[renovate]

This PR contains the following updates:

Package	Update	Change
theotherp/nzbhydra2	major	8.9.0 → 9.0.2

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

theotherp/nzbhydra2 (theotherp/nzbhydra2)

v9.0.2

Compare Source

Fix Restore downloader category selection popup when sending results to the downloader by clicking the row action button. See #​1085

Fix With form based login the welcome screen was shown on every login page. The UI asks the server whether the welcome was already shown, and that request was answered with the login page itself instead of with the setting, which the UI read as a no.

Fix Requests the UI makes in the background are now answered with a proper error when your session is gone or you are not logged in, instead of with the login page. This affects form based login; OIDC already worked that way.

Fix With OIDC logins Hydra only recognized the logged in user when the username was taken from the claim "preferred_username". If you configured another claim (e.g. "email") you were logged in but treated as an unknown user, which with restricted search sent you back to the login page.

Fix Logging out reported "Logout failed!" and kept you on the page although you had been logged out. It happened whenever the login page was the only thing you were allowed to see afterwards.

Feature Clicking a search result's cover now opens it in a bigger view.

Fix The button to download selected results as ZIP was never shown because it checked a setting that never existed on the server. It is back, available when your downloads are set to go through Hydra (not direct links), and can be hidden again through the display options.

Feature The display option "Hide downloaded results" is back and now shows how many results it currently affects, e.g. "Hide downloaded results (3)". Enabling it also hides results you already downloaded in an earlier session, not just ones downloaded during the current search. The "Downloaded" label on a result now shows for those earlier downloads too.

Fix "Send selected to black hole" and "Copy selected links" could be clicked with nothing selected and only complained afterwards. They are now disabled until you select at least one result, like the other bulk actions.

Fix Fix newznab API endpoint being unable to parse search result GUID. See #​1087

v9.0.1

Compare Source

Feature New display option "Group same titles" in the search results. Results with the same title were always put into one group; you can now switch that off and see every result in its own row. Duplicates of the same release are still grouped, they have their own option.

Fix "Group torrent and Usenet results" was ignored for results grouped by season/episode, so with the option off a torrent and a Usenet result could still end up in the same group. It now applies to every kind of grouping.

Feature The option "Expand groups by default" is back. With it on, groups start expanded, also those of results loaded later; expanding or collapsing a single group still overrules it.

v9.0.0

Compare Source

Feature Complete rewrite of the UI.

Feature Results from indexers that use language variants of the standard newznab categories (e.g. 2140 for German HD movies on treasure-maps) are now mapped to the matching category (Movies HD instead of just Movies) without adding those numbers to the categories config. For Hydra to include those categories when querying the indexer you still need to add the numbers to the categories config.

Feature New external API under /externalapi/v1 for scripts and dashboards: statistics, search, download and notification history, the current log file and creating or downloading backups. It only needs your API key (header X-Api-Key or the apikey parameter), no session and no CSRF token, so it is the replacement if the CSRF change broke a tool of yours. Browse it in the built-in API documentation at <your Hydra URL>/swagger-ui/index.html and pick the "externalapi" entry; see docs/external-api.md in the repository.

Feature The downloader status bar at the bottom of the page now shows the free disk space reported by SABnzbd or NZBGet (e.g. 955 GB free). If the downloader reports different values for the folder of finished downloads and the folder of downloads in progress the smaller one is shown and the tooltip lists both. A warning icon appears when what is left to download in the queue is larger than the free space. See #​1060.

Feature Custom mappings moved out of the Searching settings into their own "Custom Mappings" config tab. A mapping can now be given a name, switched off without deleting it, and moved up or down. The order matters, because mappings are applied from top to bottom and a mapping that matches the whole string stops the rest. The example you test with is now several lines, is saved with the mapping, and testing shows for every line both what that one mapping does and what your whole list of mappings does to it. See #​902.

