[truecharts-admin]

This PR contains the following updates:

Package	Update	Change
stashapp/stash	minor	0.31.1 → 0.32.0

---

Release Notes

stashapp/stash

v0.32.0

Compare Source

Release Notes

v0.32.0 - 2026-10-26

⚠️ Notable Changes

• The security tripwire has been replaced. If no credentials are configured, requests from public IP addresses are now rejected with a 403 error instead of shutting down stash. Public IP ranges can be allowed using the new public_whitelist config field (CIDR format, e.g. 192.168.1.0/24), and non-local proxies can be configured with the new trusted_proxies field. The dangerous_allow_public_without_auth and security_tripwire_accessed_from_public_internet config fields have been removed. (#​7085)
• Marker preview generation now honours the marker's end time. The previous hardcoded 20 second limit is now an optional Max marker preview duration setting (default 0 - no limit). (#​6855)
• The UI has been upgraded to React 18. UI plugins that depend on React internals may need to be updated. (#​7276)

✨ New Features

• Added Production Date field to scenes. (#​6533)
• Added list view for Studios. (#​6913)
• Added credentials step to the initial setup wizard. (#​7080)
• Sort by options can now be pinned to the top of the sort by list. (#​7081)
• Added Select by Codec option to the Duplicate Checker. (#​5281)
• Added support for scraping using TLS impersonation via the useSurf scraper driver option. (#​6806)
• Added image support to the built-in Auto Tag scraper. (#​6650)
• Added option to merge or overwrite aliases in the Tags tagger. (#​6839)
• Added performer hover previews and mismatch warnings to the Tagger performer matching. (#​6854)
• Remote scene duration is now shown in the Tagger. (#​7193)
• Added support for JXL images in zip files. (#​7002)
• Added stash-box endpoint dropdown to the Stash ID filter. (#​7113)
• Saved filter list has been redesigned, with support for renaming filters in place. (#​7224)
• Added support for sorting galleries (#​6879) and images (#​6936) by performer age.
• AirPlay now works when authentication is enabled, using signed stream URLs. (#​6529)

🎨 Improvements

• Added text filter to the sort by dropdown. (#​7078)
• Child studios can now be set from the studio edit page. (#​6898)
• Studio cards, list and details now show recursive scene, performer and O-counts including sub-studios. Added sorting studios by O-Count and Performer Count. (#​6933)
• Added support for sorting studios by scene marker count. (#​6932)
• Added sorting and filtering options to sub-groups. (#​6900)
• Parent tags with no directly-tagged content now appear in the sidebar tag selector. (#​6929)
• Batch update performers now allows selecting which fields are updated. (#​6885)
• Scene cover image actions have been consolidated into a single menu. (#​6924)
• Added Set as performer image action to the performer Images tab. (#​6980)
• Gallery slideshow can now be opened directly from the galleries page. (#​7035)
• Added delete button and d d keyboard shortcut to the image lightbox. (#​7022)
• Lightbox now shows a single image position counter across the whole gallery. (#​7084)
• Plugins settings list is now collapsible, filterable and sorted alphabetically. (#​7018)
• Available scrapers filter now matches on supported studios and URL patterns. (#​7259)
• Added setting to disable the Auto Tag confirmation dialog. (#​6859)
• Stash-box OSHASH match indicator now only checks OSHASH and shows submission counts on hover. (#​6972)
• Improved visibility of the Organized button in its active state. (#​7254)
• Surrounding quotes are now stripped from pasted Windows paths. (#​6948)
• Clean Generated Files now removes empty directories when cleaning blobs. (#​6749)
• Scene screenshot generation now retries with accurate seek if the initial attempt fails. (#​6922)
• Image URLs now use the file checksum for cache-busting, so images are no longer reloaded after editing metadata. (#​6998)
• Improved logging when scene marker generation fails. (#​7043)
• Added support for the TZ environment variable to configure the timezone. (#​7054)
• Funscript URLs now include the API key. (#​6760)
• Stash-box requests now include a User-Agent header with the stash version. (#​7034)
• Improved query performance by optimising table joins. (#​6648)
• Improved card rendering performance. (#​6935)
• Reduced memory usage when generating image phashes. (#​7128)
• Improved performance of stash-box scene queries by fetching studio parents in a single request. (#​7169)
• Increased database busy timeout to 5 seconds to reduce database is locked errors. (#​7190)

