Skip to content

feat(deps): update tautulli/tautulli v2.18.2 → v2.19.0 - #4633

Merged
truecharts-admin merged 1 commit into
mainfrom
renovate/tautulli-tautulli-2.x
Nov 10, 2026
Merged

feat(deps): update tautulli/tautulli v2.18.2 → v2.19.0#4633
truecharts-admin merged 1 commit into
mainfrom
renovate/tautulli-tautulli-2.x

Conversation

@truecharts-admin

@truecharts-admin truecharts-admin commented Nov 10, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Update Change
Tautulli/Tautulli minor 2.18.2 → 2.19.0

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

Tautulli/Tautulli

v2.19.0

Compare Source

  • Notes:
    • Support for Python 3.10 has been dropped. The minimum Python version is now 3.11.
    • Installs without a password set will generate a temporary random password on upgrade. The temporary login info can be found in the Tautulli log file. Please change the password in the settings after logging in.
  • Activity:
    • Change: Renamed ETA on activity cards to Ends At. (#​2574)
  • History:
    • Fix: Filtering history tables on collections and playlist media info pages showed incorrect results.
    • New: Added feature to archive users and libraries while keeping their history. (#​1435, #​2778) (Thanks @​akonopcz)
      • Note: Archived users and libraries are excluded from all history and statistics by default. They can be shown using the "Show Archived Data" button in the navigation bar dropdown menu.
    • New: Added ability to restore deleted users/libraries from the users/libraries tables in edit mode.
  • Notifications:
    • Fix: Telegram notifications shown as failed in the notification logs when a poster with a caption is sent. (#​2852) (Thanks @​PilaScat)
    • Fix: Dolby Vision Profile and Level notification parameters should be blank when not present. (#​2381)
    • Fix: Deep links for Plex Android / iOS app notifications not working.
    • New: Added Ace editor for editing notification text.
    • New: Added live TV notification exclusion tag.
    • New: Added Letterboxd URL notification parameter. (#​1904)
    • New: Added Reply-To header to email notification agent. (#​1702)
    • Removed: OneSignal notifications for Tautulli Remote App.
  • Newsletters:
    • Fix: Unable to save blank newsletter subject, body, or message.
    • New: Added weeks and years time frame options for newsletters. (#​2042)
    • New: Added item counts to recently added newsletter parameters. (#​1787)
    • Fix: Do not allow custom newsletter templates inside the newsletter output folder. (Thanks @​SHAHID-XT)
    • Fix: Newsletter scheduler crash when local timezone cannot be resolved. (#​2889, #​2890)
  • Exporter:
    • Fix: Truncate long titles in export filenames. (#​2777)
  • UI:
    • Fix: Collections composite poster not showing on media info pages.
    • Fix: Broken collections click through link to Plex Web on media info pages.
    • Fix: Alert message for an expired Plex token not showing up.
    • Fix: Escape playlist titles in the Playlist tables. (CVE-2026-TBD) (Thanks @​Cbdlll)
    • Fix: Escape media info fields in the Media Info tables. (CVE-2026-TBD) (Thanks @​Cbdlll)
    • Fix: Escape subtitle language on the activity cards. (CVE-2026-TBD) (Thanks @​Cbdlll)
    • New: Various UI fixes and improvements.
    • New: Allow selecting multiple media types for recently added on the homepage. (#​2733)
    • New: Added ability to disable Tautulli login and only allow Plex OAuth login. (#​2092)
  • API:
    • New: Added include_archived parameter to all history and statistics API commands.
    • New: Added user_is_archived and library_is_archived to get_history API response.
    • New: Added deleted_user and is_archived to get_users_table API response.
    • New: Added deleted_section and is_archived to get_libraries_table API response.
    • New: Added is_archived to get_user, get_users, get_user_names, get_library, and get_library_names API responses.
    • New: Added row_ids parameter to undelete_user and undelete_library API commands.
    • New: Added include_last_triggered parameter to get_notifiers API command.
    • New: get_recently_added API command now accepts a comma separated list of media types.
  • Other:
    • Fix: Some default settings were reset to disabled after completing the setup wizard.
    • Fix: SSRF in /pms_image_proxy via unrestricted external image URL handling. (CVE-2026-TBD) (Thanks @​larlarua)
    • Fix: CSRF via State-Changing GET Endpoints Allows Administrative Actions. (CVE-2026-TBD) (Thanks @​zaara2004)
    • Fix: Generating self-signed SSL certificates not working.
    • Fix: Changing admin HTTP password did not log out existing sessions. (#​2868) (Thanks @​spjoes)
    • Fix: GIT_PATH command injection. (@​SHAHID-XT)
    • New: Major database optimizations and performance improvements.
    • New: Added Homebrew Cask installation method for macOS. (#​2867) (Thanks @​manakbisht)
    • New: Added Flatpak installation method for Linux.
    • New: Added CPU architecture to the system analytics data.
    • New: Update Docker image, and Windows and MacOS packages to Python 3.14.
    • New: Improved Tautulli log messages to include full traceback for errors. (#​2760)
    • New: Refuse non-local clients when no password is set. This can be disabled by setting allow_public_no_password = 1 in the config file.
    • New: Log IP address of failed login attempts. (#​2092)
    • New: Generate a temporary random login password on new installs to access the setup wizard. (CVE-2026-TBD) (Thanks @​SHAHID-XT)
    • New: Generate a temporary random login password on existing installs if no password is set.
    • Change: Only allow X-Api-Key header for /api and /auth/signin.
    • Removed: Drop support for arm/v6 Docker image.
    • Removed: Drop support for macOS 10.13 and 10.14 for the Intel x86_64 installer package.
    • Removed: /delete_duplicate_libraries endpoint removed.
    • Removed: PlexWatch and Plexivity importers removed.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@truecharts-admin truecharts-admin added automerge Categorises a PR or issue that references a new App. renovate/container renovate/github-release type/minor labels Nov 10, 2026
@truecharts-admin
truecharts-admin enabled auto-merge (squash) November 10, 2026 22:16
@coderabbitai

