feat: release TypeType 1.5.0

README.md

@@ -90,6 +90,21 @@ The installer creates `~/typetype-stack`, generates installation-specific secret
 - SponsorBlock, DeArrow, content blocking, imports, OIDC, and instance administration
 - No TypeType telemetry; the instance operator controls the deployment and its data
 
+## Thanks to sponsors
+
+<p>
+  <a href="https://github.com/Toastienergy" title="@Toastienergy"><img src="https://github.com/Toastienergy.png?size=128" alt="@Toastienergy" width="64" height="64"></a>
+  <a href="https://github.com/filippobaroni" title="@filippobaroni"><img src="https://github.com/filippobaroni.png?size=128" alt="@filippobaroni" width="64" height="64"></a>
+</p>
+
+A big thx to [@Toastienergy](https://github.com/Toastienergy) and
+[@filippobaroni](https://github.com/filippobaroni) for supporting TypeType through
+GitHub Sponsors. Their support helps me cover the infrastructure and spend more
+time improving the project.
+
+If u want to support TypeType financially, u can do so through
+[GitHub Sponsors](https://github.com/sponsors/Priveetee).
+
 ## For developers
 
 Each component has its own repository, tests, release cycle, and license. Pull requests belong in the repository that owns the changed code. Bug reports and feature requests stay in the central issue tracker.

RELEASE_NOTES.md

@@ -1,88 +1,84 @@
-# TypeType 1.4.0
-
-TypeType 1.4.0 adds richer search filters, consistent content blocking,
-server-delivered YouTube subtitles, configurable account sessions, and several
-playback, import and self-hosting fixes.
-
-## Search And Content Controls
-
-- Add grouped YouTube search filters for upload date, content type, duration
-  and sorting. [#187](https://github.com/TypeType-Video/TypeType/issues/187)
-- Hide blocked channels and videos consistently across search, autoplay, watch
-  pages, embeds, playlists, history, subscriptions and recommendations.
-  [#193](https://github.com/TypeType-Video/TypeType/issues/193)
-- Normalize channel and video identities so alternate YouTube URL formats
-  cannot bypass blocked-content rules.
-
-## Subtitles And Playback
-
-- Load YouTube subtitles through TypeType-Server instead of requiring the web
-  client to contact YouTube directly.
-- Cache subtitle content and preserve manual, automatic and translated subtitle
-  tracks.
-- Return typed rate-limit errors when YouTube rejects subtitle retrieval.
-- Preload adaptive SABR initialization ranges to prevent startup failures when
-  an initialization segment is not returned immediately.
-  [#204](https://github.com/TypeType-Video/TypeType/issues/204)
-- Restore saved playback positions only after the SABR session has completed
-  its initial bootstrap.
-- Route chapter selection through SABR so selecting a chapter seeks correctly
-  again. [#202](https://github.com/TypeType-Video/TypeType/issues/202)
-- Center captions correctly in the web player.
-  [#201](https://github.com/TypeType-Video/TypeType/issues/201)
-- Update PipePipeExtractor and align TypeType with the current YouTube client
-  profiles.
-
-## Accounts And Administration
-
-- Add `AUTH_SESSION_TTL_DAYS` to configure account session lifetime from 1 to
-  365 days, with a default of 30 days.
-  [#203](https://github.com/TypeType-Video/TypeType/issues/203)
-- Preserve active browser sessions during temporary refresh failures instead
-  of immediately redirecting to login.
-- Keep generated password reset tokens visible and copyable when browser
-  clipboard access is unavailable.
-  [#198](https://github.com/TypeType-Video/TypeType/issues/198)
-- Keep admin user avatars stable when an account identity is edited.
-  [#199](https://github.com/TypeType-Video/TypeType/issues/199)
-
-## Imports And Performance
-
-- Skip deleted and unavailable videos when importing YouTube Takeout playlists.
-  [#135](https://github.com/TypeType-Video/TypeType/issues/135)
-- Bound concurrent SABR download parts to reduce memory and connection pressure
-  during large downloads.
-- Keep Server and Token YouTube traffic on the configured proxy instead of
-  silently switching to a different egress.
+# TypeType 1.5.0
+
+TypeType 1.5.0 adds private RSS feeds, new-upload notifications and better
+control over live content. It also closes a security issue in the public media
+proxy and improves SABR playback during resumes and long-distance seeks.
+
+## RSS And Notifications
+
+- Add private RSS feeds for all subscriptions or a selected set of channels.
+- Filter feeds by service and content type, with direct shortcuts from channel
+  pages.
+- Regenerate, disable or delete feed links without affecting subscriptions.
+- Show compact in-app notifications when subscribed channels publish new
+  videos. [#211](https://github.com/TypeType-Video/TypeType/issues/211)
+- Give instance administrators control over RSS availability, public base URL,
+  account limits, polling intervals and request rate limits.
+
+RSS access is private to each account. Feed tokens can be revoked at any time
+and do not expose the account session itself.
+
+## Subscriptions
+
+- Add account settings to hide live streams, upcoming streams or both from the
+  subscription feed. [#213](https://github.com/TypeType-Video/TypeType/issues/213)
+- Remove stale live entries after they stop being available from the provider.
+- Normalize channel tab URLs before fetching and caching subscription pages.
+
+## Playback
+
+- Restore saved playback positions reliably in Safari after SABR preparation.
+- Preserve the requested position while a SABR session is being prepared or
+  recovered.
+- Seek directly to distant positions before decoder preroll instead of replaying
+  unnecessary media.
+- Preserve play and pause intent through seeks and quality changes.
+- Update the web player to `@typetype/mse` 0.1.44.
+
+## Security
+
+- Restrict the public media proxy to supported provider hosts and approved
+  media paths.
+- Block private, loopback and local-network destinations, including redirect
+  and DNS resolution checks.
+- Keep cross-provider redirects outside the proxy allowlist.
+- Report YouTube remote-login readiness accurately instead of exposing an
+  unusable login flow.
+- Update application and build dependencies across the released services.
 