🐛 Bug fixes

• Fixed SVG images being able to run embedded scripts. (#​7174)
• Fixed potential SQL injection in stash ID filters. (#​6992)
• Fixed scene identify not respecting identify settings. (#​7047)
• Fixed zip-based galleries not being recreated on scan after being deleted. (#​7001)
• Fixed files being treated as new when only the filename case changed on case-insensitive filesystems. (#​7098)
• Filenames on macOS are now normalised to NFC when scanning. (#​7072)
• Fixed nested library paths not consistently applying the most specific library's media type exclusions. (#​7077)
• Image phash is now removed when the file's OSHASH changes. (#​7021)
• Fixed database lock being held after cancelling image phash generation on large libraries. (#​6845)
• Fixed phash precision loss in JSON import/export. (#​6905)
• Fixed entire video-backed image clips being loaded into memory when generating thumbnails. (#​7049)
• Fixed Selective generate not using the configured preview settings. (#​7056)
• Fixed funscripts encoded with a UTF-8 BOM failing to parse. (#​6988)
• Fixed numeric custom field filters not working in some circumstances. (#​7040)
• Fixed filtering for missing phash. (#​7121)
• Fixed SQL error when excluding galleries by parent folder. (#​7123)
• Fixed size summary in list views not including all files, and file size filter not considering all files. (#​7006, #​7298)
• Fixed A/V desync after seeking when the video stream is copied during transcoding. (#​7104)
• Fixed caption tracks not loading when authentication is enabled. (#​7069)
• Fixed scenes without files breaking the scene queue. (#​7227)
• Fixed scene and marker walls not respecting the wall preview type setting. (#​7017)
• Fixed scenes requiring transcoding auto-starting in Safari when auto-start is disabled. (#​7016)
• Fixed VR videos appearing too bright and desaturated in VR mode. (#​7248)
• Fixed portrait videos blocking clicks on elements below the player. (#​7249)
• Fixed lightbox jumping to the last image of a page when crossing a page boundary. (#​7083)
• Browser Back button now closes the lightbox. (#​7094)
• Fixed warped image aspect ratios in the lightbox on Safari. (#​6961)
• Fixed Performer details page layout on Safari. (#​7235)
• Fixed From File image button not working in Firefox. (#​7299)
• Fixed detail page tabs not rendering when the first tab has no content. (#​6923, #​7074)
• Fixed Tagger view crashing when no stash-box endpoint is configured. (#​7042)
• Fixed performer popover being cut off in scene scrape results. (#​6892)
• Fixed duration match indicator in the Tagger when the remote scene has no fingerprints. (#​7267)
• Fixed description and aliases not being included when creating a tag from the scene Tagger. (#​6872)
• Fixed incorrect stash ID links in the tag and performer merge dialogs. (#​6838)
• Fixed pagination footer blocking clicks on elements beside it. (#​6895, #​7041)
• Fixed file info counter not updating after deleting a file. (#​6841)
• Fixed relationship fields keeping stale values after using Save & New. (#​7125)
• Fixed scene file info overflowing on mobile. (#​7141)
• Fixed repeated whitespace being collapsed in Duplicate Checker paths. (#​7073)
• Fixed Reveal in file manager not working. (#​7163)
• Fixed long log lines from scrapers and plugins causing errors. (#​7171)
• Fixed UI continually polling for job status after package manager jobs complete. (#​7226)
• Fixed panic when a scraper returns no scene fields. (#​6857)
• Fixed HTTP response bodies not being closed in some scraper and package paths. (#​6930)
• Fixed API route context key collisions. (#​6989)
• HTML lang attribute is now set from the interface language. (#​7185)
• Updated the JAV code parser in the Tagger. (#​7207)

Api Changes

• Many new components are now patchable: StudioPage, TagPage, GroupPage (#​6967), PerformerCreate, SceneCreate (#​7264), merge modals (#​7151) and SceneScrapeDialog (#​7213).
• Added SavedFilter.Loaded and FilterTags.Extras plugin extension points. (#​7117)
• Added data-action attributes to interactive controls (#​6977) and rating attributes to the rating banner (#​6976) for theme and plugin targeting.
• Added production_date field to scenes. (#​6533)
• Added scene_filter parameter to findDuplicateScenes. (#​6884)
• Added child_ids field to StudioCreateInput and StudioUpdateInput. (#​6898)
• Added depth parameter to studio o_counter. (#​6933)
• TagFilterType count fields now use HierarchicalCountInput, which accepts an optional depth. (#​6929)
• Added scenes, images and galleries fields to VideoFile, ImageFile and GalleryFile respectively. (#​6938)
• Added file path to image scraper input. (#​6856)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 620e93ea-6694-41bd-96c1-02aa2d1c78f3

Commits

Reviewing files that changed from the base of the PR and between 1ea59a2 and 0e8fb65.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

No actionable comments were generated in the recent review.

Summary

Summary by CodeRabbit

• Chores
  • Updated the Stash version used for builds from 0.31.1 to 0.32.0. This updates the version associated with Stash container builds; no other user-facing changes are included in this update.

The default VERSION in the Stash Docker Bake configuration changes from 0.31.1 to 0.32.0.

Changes: Stash version update

Layer / File(s)	Summary
Update default version apps/stash/docker-bake.hcl	The default VERSION changes from 0.31.1 to 0.32.0.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Change: Other

Suggested reviewers: crow-control

Merge Risk: Minimal · previous review 1ea59

No actionable merge-blocking risk was identified in this version update.

Security architecture risk: Low · up to 1ea59

The update changes security behavior inherited from Stash. No concrete expansion of access or unsafe transition was demonstrated, but compatibility with deployed security settings across upgrade and rollback remains unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The direct reach is Stash images built using the updated version default and deployments that adopt those images. Which instances, users, or stored assets are exposed cannot be established without deployment and configuration evidence.

Trust Boundaries and Controls

• inferred — The downloaded Stash runtime supplies the reported public-IP and proxy-trust enforcement. Determining whether attacker-controlled requests or forwarded identity information can cross that boundary requires the upstream enforcement implementation and effective deployment settings; the build files do not establish that attack path.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the dependency update from stashapp/stash 0.31.1 to 0.32.0.
Description check		The description directly documents the stashapp/stash version update and includes its release notes.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e1a7a8d7-3b89-4f78-98e9-070fb0565b0d

Commits

Reviewing files that changed from the base of the PR and between 68d456c and 1ea59a2.

Files selected for processing: 1

• apps/stash/docker-bake.hcl

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

[Crow-Control]

Auto approved automated PR