WebAPI: Add support for authenticating via API key

PR #23212.
Closes #13201.

.github/FUNDING.yml

@@ -1 +1 @@
-custom: "https://www.qbittorrent.org/donate.php"
+custom: "https://www.qbittorrent.org/donate"

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -7,19 +7,17 @@ body:
         #### ADVISORY
         "We do not support any versions older than the current release series"
 
-        "We do not support any 3rd party/forked versions e.g. `portableapps`/`Enhanced Edition`etc."
+        "We do not support any 3rd party/forked versions e.g. `portableapps`/`Enhanced Edition` etc."
 
         "Please post all details in **English**."
 
         #### Prerequisites before submitting an issue!
         - Read the issue reporting section in the **[contributing guidelines](https://github.com/qbittorrent/qBittorrent/blob/master/CONTRIBUTING.md)**, to know how to submit a good bug report with the required information.
         - Verify that the issue is not fixed and is reproducible in the **[latest official qBittorrent version](https://www.qbittorrent.org/download.php).**
-        - (Optional, but recommended) Verify that the issue is not fixed and is reproducible in the latest CI (currently only on **[Windows](https://github.com/qbittorrent/qBittorrent/actions/workflows/ci_windows.yaml?query=branch%3Amaster+event%3Apush)**) builds.
-        - Check the **[frequent/common issues list](https://github.com/qbittorrent/qBittorrent/projects/2)** and perform a **[search of the issue tracker (including closed ones)](https://github.com/qbittorrent/qBittorrent/issues)** to avoid posting a duplicate.
+        - (Optional, but recommended) Verify that the issue is not fixed and is reproducible in the latest CI (**[macOS](https://github.com/qbittorrent/qBittorrent/actions/workflows/ci_macos.yaml?query=branch%3Amaster+event%3Apush)** / **[Ubuntu](https://github.com/qbittorrent/qBittorrent/actions/workflows/ci_ubuntu.yaml?query=branch%3Amaster+event%3Apush)** / **[Windows](https://github.com/qbittorrent/qBittorrent/actions/workflows/ci_windows.yaml?query=branch%3Amaster+event%3Apush)**) builds.
+        - Perform a **[search of the issue tracker (including closed ones)](https://github.com/qbittorrent/qBittorrent/issues?q=is%3Aissue+is%3Aopen+-label%3A%22Feature+request%22)** to avoid posting a duplicate.
         - Make sure this is not a support request or question, both of which are better suited for either the **[discussions section](https://github.com/qbittorrent/qBittorrent/discussions)**, **[forum](https://qbforums.shiki.hu/)**, or **[subreddit](https://www.reddit.com/r/qBittorrent/)**.
         - Verify that the **[wiki](https://github.com/qbittorrent/qBittorrent/wiki)** did not contain a suitable solution either.
-        - If relevant to issue/when asked, the qBittorrent preferences file, qBittorrent.log & watched_folders.json (if using "Watched Folders" feature) must be provided.
-          See **[Where does qBittorrent save its settings?](https://github.com/qbittorrent/qBittorrent/wiki/Frequently-Asked-Questions#Where_does_qBittorrent_save_its_settings)**
 
   - type: textarea
     attributes:
@@ -28,10 +26,10 @@ body:
         Qt and libtorrent-rasterbar versions are required when: 1. You are using linux. 2. You are not using an official build downloaded from our website.
 
         Example of preferred formatting:
-        qBittorrent: 4.3.7 x64
-        Operating system: Windows 10 Pro 21H1/2009 x64
-        Qt: 5.15.2
-        libtorrent-rasterbar: 1.2.14
+        qBittorrent: 4.6.6 x64
+        Operating system: Windows 10 Pro x64 (22H2) 10.0.19045
+        Qt: 6.4.3
+        libtorrent-rasterbar: 1.2.19
       placeholder: |
         qBittorrent:
         Operating system:
@@ -73,4 +71,4 @@ body:
         See **[Where does qBittorrent save its settings?](https://github.com/qbittorrent/qBittorrent/wiki/Frequently-Asked-Questions#Where_does_qBittorrent_save_its_settings)**
         #### Note: It's the user's responsibility to redact any sensitive information
     validations:
-      required: false
+      required: true

.github/workflows/ci_file_health.yaml

@@ -12,12 +12,16 @@ jobs:
   ci:
     name: Check
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
-      - name: Install tools
-        uses: actions/setup-python@v5
+      - name: Setup python
+        uses: actions/setup-python@v6
         with:
           python-version: "*"
 
@@ -32,7 +36,7 @@ jobs:
           curl \
             -L \
             -o "${{ runner.temp }}/pandoc.tar.gz" \
-            "https://github.com/jgm/pandoc/releases/download/3.1.7/pandoc-3.1.7-linux-amd64.tar.gz"
+            "https://github.com/jgm/pandoc/releases/download/3.7.0.2/pandoc-3.7.0.2-linux-amd64.tar.gz"
           tar -xf "${{ runner.temp }}/pandoc.tar.gz" -C "${{ github.workspace }}/.."
           mv "${{ github.workspace }}/.."/pandoc-* "${{ env.pandoc_path }}"
           # run pandoc
@@ -42,3 +46,26 @@ jobs:
           done
           # check diff, ignore "Automatically generated by ..." part
           git diff -I '\.\\".*' --exit-code
+
+      - name: Check GitHub Actions workflow
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          pip install zizmor
+          IGNORE_RULEID='(.ruleId != "zizmor/template-injection")
+            and (.ruleId != "zizmor/unpinned-uses")'
+          IGNORE_ID='(.id != "zizmor/template-injection")
+            and (.id != "zizmor/unpinned-uses")'
+          zizmor \
+            --format sarif \
+            --persona auditor \
+            ./ \
+            | jq "(.runs[].results |= map(select($IGNORE_RULEID)))
+              | (.runs[].tool.driver.rules |= map(select($IGNORE_ID)))" \
+            > "${{ runner.temp }}/zizmor_results.sarif"
+
+      - name: Upload zizmor results
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          category: zizmor
+          sarif_file: "${{ runner.temp }}/zizmor_results.sarif"

.github/workflows/ci_macos.yaml

@@ -2,8 +2,7 @@ name: CI - macOS
 
 on: [pull_request, push]
 
