preserves existing functionality (OAuth failure page still shown) while preventing exception content disclosure.

Best targeted change in app/api/endpoints/oauth.py:

• In simkl_callback exception handler (around lines 152–154), replace logger.error(...) with logger.exception(...) (or equivalent) so diagnostics remain available server-side with traceback.
• Replace _oauth_error_page("Simkl", str(e)) with a static, non-sensitive message such as "An internal error occurred during authentication. Please try again.".

No new imports or dependencies are required.

[gemini-code-assist]

Code Review

This pull request introduces significant architectural changes, including the addition of OAuth support for Trakt and Simkl, a refactored token management system, and a new unified library/history model. While these changes expand functionality, several critical issues were identified: an AttributeError in the profile service due to incorrect attribute access on Pydantic models, a security vulnerability in the OAuth callback using a wildcard origin for postMessage, a missing import for the caching decorator in the TMDB service, and a breaking change to the health check endpoint's response format.