You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
linux/arm/v7 (32-bit ARM) Docker images are no longer published. v2.5.4 is the final release with armv7 images; 32-bit ARM users should pin kometateam/kometa:v2.5.4.
Fixed
Suppress unverified HTTPS warnings for the configured Plex host when its SSL verification is disabled, while preserving warnings for other hosts. #3743
Avoid warnings when Tautulli builders omit the optional list_minimum or explicitly set it to its default of 0.
Warn and ignore missing collection names in collection.not post-filters instead of rejecting the definition, allowing overlays to continue after an excluded collection is deleted.
Preserve IMDb show mappings when TMDb cannot provide a TVDb ID, allowing metadata files to match those shows by IMDb ID. #3820
Avoid warning about a missing optional sort_by when Letterboxd user-page builders use the default sort. #3814
Reject items without a release or first-air date when applying numeric tmdb_year filters instead of aborting missing-item processing. #3815
Apply IMDb keyword filters to missing movies and shows before reporting them or sending them to Radarr/Sonarr. #3816
Process YAML files from folder sources in alphabetical filename order, ignoring case, instead of filesystem order.
Redact sensitive fallback defaults before logging library connection warnings, preventing inherited Sonarr/Radarr API keys from appearing in logs. #3839
Abort existing collection processing when a builder fails to fetch its items, preserving membership instead of syncing incomplete results. #3838
Skip Letterboxd TV entries with a single warning instead of also logging a failed movie lookup as an error. #3836
Accept Tracearr display names in builder user options, report identity UUIDs for ambiguous names, and validate Public API v2 response handling against the Tracearr 3.1.2 contract.
Discover dynamic collection keys across the full library on scoped schedule runs, avoiding empty actor discovery even when collection files are scheduled out. #3846
Let Docker containers recreated from an older image keep starting after an update instead of failing with ModuleNotFoundError: No module named 'packaging'. #3692
Added
Added mdblist_watchlist builder to create collections based on watchlist
Recognize TMDb and IMDb identifiers embedded in Plex NFO Movie agent GUIDs when mapping movie libraries. #3837
Changed
Allow items(plex:<ratingKey>|...) schedule scopes to target individual Plex items, including seasons and episodes, during library operations and overlay updates. Behavior remains the same when other ID types are used (TMDb, TVDb, IMDb).
Docs
Tell Docker users to recreate the container when updating instead of updating it in place or copying an old container's Entrypoint or PATH, which can stop a newer image starting with ModuleNotFoundError: No module named 'packaging'. #3692
Configuration
📅 Schedule: (UTC)
Branch creation
At any time (no schedule defined)
Automerge
At any time (no schedule defined)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
If you want to rebase/retry this PR, check this box
This is a routine Kometa version bump with no identified regression risk. The image build keeps the same source and installation steps. The existing container test covers the expected artifact.
Security architecture risk: Low · up to a3dfe
The update preserves the existing source location, build privileges, and runtime user. No introduced or worsened security condition was established. The selected release’s contents and authenticity were not independently verified.
Retained concerns
No architecture-level concerns identified.
Security review details
Security Blast Radius
inferred — The evidenced trust exposure is the Kometa image build and images containing the selected release. Upstream source and dependency integrity matter because installation occurs with build-time root authority. The available evidence does not establish downstream tenant, credential, or deployment exposure.
Trust Boundaries and Controls
observed — The archive fetch uses HTTPS and a fixed repository location, but the inspected Dockerfile has no explicit archive checksum or signature check before extraction and installation. This trust assumption predates the PR; no changed source-selection authority or verification control was established.
- [ ] Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.5.4→2.5.5Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
Kometa-Team/Kometa
v2.5.5Compare Source
Removed
linux/arm/v7(32-bit ARM) Docker images are no longer published.v2.5.4is the final release witharmv7images; 32-bit ARM users should pinkometateam/kometa:v2.5.4.Fixed
list_minimumor explicitly set it to its default of0.collection.notpost-filters instead of rejecting the definition, allowing overlays to continue after an excluded collection is deleted.sort_bywhen Letterboxd user-page builders use the default sort. #3814tmdb_yearfilters instead of aborting missing-item processing. #3815foldersources in alphabetical filename order, ignoring case, instead of filesystem order.useroptions, report identity UUIDs for ambiguous names, and validate Public API v2 response handling against the Tracearr 3.1.2 contract.ModuleNotFoundError: No module named 'packaging'. #3692Added
mdblist_watchlistbuilder to create collections based on watchlistChanged
items(plex:<ratingKey>|...)schedule scopes to target individual Plex items, including seasons and episodes, during library operations and overlay updates. Behavior remains the same when other ID types are used (TMDb, TVDb, IMDb).Docs
ModuleNotFoundError: No module named 'packaging'. #3692Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.