-permissions:
-  actions: write
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -13,13 +12,15 @@ jobs:
   ci:
     name: Build
     runs-on: macos-latest
+    permissions:
+      actions: write
 
     strategy:
       fail-fast: false
       matrix:
-        libt_version: ["2.0.10", "1.2.19"]
+        libt_version: ["2.0.11", "1.2.20"]
         qbt_gui: ["GUI=ON", "GUI=OFF"]
-        qt_version: ["6.7.0"]
+        qt_version: ["6.9.1"]
 
     env:
       boost_path: "${{ github.workspace }}/../boost"
@@ -27,7 +28,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         uses: Wandalen/wretry.action@v3
@@ -40,8 +43,8 @@ jobs:
           command: |
             brew update > /dev/null
             brew install \
-              cmake ninja \
               openssl@3 zlib
+            # preinstalled on the image: cmake ninja
 
       - name: Setup ccache
         uses: Chocobo1/setup-ccache-action@v1
@@ -49,15 +52,15 @@ jobs:
           store_cache: ${{ github.ref == 'refs/heads/master' }}
           update_packager_index: false
           ccache_options: |
-            max_size=2G
+            max_size=1G
 
       - name: Install boost
         env:
           BOOST_MAJOR_VERSION: "1"
-          BOOST_MINOR_VERSION: "85"
+          BOOST_MINOR_VERSION: "86"
           BOOST_PATCH_VERSION: "0"
         run: |
-          boost_url="https://boostorg.jfrog.io/artifactory/main/release/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/source/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
+          boost_url="https://archives.boost.io/release/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/source/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
           boost_url2="https://sourceforge.net/projects/boost/files/boost/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
           set +e
           curl -L -o "${{ runner.temp }}/boost.tar.gz" "$boost_url"
@@ -67,6 +70,9 @@ jobs:
             tar -xf "${{ runner.temp }}/boost.tar.gz" -C "${{ github.workspace }}/.."; _exitCode="$?"
           fi
           mv "${{ github.workspace }}/.."/boost_* "${{ env.boost_path }}"
+          cd "${{ env.boost_path }}"
+          ./bootstrap.sh
+          ./b2 stage --stagedir=./ --with-headers
 
       - name: Install Qt
         uses: jurplel/install-qt-action@v4
@@ -90,23 +96,23 @@ jobs:
             -G "Ninja" \
             -DBUILD_SHARED_LIBS=OFF \
             -DCMAKE_BUILD_TYPE=RelWithDebInfo \
-            -DCMAKE_CXX_STANDARD=17 \
+            -DCMAKE_CXX_STANDARD=20 \
             -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
-            -DBOOST_ROOT="${{ env.boost_path }}" \
+            -DBOOST_ROOT="${{ env.boost_path }}/lib/cmake" \
             -Ddeprecated-functions=OFF
           cmake --build build
           sudo cmake --install build
 
       - name: Build qBittorrent
         run: |
-          CXXFLAGS="$CXXFLAGS -Werror -Wno-error=deprecated-declarations" \
+          CXXFLAGS="$CXXFLAGS -DQT_FORCE_ASSERTS -Werror -Wno-error=deprecated-declarations" \
           LDFLAGS="$LDFLAGS -gz" \
           cmake \
             -B build \
             -G "Ninja" \
             -DCMAKE_BUILD_TYPE=RelWithDebInfo \
             -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
-            -DBOOST_ROOT="${{ env.boost_path }}" \
+            -DBOOST_ROOT="${{ env.boost_path }}/lib/cmake" \
             -DTESTING=ON \
             -DVERBOSE_CONFIGURE=ON \
             -D${{ matrix.qbt_gui }}
@@ -116,17 +122,24 @@ jobs:
 
       - name: Prepare build artifacts
         run: |
-          # create .dmg
           appName="qbittorrent"
           if [ "${{ matrix.qbt_gui }}" = "GUI=OFF" ]; then
             appName="qbittorrent-nox"
           fi
-          # package
           pushd build
+          # packaging
+          macdeployqt "$appName.app" -no-strip
+          # code signing
+          xattr -cr "$appName.app"
+          codesign --force --sign - \
+            "$appName.app" \
+            "$appName.app/Contents/Frameworks"/* \
+            "$appName.app/Contents/MacOS/$appName"
+          codesign --verify --deep --strict -v "$appName.app"
+          # create .dmg
           PACKAGE_RETRY=0
           while [ "$PACKAGE_RETRY" -lt "3" ]; do
-            macdeployqt "$appName.app" -dmg -no-strip
-            if [ -f "$appName.dmg" ]; then
+            if hdiutil create -fs HFS+ -srcfolder "$appName.app" -volname "$appName" "$appName.dmg"; then
               break
             fi
             sleep 5

.github/workflows/ci_python.yaml

@@ -15,15 +15,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Setup python (auxiliary scripts)
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: '3'  # use default version
 
       - name: Install tools (auxiliary scripts)
-        run: pip install bandit pycodestyle pyflakes
+        run: pip install bandit isort pycodestyle pyflakes
 
       - name: Gather files (auxiliary scripts)
         run: |
@@ -34,7 +36,7 @@ jobs:
       - name: Lint code (auxiliary scripts)
         run: |
           pyflakes $PY_FILES
-          bandit --skip B314,B405 $PY_FILES
+          bandit --skip B101,B314,B405 $PY_FILES
 
       - name: Format code (auxiliary scripts)
         run: |
@@ -42,48 +44,40 @@ jobs:
             --max-line-length=1000 \
             --statistics \
             $PY_FILES
+          isort \
+             --check \
+             --diff \
+             $PY_FILES
 
       - name: Build code (auxiliary scripts)
         run: |
           python -m compileall $PY_FILES
 
       - name: Setup python (search engine)
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
-          python-version: '3.7'
+          python-version: '3.9'
 
       - name: Install tools (search engine)
-        run: pip install bandit mypy pycodestyle pyflakes pyright
-
-      - name: Gather files (search engine)
+        working-directory: src/searchengine/nova3
         run: |
-          export "PY_FILES=$(find . -type f -name '*.py' -path '*searchengine*' ! -name 'socks.py' -printf '%p ')"
-          echo $PY_FILES
-          echo "PY_FILES=$PY_FILES" >> "$GITHUB_ENV"
+          pip install uv
+          uv sync
 
-      - name: Check typings  (search engine)
-        run: |
-          MYPYPATH="src/searchengine/nova3" \
-          mypy \
-            --follow-imports skip \
-            --strict \
-            $PY_FILES
-          pyright \
-            $PY_FILES
+      - name: Check typings (search engine)
+        working-directory: src/searchengine/nova3
+        run: uv run just check
 
       - name: Lint code (search engine)
-        run: |
-          pyflakes $PY_FILES
-          bandit --skip B110,B310,B314,B405 $PY_FILES
+        working-directory: src/searchengine/nova3
+        run: uv run just lint
 
