v2.17.0-ls222

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/v2.17.0-ls222/index.html

LinuxServer Changes:

Full Changelog: v2.16.1-ls221...v2.17.0-ls222

Remote Changes:

Changelog

v2.17.0 (2026-03-27)

• Important Note!
  • Several security vulnerabilities have been identified in Tautulli versions <=2.16.1. Users are strongly encouraged to update to the latest Tautulli version 2.17.x.
• Notifications:
  • Fix: Prevent RCE in notification text evaluation. (CVE-2026-28505) (Thanks @q1uf3ng)
• Newsletters:
  • Fix: Media from other video libraries using the modern Plex agents not showing up on newsletter.
  • Fix: Unauthenticated path traversal in /newsletter/image/images endpoint. (CVE-2026-31831) (Thanks @JakePeralta7)
• Exporter:
  • Fix: Logo images incorrectly exported as jpg instead of png.
  • New: Added ability to export square art images.
  • New: Added ability to export theme music. (#2654)
• Graphs:
  • Fix: History modal not opening when clicking on graphs. (#2652)
• API:
  • Fix: SQL injection in get_home_stats API command. (CVE-2026-31799) (Thanks @mandreko)
  • Fix: Unsanitized JSONP callback parameter. (CVE-2026-32275) (Thanks @mandreko)
  • New: Added rating to get_home_stats API command. (#2655) (Thanks @jma1ice)
  • Removed: get_apikey API command.
• Other:
  • Fix: Validate log path for Plex log files. (#2632)
  • Fix: Add authentication to /pms_image_proxy endpoint. (CVE-2026-31804) (Thanks @mandreko)
  • New: Updated third party donation logos. (#2646) (Thanks @aisgbnok)
  • New: Update Bootstrap CSS to v3.4.1 and decouple overrides (#2662) (Thanks @aisgbnok)
  • New: Update Bootstrap-select to v1.13.18 (#2666) (Thanks @aisgbnok)

🛡 VirusTotal GitHub Action analysis:

• Tautulli-macos-v2.17.0-universal.pkg
• Tautulli-windows-v2.17.0-x64.exe

develop-c21b74b1-ls464

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-c21b74b1-ls464/index.html

LinuxServer Changes:

No changes

Remote Changes:

Revert "Remove --no-binary cffi"

This reverts commit b1bde2cf7f16e68d58caa05149099c4c97518b25.

develop-b37f280e-ls464

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-b37f280e-ls464/index.html

LinuxServer Changes:

No changes

Remote Changes:

Update snap to core24

develop-5610c167-ls464

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-5610c167-ls464/index.html

LinuxServer Changes:

No changes

Remote Changes:

v2.17.0

develop-4ccd313a-ls464

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-4ccd313a-ls464/index.html

LinuxServer Changes:

No changes

Remote Changes:

Update Bootstrap CSS to v3.4.1 and decouple overrides (#2662)

• Externalize Bootstrap overrides to tautulli.css

• Restores bootstrap.css to the official v3.3.5 distribution files.
• Relocates Bootstrap customizations (body background, textarea focus) to tautulli.css.
• Overrides font-face to map Glyphicons to Tautulli's specific font directory.

• Update Bootstrap CSS to v3.4.1

• Remove Bootstrap CSS source maps

• Update Bootstrap CSS to v3.3.7

develop-37ff0325-ls464

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-37ff0325-ls464/index.html

LinuxServer Changes:

Full Changelog: develop-23b2af1c-ls463...develop-37ff0325-ls464

Remote Changes:

Bump cryptography from 46.0.5 to 46.0.6 (#2665)

Bumps cryptography from 46.0.5 to 46.0.6.

• Changelog
• Commits

---

updated-dependencies:

• dependency-name: cryptography
  dependency-version: 46.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  ...

Signed-off-by: dependabot[bot] support@github.com
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

v2.16.1-ls221

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/v2.16.1-ls221/index.html

LinuxServer Changes:

Full Changelog: v2.16.1-ls220...v2.16.1-ls221

Remote Changes:

Changelog

v2.16.1 (2026-12-15)

• Notifications:
  • New: Add Tautulli Plex token expired notification trigger.
• Newsletters:
  • New: Add Ace editor for syntax highlighting and code formatting for newsletter message text (#2585) (Thanks @mcclown)
• Graphs:
  • Change: Restrict graphs to guest user.
• UI:
  • New: Add DD:HH:MM time format for home stats.
  • New: Add HH:MM:SS time format for activity cards.
  • Removed: Timezone from IP address modal.
• Other:
  • Change: Zip backup files to reduce file size.

🛡 VirusTotal GitHub Action analysis:

• Tautulli-macos-v2.16.1-universal.pkg
• Tautulli-windows-v2.16.1-x64.exe

develop-57576199-ls463

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-57576199-ls463/index.html

LinuxServer Changes:

No changes

Remote Changes:

Add rating field to get_home_stats API response (#2655)

• Add rating field to get_home_stats API response

• Updated so rating field is in all of the applicable API responses

develop-23b2af1c-ls463

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-23b2af1c-ls463/index.html

LinuxServer Changes:

Full Changelog: develop-7286f343-ls462...develop-23b2af1c-ls463

Remote Changes:

Bump plexapi from 4.18.0 to 4.18.1 (#2661)

• Bump plexapi from 4.18.0 to 4.18.1

Bumps plexapi from 4.18.0 to 4.18.1.

• Release notes
• Commits

---

updated-dependencies:

• dependency-name: plexapi
  dependency-version: 4.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  ...

Signed-off-by: dependabot[bot] support@github.com

• Bump plexapi==4.18.1

---

Signed-off-by: dependabot[bot] support@github.com
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JonnyWong16 9099342+JonnyWong16@users.noreply.github.com

develop-f52b017d-ls462

CI Report:

https://ci-tests.linuxserver.io/linuxserver/tautulli/develop-f52b017d-ls462/index.html

LinuxServer Changes:

No changes

Remote Changes:

Fix export modal theme music typos