 ## Self-Hosting
 
-- Fix the installation script attempting to download the removed
-  `youtube-egress-relay.mjs` file.
-  [#197](https://github.com/TypeType-Video/TypeType/issues/197)
-- Add account session lifetime configuration to the Compose stack and
-  environment template.
-- Validate the new session configuration during stack checks.
+No manual database migration is required.
+
+RSS is disabled by default. Instance administrators can enable it and configure
+the public feed base URL from the documented environment settings.
 
-No database migration is required. `AUTH_SESSION_TTL_DAYS` is optional and
-defaults to `30`.
+The account session lifetime and insecure-cookie development settings are now
+documented in English, French and Spanish.
 
-When a YouTube proxy is configured, it must remain reachable because Server and
-Token will no longer silently bypass it.
+## Known Limitations
+
+- YouTube may still throttle subtitle retrieval with HTTP 429 on some egress
+  addresses. [#210](https://github.com/TypeType-Video/TypeType/issues/210)
+- Native SABR playback on ARM64 remains under investigation.
+  [#204](https://github.com/TypeType-Video/TypeType/issues/204)
 
 ## Thx
 
-- A big thx to @LuckeeSoft for proposing the new search filters.
-- Thx to @Toni-Vide for the detailed reports about blocked content, password
-  reset tokens and admin avatars.
-- Thx to @Slashic for reporting the session, chapter selection and caption
-  alignment problems.
-- Thx to @Role92 for the precise SABR initialization logs.
-- Thx to @Willie169 for catching the broken self-hosted installation path.
-- Thx to @lelam183 for repeatedly testing YouTube Takeout imports and helping
-  identify the remaining unavailable-video case.
-- Thx as well to everyone testing subtitles and playback on beta, sharing logs,
-  and helping improve the self-hosting setup.
+- A big thx to @LuckeeSoft for the RSS and notification ideas and for the
+  detailed feedback while the feature was taking shape.
+- Thx to @CCGcastiel for proposing granular live-content controls for the
+  subscription feed.
+- Thx to @Buage for privately and responsibly reporting the public proxy issue
+  before disclosure. [#212](https://github.com/TypeType-Video/TypeType/issues/212)
+- Thx to @VitoItalianGamer for the detailed browser playback reports and the
+  time spent reproducing intermittent buffering behavior.
+- A big thx to [@Toastienergy](https://github.com/Toastienergy) and
+  [@filippobaroni](https://github.com/filippobaroni) for supporting TypeType
+  through GitHub Sponsors. Their support helps me cover the infrastructure and
+  spend more time improving the project.
+- Thx as well to everyone testing beta, sharing logs and helping other
+  self-hosters.
 
 ## Updating