       - name: Format code (search engine)
+        working-directory: src/searchengine/nova3
         run: |
-          pycodestyle \
-            --ignore=E265,E402 \
-            --max-line-length=1000 \
-            --statistics \
-            $PY_FILES
+          uv run just format
+          git diff --exit-code
 
       - name: Build code (search engine)
-        run: |
-          python -m compileall $PY_FILES
+        working-directory: src/searchengine/nova3
+        run: uv run just build

.github/workflows/ci_ubuntu.yaml

@@ -2,9 +2,7 @@ name: CI - Ubuntu
 
 on: [pull_request, push]
 
-permissions:
-  actions: write
-  security-events: write
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -14,22 +12,27 @@ jobs:
   ci:
     name: Build
     runs-on: ubuntu-latest
+    permissions:
+      actions: write
+      security-events: write
 
     strategy:
       fail-fast: false
       matrix:
-        libt_version: ["2.0.10", "1.2.19"]
+        libt_version: ["2.0.11", "1.2.20"]
         qbt_gui: ["GUI=ON", "GUI=OFF"]
-        qt_version: ["6.5.2"]
+        qt_version: ["6.6.3"]
 
     env:
       boost_path: "${{ github.workspace }}/../boost"
-      harden_flags: "-D_FORTIFY_SOURCE=2 -D_GLIBCXX_ASSERTIONS"
+      harden_flags: "-D_FORTIFY_SOURCE=3 -D_GLIBCXX_ASSERTIONS"
       libtorrent_path: "${{ github.workspace }}/../libtorrent"
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: |
@@ -44,15 +47,15 @@ jobs:
           store_cache: ${{ github.ref == 'refs/heads/master' }}
           update_packager_index: false
           ccache_options: |
-            max_size=2G
+            max_size=1G
 
       - name: Install boost
         env:
           BOOST_MAJOR_VERSION: "1"
-          BOOST_MINOR_VERSION: "76"
+          BOOST_MINOR_VERSION: "77"
           BOOST_PATCH_VERSION: "0"
         run: |
-          boost_url="https://boostorg.jfrog.io/artifactory/main/release/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/source/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
+          boost_url="https://archives.boost.io/release/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/source/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
           boost_url2="https://sourceforge.net/projects/boost/files/boost/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
           set +e
           curl -L -o "${{ runner.temp }}/boost.tar.gz" "$boost_url"
@@ -62,6 +65,9 @@ jobs:
             tar -xf "${{ runner.temp }}/boost.tar.gz" -C "${{ github.workspace }}/.."; _exitCode="$?"
           fi
           mv "${{ github.workspace }}/.."/boost_* "${{ env.boost_path }}"
+          cd "${{ env.boost_path }}"
+          ./bootstrap.sh
+          ./b2 stage --stagedir=./ --with-headers
 
       - name: Install Qt
         uses: jurplel/install-qt-action@v4
@@ -85,8 +91,9 @@ jobs:
             -G "Ninja" \
             -DBUILD_SHARED_LIBS=OFF \
             -DCMAKE_BUILD_TYPE=RelWithDebInfo \
+            -DCMAKE_CXX_STANDARD=20 \
             -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
-            -DBOOST_ROOT="${{ env.boost_path }}" \
+            -DBOOST_ROOT="${{ env.boost_path }}/lib/cmake" \
             -Ddeprecated-functions=OFF
           cmake --build build
           sudo cmake --install build
@@ -101,14 +108,14 @@ jobs:
 
       - name: Build qBittorrent
         run: |
-          CXXFLAGS="$CXXFLAGS ${{ env.harden_flags }} -Werror" \
+          CXXFLAGS="$CXXFLAGS ${{ env.harden_flags }} -DQT_FORCE_ASSERTS -Werror" \
           LDFLAGS="$LDFLAGS -gz" \
           cmake \
             -B build \
             -G "Ninja" \
             -DCMAKE_BUILD_TYPE=RelWithDebInfo \
             -DCMAKE_EXPORT_COMPILE_COMMANDS=ON \
-            -DBOOST_ROOT="${{ env.boost_path }}" \
+            -DBOOST_ROOT="${{ env.boost_path }}/lib/cmake" \
             -DCMAKE_INSTALL_PREFIX="/usr" \
             -DTESTING=ON \
             -DVERBOSE_CONFIGURE=ON \
@@ -155,6 +162,7 @@ jobs:
 
       - name: Package AppImage
         run: |
+          rm -f "${{ runner.workspace }}/Qt/${{ matrix.qt_version }}/gcc_64/plugins/sqldrivers/libqsqlmimer.so"
           ./linuxdeploy-x86_64.AppImage --appdir qbittorrent --plugin qt
           rm qbittorrent/apprun-hooks/*
           cp .github/workflows/helper/appimage/export_vars.sh qbittorrent/apprun-hooks/export_vars.sh

.github/workflows/ci_webui.yaml

@@ -2,8 +2,7 @@ name: CI - WebUI
 
 on: [pull_request, push]
 
-permissions:
-  security-events: write
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -13,6 +12,8 @@ jobs:
   ci:
     name: Check
     runs-on: ubuntu-latest
+    permissions:
+      security-events: write
 
     defaults:
       run:
@@ -20,29 +21,43 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Setup nodejs
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v5
         with:
           node-version: 'lts/*'
 
       - name: Install tools
-        run: npm install
+        run: |
+          npm install
+          npm ls
+          echo "::group::npm ls --all"
+          npm ls --all
+          echo "::endgroup::"
+
+      - name: Run tests
+        run: npm test
 
       - name: Lint code
+        if: ${{ !cancelled() }}
         run: npm run lint
 
       - name: Format code
+        if: ${{ !cancelled() }}
         run: |
           npm run format
           git diff --exit-code
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v3
+        if: ${{ !cancelled() }}
         with:
           config-file: .github/workflows/helper/codeql/js.yaml
           languages: javascript
 
       - name: Run CodeQL analysis
+        if: ${{ !cancelled() }}
         uses: github/codeql-action/analyze@v3

.github/workflows/ci_windows.yaml

@@ -2,8 +2,7 @@ name: CI - Windows
 
 on: [pull_request, push]
 
-permissions:
-  actions: write
+permissions: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
@@ -13,11 +12,13 @@ jobs:
   ci:
     name: Build
     runs-on: windows-latest
+    permissions:
+      actions: write
 
     strategy:
       fail-fast: false
       matrix:
-        libt_version: ["2.0.10", "1.2.19"]
+        libt_version: ["2.0.11", "1.2.20"]
 
     env:
       boost_path: "${{ github.workspace }}/../boost"
@@ -26,7 +27,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Setup devcmd
         uses: ilammy/msvc-dev-cmd@v1
@@ -42,7 +45,7 @@ jobs:
 