Feature Some indexers (e.g. NZBGeek) put several languages into one language attribute like "English - Japanese", which Sonarr and Radarr read as a single unknown language. Hydra now returns one language attribute per language in API results, and the "Languages to keep" filter keeps a result if any of its languages is wanted. See #​888.

Fix The "Create heap dump" button in the bug report section did nothing on the regular (native) builds, which is what nearly all installations run. Hydra now creates the heap dump itself and offers it as a download.

Fix Downloads that a logged-in user sent to the downloader were shown in the history with source "API" and that user's name, because the downloader fetched them through the API link. They are now recorded as internal, and existing history entries are corrected on the first start after the update; "API" is only used for downloads of results that came from an API call.

Note Custom query and title mappings are now applied from top to bottom, and nothing is applied after the first mapping that matched the whole string was applied. Before, if two mappings that match the whole string matched, an error was logged and none of them was used.

Fix A custom mapping for search titles was also applied to result titles (and one for result titles to searches) whenever another mapping of the other kind existed. Each kind is now only applied where it belongs.

Feature Send user agent NZBHydra2 when sending results to the downloader.

Feature Duplicates are now detected when results arrive from an indexer instead of for all results every time more are loaded. This should speed up searches with many results.

Fix Old backups were never deleted on systems where the filesystem does not report a file creation time (e.g. Synology/Btrfs, some NFS or SMB setups), regardless of the configured retention. See #​1070

Fix Search results could end up in the wrong category when two indexers use the same newznab category number for different things (e.g. 4050 for ebooks on one and PC software on another). Which category won depended on which indexer answered first. Changes to the categories config were also not applied to results until a restart.

Fix The database file no longer grows to many times the size of the data it contains. Some users reported files of dozens of gigabytes; the cause was found and fixed. See #​1002 and #​976.

Note The database library H2 was updated from 2.1 to 2.4. On the first start after the update the existing database is migrated once. This happens automatically, needs nothing installed and may take a few minutes for large databases. The old file is kept as nzbhydra.mv.db.old.bak.<timestamp> for 14 days.

Note During the migration the cached search results are discarded (downloads, history and stats are kept). If Sonarr, Radarr etc. made a search shortly before the update they may need to search again before they can download.

Note If you run Hydra in docker make sure the container is stopped gracefully (e.g. stop_grace_period: 120s). Killing the process does not corrupt the database but skips the cleanup of the database file on shutdown, so the file stays larger than necessary.

Feature Admins running Hydra in docker get a one-time notice after startup about giving the container time to shut down, so the database file is compacted.

Note CSRF protection is now actually enforced. It was silently switched off in every release so far because the check depended on a value that was never set. The setting "Use CSRF protection" has been on by default the whole time, so for most installations this changes on the next restart. The web interface handles it on its own, so nothing changes when you use Hydra in a browser.

Note If you have scripts or tools that call /internalapi (which you shouldn't) with POST, PUT or DELETE using basic auth or a session, they now need to send the header X-XSRF-TOKEN with the value of the HYDRA-XSRF-TOKEN cookie. The API that Sonarr, Radarr and NZB clients use (/api, /torznab/api, /rss and the apikey download links) is not affected and needs no change. If that is not an option you can turn off "Use CSRF protection" in the main config.

Fix Configuring Sonarr, Radarr, Lidarr or Readarr no longer deletes and recreates the NZBHydra indexer entries. Entries with the same name are updated in place, so what you set on them in the tool itself, like tags or the download client, is kept. Only entries that no longer correspond to anything in Hydra are removed. See #​1078.

Fix Book searches from API tools like Readarr found nothing with the default setting "Generate queries" set to INTERNAL, because no usenet indexer supports book searches natively and only searches from the web interface got a generated query. The API capabilities now only advertise book search when it can actually be served, and the help of the setting explains what it depends on. See #​1083.

Fix Searches with excluded words (e.g. "--word") were executed again for every page instead of using the cached results.

Fix An unexpected error in an indexer could cause a search to run forever.

Fix Search results without any date could cause a search to fail.

Fix Shortcutting a search was ignored when it happened between two indexer requests.