coderabbitai Bot commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Explain Change →

Caution

Review failed

The pull request is closed.

Summary

Summary by CodeRabbit

  • Chores
    • Updated the Tautulli version included with this release from 2.18.2 to 2.19.0. This means the application now uses Tautulli 2.19.0 instead of 2.18.2. No other changes are specified in the release summary.

The Docker Bake configuration updates the default Tautulli version from 2.18.2 to 2.19.0.

Changes: Tautulli version update

Layer / File(s) Summary
Update default version
apps/tautulli/docker-bake.hcl		 The default VERSION changes from 2.18.2 to 2.19.0.

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Suggested labels: area/apps

Merge Risk: Minimal · up to e66d6

No merge-blocking issue was identified in the version update.

Security architecture risk: Low · up to e66d6

The update preserves the existing image privileges and configuration location. No introduced security defect was established. However, the release’s temporary-password behavior makes credential persistence and log access relevant during upgrades; those deployment-specific controls and recovery behavior remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The credential-initialization behavior described in the release notes applies to upgraded Tautulli installations without a password. Effective network exposure, deployment count, log readership, and isolation between installations are not established by the inspected image configuration.

Trust Boundaries and Controls

  • inferred — The release notes say temporary login information is written to the Tautulli log. For affected installations, access to that log is therefore relevant to credential confidentiality. No evidence establishes unauthorized log access, credential misuse, or an attacker-reachable path introduced by this update.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

@trueforge-bot

trueforge-bot Bot commented Nov 10, 2026

Copy link
Copy Markdown

📦 App Size Analysis

Note

Comparing ghcr.io/trueforge-org/tautulli:rolling ➔ ghcr.io/trueforge-org/tautulli:sandbox

📈 Size Comparison Table

OS/Platform Previous Current Change Trend
linux/amd64 357.48 MB 357.69 MB +205.18 kB (+0.06%) 🔼
linux/arm64 347.19 MB 347.45 MB +252.48 kB (+0.07%) 🔼

Crow-Control
Crow-Control approved these changes Nov 10, 2026
View reviewed changes

@Crow-Control Crow-Control left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto approved automated PR

@truecharts-admin
truecharts-admin merged commit 39bf480 into main Nov 10, 2026
14 of 15 checks passed
@truecharts-admin
truecharts-admin deleted the renovate/tautulli-tautulli-2.x branch November 10, 2026 22:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Crow-Control Crow-Control Crow-Control approved these changes
@alfi0812 alfi0812 Awaiting requested review from alfi0812 alfi0812 is a code owner

Assignees

No one assigned

Labels

app/tautulli area/apps automerge Categorises a PR or issue that references a new App. renovate/container renovate/github-release type/minor

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@truecharts-admin @Crow-Control