       # https://learn.microsoft.com/en-us/vcpkg/users/binarycaching#gha
       - name: Set variables for vcpkg
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             core.exportVariable('ACTIONS_CACHE_URL', (process.env.ACTIONS_CACHE_URL || ''));
@@ -64,6 +67,7 @@ jobs:
               "set(VCPKG_BUILD_TYPE release)")
           # clear buildtrees after each package installation to reduce disk space requirements
           $packages = `
+            "boost-build:x64-windows-static-md-release",
             "openssl:x64-windows-static-md-release",
             "zlib:x64-windows-static-md-release"
           ${{ env.vcpkg_path }}/vcpkg.exe upgrade `
@@ -78,10 +82,10 @@ jobs:
       - name: Install boost
         env:
           BOOST_MAJOR_VERSION: "1"
-          BOOST_MINOR_VERSION: "85"
+          BOOST_MINOR_VERSION: "86"
           BOOST_PATCH_VERSION: "0"
         run: |
-          $boost_url="https://boostorg.jfrog.io/artifactory/main/release/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/source/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
+          $boost_url="https://archives.boost.io/release/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/source/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
           $boost_url2="https://sourceforge.net/projects/boost/files/boost/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
           curl -L -o "${{ runner.temp }}/boost.tar.gz" "$boost_url"
           tar -xf "${{ runner.temp }}/boost.tar.gz" -C "${{ github.workspace }}/.."
@@ -91,11 +95,19 @@ jobs:
             tar -xf "${{ runner.temp }}/boost.tar.gz" -C "${{ github.workspace }}/.."
           }
           move "${{ github.workspace }}/../boost_*" "${{ env.boost_path }}"
+          cd "${{ env.boost_path }}"
+          #.\bootstrap.bat
+          ${{ env.vcpkg_path }}/installed/x64-windows-static-md-release/tools/boost-build/b2.exe `
+            stage `
+            toolset=msvc `
+            --stagedir=.\ `
+            --with-headers
 
       - name: Install Qt
         uses: jurplel/install-qt-action@v4
         with:
-          version: "6.7.3"
+          version: "6.9.1"
+          arch: win64_msvc2022_64
           archives: qtbase qtsvg qttools
           cache: true
 
@@ -109,15 +121,16 @@ jobs:
             ${{ env.libtorrent_path }}
           cd ${{ env.libtorrent_path }}
           $env:CXXFLAGS+=" /guard:cf"
-          $env:LDFLAGS+=" /guard:cf"
+          $env:LDFLAGS+=" /GUARD:CF"
           cmake `
             -B build `
             -G "Ninja" `
             -DCMAKE_BUILD_TYPE=RelWithDebInfo `
+            -DCMAKE_CXX_STANDARD=20 `
             -DCMAKE_EXPORT_COMPILE_COMMANDS=ON `
             -DCMAKE_INSTALL_PREFIX="${{ env.libtorrent_path }}/install" `
             -DCMAKE_TOOLCHAIN_FILE="${{ env.vcpkg_path }}/scripts/buildsystems/vcpkg.cmake" `
-            -DBOOST_ROOT="${{ env.boost_path }}" `
+            -DBOOST_ROOT="${{ env.boost_path }}/lib/cmake" `
             -DBUILD_SHARED_LIBS=OFF `
             -Ddeprecated-functions=OFF `
             -Dstatic_runtime=OFF `
@@ -127,14 +140,14 @@ jobs:
 
       - name: Build qBittorrent
         run: |
-          $env:CXXFLAGS+=" /WX"
+          $env:CXXFLAGS+="/DQT_FORCE_ASSERTS /WX"
           cmake `
             -B build `
             -G "Ninja" `
             -DCMAKE_BUILD_TYPE=RelWithDebInfo `
             -DCMAKE_EXPORT_COMPILE_COMMANDS=ON `
             -DCMAKE_TOOLCHAIN_FILE="${{ env.vcpkg_path }}/scripts/buildsystems/vcpkg.cmake" `
-            -DBOOST_ROOT="${{ env.boost_path }}" `
+            -DBOOST_ROOT="${{ env.boost_path }}/lib/cmake" `
             -DLibtorrentRasterbar_DIR="${{ env.libtorrent_path }}/install/lib/cmake/LibtorrentRasterbar" `
             -DMSVC_RUNTIME_DYNAMIC=ON `
             -DTESTING=ON `
@@ -186,6 +199,11 @@ jobs:
           name: qBittorrent-CI_Windows-x64_libtorrent-${{ matrix.libt_version }}
           path: upload
 
+      - name: Install NSIS
+        uses: repolevedavaj/install-nsis@265e893c16602d8ccfb0a9ca44173b084078917c # v1.0.3
+        with:
+          nsis-version: '3.11'
+
       - name: Create installer
         run: |
           7z x -o"dist/windows/" "dist/windows/NSISPlugins.zip"

.github/workflows/coverity-scan.yaml

@@ -14,9 +14,9 @@ jobs:
 
     strategy:
       matrix:
-        libt_version: ["2.0.10"]
+        libt_version: ["2.0.11"]
         qbt_gui: ["GUI=ON"]
-        qt_version: ["6.5.2"]
+        qt_version: ["6.9.1"]
 
     env:
       boost_path: "${{ github.workspace }}/../boost"
@@ -25,7 +25,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: |
@@ -37,10 +39,10 @@ jobs:
       - name: Install boost
         env:
           BOOST_MAJOR_VERSION: "1"
-          BOOST_MINOR_VERSION: "85"
+          BOOST_MINOR_VERSION: "88"
           BOOST_PATCH_VERSION: "0"
         run: |
-          boost_url="https://boostorg.jfrog.io/artifactory/main/release/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/source/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
+          boost_url="https://archives.boost.io/release/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/source/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
           boost_url2="https://sourceforge.net/projects/boost/files/boost/${{ env.BOOST_MAJOR_VERSION }}.${{ env.BOOST_MINOR_VERSION }}.${{ env.BOOST_PATCH_VERSION }}/boost_${{ env.BOOST_MAJOR_VERSION }}_${{ env.BOOST_MINOR_VERSION }}_${{ env.BOOST_PATCH_VERSION }}.tar.gz"
           set +e
           curl -L -o "${{ runner.temp }}/boost.tar.gz" "$boost_url"
@@ -50,6 +52,9 @@ jobs:
             tar -xf "${{ runner.temp }}/boost.tar.gz" -C "${{ github.workspace }}/.."; _exitCode="$?"
           fi
           mv "${{ github.workspace }}/.."/boost_* "${{ env.boost_path }}"
+          cd "${{ env.boost_path }}"
+          ./bootstrap.sh
+          ./b2 stage --stagedir=./ --with-headers
 