Fix Indexer search results were written to the database again every time more results were loaded.

Fix Upload debug infos to tmpfiles.org if upload is selected.

Note For API searches a result that was already returned is no longer replaced by a duplicate found later. Pages stay consistent when loading more results.

Note I've used AI (Claude) to help me with a lot of this stuff. Without it there wouldn't be a new UI because, let's face it, I'm no designer. The database thing has been troubling me for years and I never found a solution before.

Note Thanks to Treasure Maps for their donation which made all this possible.

Note With this many changes there always will be bugs - please report them on Github and provide debug infos.

Note If you've made it this far - thanks for reading :-)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: undefined

Post-upgrade command 'helm-docs --chart-search-root=. --log-level=warn' has not been added to the allowed list in allowedCommands

File name: undefined

Post-upgrade command 'helm-schema --chart-search-root . --skip-auto-generation required,additionalProperties --append-newline' has not been added to the allowed list in allowedCommands

[github-actions]

Renovate PR Analysis

Update Summary

• Dependency: theotherp/nzbhydra2 (application version, apps/nzbhydra2/docker-bake.hcl:5)
• Version: 8.9.0 → 9.0.1
• Type: major

Release Changes

v9.0.0 (2026-09-17):

• Complete rewrite of the web UI
• New external API under /externalapi/v1 (API-key auth, no session/CSRF) with swagger-ui docs
• Database library H2 upgraded 2.1 → 2.4: one-time automatic migration on first start (old file kept as nzbhydra.mv.db.old.bak.<ts> for 14 days; cached search results discarded, downloads/history/stats kept)
• Fix: database file no longer grows to many times its data size (issues release(kopia): update kopia/kopia ( v0.22.2 → v0.22.3 ) home-operations/containers#1002, release(qbittorrent): update qbittorrent ( 5.1.3 → 5.1.4 ) home-operations/containers#976)
• CSRF protection is now actually enforced (was silently disabled in all prior releases); affects POST/PUT/DELETE to /internalapi with basic auth/session — such tools must now send X-XSRF-TOKEN; /api, /torznab/api, /rss and apikey download links are not affected
• Upstream explicitly recommends graceful container shutdown (e.g. stop_grace_period: 120s) so the H2 file is compacted on exit
• Newznab language-variant category mapping, downloader free-disk-space display, custom mappings moved to their own config tab, numerous search/indexer fixes

v9.0.1 (2026-09-18):

• New "Group same titles" display option; "Group torrent and Usenet results" now applies to all grouping kinds; "Expand groups by default" option restored

Breaking Changes

None affecting the image build — verified:

• Release asset nzbhydra2-9.0.1-generic.zip exists upstream (gh api repos/theotherp/nzbhydra2/releases/tags/v9.0.1), matching the Dockerfile URL pattern at apps/nzbhydra2/Dockerfile:10
• PR-branch CI is green: Build nzbhydra2 / Build (linux/amd64) pass, including the goss app-tests (java process, tcp6:5076 listening, HTTP 200)

Behavioral changes for image users:

• One-time DB migration on first start (can take minutes on large databases)
• CSRF enforcement may break user scripts that POST to /internalapi
• Docker's default 10s stop timeout may be short for DB compaction; upstream suggests 120s (orchestrator-side setting, not settable in the Dockerfile)

Code Changes Required

None for build/tests (CI-verified). Optional follow-up for a maintainer: document a stop_grace_period recommendation for this image's users.

Security Impact

CSRF enforcement is a security hardening (positive). No CVEs cited in the release notes. H2 2.1→2.4 is a bugfix/feature bump, not a security-driven update.

Recommendation

Needs manual review — Renovate-classified major with release notes showing behavior changes relevant to this image's users (one-time DB migration, CSRF enforcement, shutdown grace). CI build+tests pass, but per repo policy major bumps are never auto-merged. Note interplay with #277 (temurin 17→25): both branches touch apps/nzbhydra2 and are mergeable independently.