LoginSign Up
← Back to all sparks
T

Tautulli

ANALYTICS
Velocity5.0

Monitoring and analytics for Plex media servers

tautulli.com ↗

Tautulli 2.19 lets admins archive users and libraries without losing their history.

plexmedia-analyticssecurity-fixesself-hostednotifications
◆Current state
Tautulli, the Plex monitoring tool, shipped 2.19.0 on 10 November and a same-day 2.19.1 to fix the Snap package. 2.19.0 drops Python 3.10, forces a temporary password on installs that had none, and adds archiving for users and libraries so they leave statistics without deleting their history. It also closes another batch of CVEs (XSS in tables, SSRF in the image proxy, CSRF on GET endpoints, a git path injection) and removes OneSignal.
◆Where it's heading
Most Tautulli releases this year have been security-driven, and 2.19 continues that while finally landing long-requested features from the issue tracker. The project is tightening defaults (password required, Plex-OAuth-only login option, newer Python) and widening install paths with Homebrew and Flatpak.
◆Prediction
Expect 2.19.x patches for packaging and the new archive filters, and further CVE fixes as outside researchers keep reporting issues.

◆Recent moves

  1. 3d ago

    v2.19.1: Snap package starts again

    A one-line follow-up that fixes the Snap package failing to start after 2.19.0. Packaging only.

    View source ↗
  2. 3d ago

    v2.19.0: archive users and libraries, Python 3.11 required

    Adds archiving so departed users and removed libraries drop out of stats while keeping history, plus newsletter time frames and an Ace editor for notification text. It also requires Python 3.11, forces a password on open installs and fixes another set of CVEs, in line with the year's security-heavy releases.

    View source ↗
  3. 1mo ago

    Tautulli 2.18.2 fixes history grouping and a path traversal

    v2.18.2 tightens history grouping to matching guids, fixes repeating pause notifications during buffering and closes a newsletter-filename path traversal. Another release where a security fix rides alongside usability work.

    View source ↗
  4. 2mo ago

    Guest history exposure closed in the API; X-Frame-Options added

    A patch release that is mostly fixes — empty session rows written to the database, email passwords blanked on save, new-device notifications retriggering — with one that carries further: guest users could retrieve another user's history through the API. The X-Frame-Options config entry is the only addition, and it is hardening rather than a feature.

    View source ↗
  5. 2mo ago

    Dolby Atmos support and a push relay replacing OneSignal

    Adds Atmos to activity cards and notification parameters, moves history pagination into SQL for performance, and introduces a push relay for Remote App notifications ahead of OneSignal's deprecation in October. Two more CVEs are closed alongside it, keeping the release in the pattern every version here has followed.

    View source ↗
  6. 5mo ago

    Four CVEs closed: XSS, path traversal and open redirect

    An almost entirely security-driven release covering XSS in newsletter cron values and search query strings, path traversal in uploaded file names, and an open redirect via whitespace bypass. The only functional fixes are cosmetic by comparison.

    View source ↗