       - name: Install Qt
         uses: jurplel/install-qt-action@v4
@@ -71,7 +76,8 @@ jobs:
             -B build \
             -G "Ninja" \
             -DCMAKE_BUILD_TYPE=RelWithDebInfo \
-            -DBOOST_ROOT="${{ env.boost_path }}" \
+            -DCMAKE_CXX_STANDARD=20 \
+            -DBOOST_ROOT="${{ env.boost_path }}/lib/cmake" \
             -Ddeprecated-functions=OFF
           cmake --build build
           sudo cmake --install build
@@ -95,7 +101,7 @@ jobs:
             -B build \
             -G "Ninja" \
             -DCMAKE_BUILD_TYPE=RelWithDebInfo \
-            -DBOOST_ROOT="${{ env.boost_path }}" \
+            -DBOOST_ROOT="${{ env.boost_path }}/lib/cmake" \
             -DVERBOSE_CONFIGURE=ON \
             -D${{ matrix.qbt_gui }}
           PATH="${{ env.coverity_path }}/bin:$PATH" \

.github/workflows/helper/pre-commit/.typos.toml

@@ -16,3 +16,5 @@ ths = "ths"
 [default.extend-words]
 BA = "BA"
 helo = "helo"
+Pn = "Pn"
+UIU = "UIU"

.github/workflows/helper/pre-commit/check_grid_items_order.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python3
+
+# A pre-commit hook for checking items order in grid layouts
+# Copyright (C) 2024  Mike Tzou (Chocobo1)
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# In addition, as a special exception, the copyright holders give permission to
+# link this program with the OpenSSL project's "OpenSSL" library (or with
+# modified versions of it that use the same license as the "OpenSSL" library),
+# and distribute the linked executables. You must obey the GNU General Public
+# License in all respects for all of the code used other than "OpenSSL".  If you
+# modify file(s), you may extend this exception to your version of the file(s),
+# but you are not obligated to do so. If you do not wish to do so, delete this
+# exception statement from your version.
+
+import argparse
+import re
+import sys
+import xml.etree.ElementTree as ElementTree
+from collections.abc import Callable, Sequence
+from typing import Optional
+
+
+def traversePostOrder(root: ElementTree.Element, visitFunc: Callable[[ElementTree.Element], None]) -> None:
+    stack = [(root, False)]
+
+    while len(stack) > 0:
+        (element, visit) = stack.pop()
+        if visit:
+            visitFunc(element)
+        else:
+            stack.append((element, True))
+            stack.extend((child, False) for child in reversed(element))
+
+
+def modifyElement(element: ElementTree.Element) -> None:
+    def getSortKey(e: ElementTree.Element) -> tuple[int, int]:
+        if e.tag == 'item':
+            return (int(e.attrib['row']), int(e.attrib['column']))
+        return (-1, -1)  # don't care
+
+    if element.tag == 'layout' and element.attrib['class'] == 'QGridLayout' and len(element) > 0:
+        element[:] = sorted(element, key=getSortKey)
+
+    # workaround_2a: ElementTree will unescape `"` and we need to escape it back
+    if element.tag == 'string' and element.text is not None:
+        element.text = element.text.replace('"', '"')
+
+
+def main(argv: Optional[Sequence[str]] = None) -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument('filenames', nargs='*', help='Filenames to check')
+    args = parser.parse_args(argv)
+
+    for filename in args.filenames:
+        with open(filename, 'r+') as f:
+            orig = f.read()
+            root = ElementTree.fromstring(orig)
+            traversePostOrder(root, modifyElement)
+            ElementTree.indent(root, ' ')
+
+            # workaround_1: cannot use `xml_declaration=True` since it uses single quotes instead of Qt preferred double quotes
+            ret = f'<?xml version="1.0" encoding="UTF-8"?>\n{ElementTree.tostring(root, 'unicode')}\n'
+
+            # workaround_2b: ElementTree will turn `&quot;` into `&amp;quot;`, so revert it back
+            ret = ret.replace('&amp;quot;', '&quot;')
+
+            # workaround_3: Qt prefers no whitespaces in self-closing tags
+            ret = re.sub('<(.+) +/>', r'<\1/>', ret)
+
+            if ret != orig:
+                print(f'Tip: run this script to apply the fix: `python {__file__} {filename}`', file=sys.stderr)
+
+                f.seek(0)
+                f.write(ret)
+                f.truncate()
+
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

.github/workflows/helper/pre-commit/check_translation_tag.py

@@ -26,9 +26,11 @@
 # but you are not obligated to do so. If you do not wish to do so, delete this
 # exception statement from your version.
 
-from typing import Optional, Sequence
 import argparse
 import re
+import sys
+from collections.abc import Sequence
+from typing import Optional
 
 
 def main(argv: Optional[Sequence[str]] = None) -> int:
@@ -67,4 +69,4 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
 
 
 if __name__ == '__main__':
-    exit(main())
+    sys.exit(main())

.github/workflows/stale_bot.yaml

@@ -4,15 +4,16 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   stale:
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - name: Mark and close stale PRs
-        uses: actions/stale@v9
+        uses: actions/stale@v10
         with:
           stale-pr-message: "This PR is stale because it has been 60 days with no activity. This PR will be automatically closed within 7 days if there is no further activity."
           close-pr-message: "This PR was closed because it has been stalled for some time with no activity."

.gitignore

@@ -1,4 +1,5 @@
 .vscode/
+
 src/gui/geoip/GeoIP.dat
 src/gui/geoip/GeoIP.dat.gz
 src/qbittorrent
@@ -10,7 +11,6 @@ CMakeLists.txt.user*
 qbittorrent.pro.user*
 conf.pri
 Makefile*
-*.pyc
 *.log
 
 # Compiled object files
@@ -41,7 +41,3 @@ src/icons/skin/build-icons/icons/*.png
 
 # CMake build directory
 build/
-
-# Web UI tools
-node_modules
-package-lock.json

.pre-commit-config.yaml

@@ -1,6 +1,12 @@
 repos:
   - repo: local
     hooks:
+      - id: check-grid-order
+        name: Check items order in grid layouts
+        entry: .github/workflows/helper/pre-commit/check_grid_items_order.py
+        language: script
+        files: \.ui$
+
       - id: check-translation-tag
         name: Check newline characters in <translation> tag
         entry: .github/workflows/helper/pre-commit/check_translation_tag.py
@@ -13,7 +19,7 @@ repos:
           - ts
 
   - repo: https://github.com/pre-commit/pre-commit-hooks.git
-    rev: v4.5.0
+    rev: v6.0.0
     hooks:
     - id: check-json
       name: Check JSON files
@@ -63,19 +69,17 @@ repos:
         - ts
 
   - repo: https://github.com/codespell-project/codespell.git
-    rev: v2.2.6
+    rev: v2.4.1
     hooks:
     - id: codespell
       name: Check spelling (codespell)
-      args: ["--ignore-words-list", "additionals,curren,fo,ist,ket,searchin,superseeding,te,ths"]
+      args: ["--ignore-words-list", "additionals,categor,curren,fo,indexIn,ist,ket,notin,searchin,sectionin,superseeding,te,ths"]
       exclude: |
         (?x)^(
           .*\.desktop |
           .*\.qrc |
-          build-aux/.* |
           Changelog |
           dist/windows/installer-translations/.* |
-          m4/.* |
           src/base/3rdparty/.* |
           src/searchengine/nova3/socks.py |
           src/webui/www/private/scripts/lib/.*
@@ -84,7 +88,7 @@ repos:
         - ts
 
   - repo: https://github.com/crate-ci/typos.git
-    rev: v1.16.18
+    rev: v1.35.3
     hooks:
     - id: typos
       name: Check spelling (typos)
@@ -95,11 +99,8 @@ repos:
           .*\.desktop |
           .*\.qrc |
           \.pre-commit-config\.yaml |
-          build-aux/.* |
           Changelog |
-          configure.* |
           dist/windows/installer-translations/.* |
-          m4/.* |
           src/base/3rdparty/.* |
           src/searchengine/nova3/socks.py |
           src/webui/www/private/scripts/lib/.*

.tx/config

@@ -1,7 +1,7 @@
 [main]
 host = https://www.transifex.com
 
-[o:sledgehammer999:p:qbittorrent:r:qbittorrent_v50x]
+[o:sledgehammer999:p:qbittorrent:r:qbittorrent_master]
 file_filter  = src/lang/qbittorrent_<lang>.ts
 source_file  = src/lang/qbittorrent_en.ts
 source_lang  = en
@@ -9,7 +9,7 @@ type         = QT
 minimum_perc = 23
 lang_map     = pt: pt_PT, zh: zh_CN
 
-[o:sledgehammer999:p:qbittorrent:r:qbittorrent_webui_v50x]
+[o:sledgehammer999:p:qbittorrent:r:qbittorrent_webui]
 file_filter  = src/webui/www/translations/webui_<lang>.ts
 source_file  = src/webui/www/translations/webui_en.ts
 source_lang  = en

CMakeLists.txt

@@ -8,7 +8,7 @@ project(qBittorrent
 
 # version requirements - older versions may work, but you are on your own
 set(minBoostVersion 1.76)
-set(minQt6Version 6.5.0)
+set(minQt6Version 6.6.0)
 set(minOpenSSLVersion 3.0.2)
 set(minLibtorrent1Version 1.2.19)
 set(minLibtorrentVersion 2.0.10)

COPYING.GPLv2

@@ -2,7 +2,7 @@
                        Version 2, June 1991
 
  Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
- 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
@@ -304,8 +304,7 @@ the "copyright" line and a pointer to where the full notice is found.
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License along
-    with this program; if not, write to the Free Software Foundation, Inc.,
-    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+    with this program; if not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
@@ -329,8 +328,8 @@ necessary.  Here is a sample; alter the names:
   Yoyodyne, Inc., hereby disclaims all copyright interest in the program
   `Gnomovision' (which makes passes at compilers) written by James Hacker.
 
-  <signature of Ty Coon>, 1 April 1989
-  Ty Coon, President of Vice
+  <signature of Moe Ghoul>, 1 April 1989
+  Moe Ghoul, President of Vice
 
 This General Public License does not permit incorporating your program into
 proprietary programs.  If your program is a subroutine library, you may

Changelog

@@ -1,45 +1,4 @@
-Sun Apr 13th 2025 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v5.0.5
-    - FEATURE: Add an advanced setting for setting the "Add New Torrent" dialog as modal (glassez)
-    - BUGFIX: Improve command line parameters serialization (glassez)
-    - BUGFIX: Declare missing color IDs for theming (glassez)
-    - WINDOWS: NSIS: Update Swedish translation (Daniel Nylander)
-
-Tue Feb 18th 2025 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v5.0.4
-    - BUGFIX: Fix cannot remove trackers via WebAPI (Chocobo1)
-    - BUGFIX: Fix torrent content checkbox state under certain conditions (thalieht)
-    - BUGFIX: Hide zero and infinity values in peer list only when that setting is set to `Always` (thalieht)
-    - BUGFIX: Remove stopped torrent from "error" tracker filter (glassez)
-    - WEBUI: Fix memory leak in context menus (skomerko)
-    - WEBAPI: Don't trim string parameters (glassez)
-    - WINDOWS: Handle Qt style options uniformly (glassez)
-    - WINDOWS: NSIS: Update Portuguese translation (Hugo Carvalho)
-    - MACOS: Avoid memory leak (Chocobo1)
-
-Mon Dec 16th 2024 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v5.0.3
-    - BUGFIX: Discard obsolete "state update" events after torrent is reloaded (glassez)
-    - BUGFIX: Fix incorrect SQL column definition (glassez)
-    - BUGFIX: Avoid redundant requests of announce entries from libtorrent (glassez)
-    - WEBUI: Fix removing tracker URL with '|' character (Thomas Piccirello)
-    - WEBUI: Fix reloading page after login (Evgenii Ryshkov)
-    - WEBAPI: Fix incorrect key in torrent creator (Bartu Özen)
-    - RSS: Don't add duplicate episodes to previously matched (wavygecko)
-    - RSS: Use cached current time when parsing RSS feed (glassez)
-    - WINDOWS: Don't follow symlink when creating torrents on Windows (Chocobo1)
-    - WINDOWS: NSIS: Update Italian translation (Giacomo411)
-
-Sun Nov 17th 2024 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v5.0.2
-    - BUGFIX: Remove trackers from previous category when moved to new one (glassez)
-    - BUGFIX: Fix `.torrent` file could not be deleted when torrent is canceled (glassez)
-    - BUGFIX: Reset tracker entries when pausing the session (glassez)
-    - BUGFIX: Check real palette darkness to detect "dark theme" (glassez)
-    - BUGFIX: Correctly handle "torrent finished" events (glassez)
-    - BUGFIX: Preserve initial torrent progress while checking resume data (glassez)
-    - BUGFIX: Avoid reapplying Mark-of-the-Web when it already exists (Chocobo1)
-    - BUGFIX: Don't apply Mark-of-the-Web on existing files (Chocobo1)
-    - WEBUI: Add color scheme switcher (sledgehammer999)
-    - SEARCH: Correctly delete the moved search tab (glassez)
-    - WINDOWS: Correctly save and restore Qt style setting (glassez)
-    - WINDOWS: NSIS: update Luxembourgish, Simplified Chinese and Traditional Chinese translations (Ikko Eltociear Ashimine, 3gf8jv4dv)
+Unreleased - sledgehammer999 <sledgehammer999@qbittorrent.org> - v5.1.0
 
 Mon Oct 28th 2024 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v5.0.1
     - FEATURE: Add "Simple pread/pwrite" disk IO type (Hanabishi)
@@ -147,6 +106,42 @@ Sun Sep 29th 2024 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v5.0.0
     - OTHER: Minimum supported versions: Qt: 6.5, Boost: 1.76, OpenSSL: 3.0.2
     - OTHER: Switch to C++20
 
+Mon Sep 16th 2024 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v4.6.7
+    - BUGFIX: The updater will launch the link to the build variant you're currently using (sledgehammer999)
+    - BUGFIX: Focus on Download button if torrent link retrieved from the clipboard (glassez)
+    - WEBUI: RSS: The list of feeds wouldn't load for Apply Rule (glassez)
+
+Sun Aug 18th 2024 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v4.6.6
+    - BUGFIX: Fix handling of tags containing '&' character (glassez)
+    - BUGFIX: Show scroll bar in Torrent Tags dialog (glassez)
+    - BUGFIX: Apply bulk changes to correct content widget items (glassez)
+    - BUGFIX: Hide zero status filters when torrents are removed (glassez)
+    - BUGFIX: Fix `Incomplete Save Path` cannot be changed for torrents without metadata (glassez)
+    - WEBUI: Correctly apply changed "save path" of RSS rules (glassez)
+    - WEBUI: Clear tracker list on full update (skomerko)
+    - OTHER: Update User-Agent string for internal downloader and search engines (cayenne17)
+
+Sun May 26th 2024 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v4.6.5
+    - BUGFIX: Prevent app from being closed when disabling system tray icon (glassez)
+    - BUGFIX: Fix <kbd>Enter</kbd> key behavior in Add new torrent dialog (glassez)
+    - BUGFIX: Prevent invalid status filter index from being used (glassez)
+    - BUGFIX: Add extra offset for dialog frame (glassez)
+    - BUGFIX: Don't overwrite stored layout of main window with incorrect one (glassez)
+    - BUGFIX: Don't forget to resume "missing files" torrent when rechecking (glassez)
+    - WEBUI: Restore ability to use server-side translation by custom WebUI (glassez)
+    - WEBUI: Fix wrong peer number (Chocobo1)
+    - LINUX: Improve AppStream metadata (Chocobo1)
+
+Sun Mar 24th 2024 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v4.6.4
+    - BUGFIX: Correctly adjust "Add New torrent" dialog position in all the cases (glassez)
+    - BUGFIX: Change "metadata received" stop condition behavior (glassez)
+    - BUGFIX: Add a small delay before processing the key input of search boxes (Chocobo1)
+    - BUGFIX: Ensure the profile path is pointing to a directory (Chocobo1)
+    - RSS: Use better icons for RSS articles (glassez)
+    - WINDOWS: NSIS: Update French, Hungarian translations (MarcDrieu, foxi69)
+    - LINUX: Fix sorting when ICU isn't used (Chocobo1)
+    - LINUX: Fix invisible tray icon on Plasma 6 (tehcneko)
+
 Mon Jan 15th 2024 - sledgehammer999 <sledgehammer999@qbittorrent.org> - v4.6.3
     - BUGFIX: Correctly update number of filtered items (glassez)
     - BUGFIX: Don't forget to store Stop condition value (glassez)

INSTALL

@@ -11,14 +11,14 @@ qBittorrent - A BitTorrent client in C++ / Qt
 
   - OpenSSL >= 3.0.2
 
-  - Qt 6.5.0 - 6.x
+  - Qt 6.6.0 - 6.x
 
   - zlib >= 1.2.11
 
   - CMake >= 3.16
       * Compile-time only
 
-  - Python >= 3.7.0
+  - Python >= 3.9.0
       * Optional, run-time only
       * Used by the bundled search engine
 

SECURITY.md

@@ -0,0 +1,18 @@
+# Security Policy
+
+qBittorrent takes the security of our software seriously, including all source code repositories managed through our GitHub organisation.
+If you believe you have found a security vulnerability in qBittorrent, please report it to us as described below.
+
+## Reporting Security Issues
+
+Please do not report security vulnerabilities through public GitHub issues. Instead, please use GitHubs private vulnerability reporting functionality associated to this repository. Additionally, you may email us with all security-related inquiries and notifications at `security@qbittorrent.org`.
+
+Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
+1. Type of issue
+2. Step-by-step instructions to reproduce the issue
+3. Proof-of-concept or exploit code (if possible)
+4. Potential impact of the issue, including how an attacker might exploit the issue
+
+This information will help us triage your report more quickly. Any and all CVEs will be requested and issued through GitHubs private vulnerability reporting functionality, which will be published alongside the disclosure.
+
+This security policy only applies to the most recent stable branch of qBittorrent. Flaws in old versions that are not present in the current stable branch will not be fixed.

WebAPI_Changelog.md

@@ -0,0 +1,92 @@
+# WebAPI Changelog
+
+## 2.14.1
+* [#23212](https://github.com/qbittorrent/qBittorrent/pull/23212)
+  * Add `app/rotateAPIKey` endpoint for generating, and rotating, the WebAPI API key
+
+## 2.14.0
+* [#23202](https://github.com/qbittorrent/qBittorrent/pull/23202)
+  * WebAPI responds with the error message "Endpoint does not exist" when the endpoint does not exist, to better differentiate from unrelated Not Found (i.e. 404) responses
+  * `auth/login` endpoint responds to invalid credentials with a 401
+  * `torrents/add` endpoint responds with `success_count`, `pending_count`, `failure_count`, and `added_torrent_ids`
+    * When `pending_count` is non-zero, response code 202 is used
+    * When all torrents fail to be added, response code 409 is used
+
+## 2.13.1
+* [#23163](https://github.com/qbittorrent/qBittorrent/pull/23163)
+  * `torrents/add` endpoint now supports downloading from a search plugin via the `downloader` parameter
+  * `torrents/fetchMetadata` endpoint now supports fetching from a search plugin via the `downloader` parameter
+* [#23088](https://github.com/qbittorrent/qBittorrent/pull/23088)
+  * Add `clientdata/load` and `clientdata/store` endpoints for managing WebUI-specific client settings and other shared data
+
+## 2.13.0
+* [#23045](https://github.com/qbittorrent/qBittorrent/pull/23045)
+  * `torrents/trackers` returns three new fields: `next_announce`, `min_announce` and `endpoints`
+    * `endpoints` is an array of tracker endpoints, each with `name`, `updating`, `status`, `msg`, `bt_version`, `num_peers`, `num_peers`, `num_leeches`, `num_downloaded`, `next_announce` and `min_announce` fields
+  *  `torrents/trackers` now returns `5` and `6` in `status` field as possible values
+    * `5` for `Tracker error` and `6` for `Unreachable`
+* [#22963](https://github.com/qbittorrent/qBittorrent/pull/22963)
+  * `torrents/editTracker` endpoint now supports setting a tracker's tier via `tier` parameter
+  * `torrents/editTracker` endpoint always responds with a 204 when successful
+  * `torrents/editTracker` endpoint `origUrl` parameter renamed to `url`
+* [#23061](https://github.com/qbittorrent/qBittorrent/pull/23061)
+  * `sync/torrentPeers` returns one new field: `i2p_dest`, only when the peer is from I2P
+    * In this case, the fields `ip` and `port` are not returned
+* [#23085](https://github.com/qbittorrent/qBittorrent/pull/23085)
+  * `torrents/parseMetadata` now responds with an array of metadata in the same order as the files in the request. It previously responded with an object keyed off of the submitted file name.
+
+## 2.12.1
+* [#23031](https://github.com/qbittorrent/qBittorrent/pull/23031)
+  * Add `torrents/setComment` endpoint with parameters `hashes` and `comment` for setting a new torrent comment
+
+## 2.12.0
+
+* [#22989](https://github.com/qbittorrent/qBittorrent/pull/22989)
+  * `sync/maindata` returns one new field: `share_limit_action`
+  * `torrents/setShareLimits` now requires a new `shareLimitAction` param that sets a torrent's shareLimitAction property
+    * possible values `Default`, `Stop`, `Remove`, `RemoveWithContent` and `EnableSuperSeeding`
+
+## 2.11.10
+
+* [#22958](https://github.com/qbittorrent/qBittorrent/pull/22958)
+  * `torrents/categories` and `sync/maindata` now serialize categories' `downloadPath` to `null`, rather than `undefined`
+* [#22954](https://github.com/qbittorrent/qBittorrent/pull/22954)
+  * `torrents/reannounce` supports specifying individual trackers via `trackers` field
+
+## 2.11.9
+
+* [#21015](https://github.com/qbittorrent/qBittorrent/pull/21015)
+  * Add `torrents/fetchMetadata` endpoint for retrieving torrent metadata associated with a URL
+  * Add `torrents/parseMetadata` endpoint for retrieving torrent metadata associated with a .torrent file
+  * Add `torrents/saveMetadata` endpoint for saving retrieved torrent metadata to a .torrent file
+  * `torrents/add` allows adding a torrent with metadata previously retrieved via `torrents/fetchMetadata` or `torrents/parseMetadata`
+  * `torrents/add` allows specifying a torrent's file priorities
+* [#22698](https://github.com/qbittorrent/qBittorrent/pull/22698)
+  * `torrents/addTrackers` and `torrents/removeTrackers` now accept `hash=all` and adds/removes the tracker to/from *all* torrents
+    * For compatibility, `torrents/removeTrackers` still accepts `hash=*` internally we transform it into `all`
+  * Allow passing a pipe (`|`) separated list of hashes in `hash` for `torrents/addTrackers` and `torrents/removeTrackers`
+
+## 2.11.8
+
+* [#21349](https://github.com/qbittorrent/qBittorrent/pull/21349)
+  * Handle sending `204 No Content` status code when response contains no data
+    * Some endpoints still return `200 OK` to ensure smooth transition
+* [#22750](https://github.com/qbittorrent/qBittorrent/pull/22750)
+  * `torrents/info` allows an optional parameter `includeFiles` that defaults to `false`
+    * Each torrent will contain a new key `files` which will list all files similar to the `torrents/files` endpoint
+* [#22813](https://github.com/qbittorrent/qBittorrent/pull/22813)
+  * `app/getDirectoryContent` allows an optional parameter `withMetadata` to send file metadata
+    * Fields are `name`, `type`, `size`, `creation_date`, `last_access_date`, `last_modification_date`
+    * See PR for TypeScript types
+
+## 2.11.7
+
+* [#22166](https://github.com/qbittorrent/qBittorrent/pull/22166)
+  * `sync/maindata` returns 3 new torrent fields: `has_tracker_warning`, `has_tracker_error`, `has_other_announce_error`
+
+## 2.11.6
+
+* [#22460](https://github.com/qbittorrent/qBittorrent/pull/22460)
+  * `app/setPreferences` allows only one of `max_ratio_enabled`, `max_ratio` to be present
+  * `app/setPreferences` allows only one of `max_seeding_time_enabled`, `max_seeding_time` to be present
+  * `app/setPreferences` allows only one of `max_inactive_seeding_time_enabled`, `max_inactive_seeding_time` to be present

cmake/Modules/CheckPackages.cmake

@@ -47,6 +47,9 @@ find_package(Boost ${minBoostVersion} REQUIRED)
 find_package(OpenSSL ${minOpenSSLVersion} REQUIRED)
 find_package(ZLIB ${minZlibVersion} REQUIRED)
 find_package(Qt6 ${minQt6Version} REQUIRED COMPONENTS Core Network Sql Xml LinguistTools)
+if (Qt6_FOUND AND (Qt6_VERSION VERSION_GREATER_EQUAL 6.10))
+    find_package(Qt6 ${minQt6Version} REQUIRED COMPONENTS CorePrivate)
+endif()
 if (DBUS)
     find_package(Qt6 ${minQt6Version} REQUIRED COMPONENTS DBus)
     set_package_properties(Qt6DBus PROPERTIES

cmake/Modules/CommonConfig.cmake

@@ -20,10 +20,11 @@ target_compile_features(qbt_common_cfg INTERFACE
 )
 
 target_compile_definitions(qbt_common_cfg INTERFACE
-    QT_DISABLE_DEPRECATED_UP_TO=0x060500
+    QT_DISABLE_DEPRECATED_UP_TO=0x060600
     QT_NO_CAST_FROM_ASCII
     QT_NO_CAST_TO_ASCII
     QT_NO_CAST_FROM_BYTEARRAY
+    QT_NO_CONTEXTLESS_CONNECT
     QT_NO_NARROWING_CONVERSIONS_IN_CONNECT
     QT_USE_QSTRINGBUILDER
     QT_STRICT_ITERATORS
@@ -89,7 +90,7 @@ if (MSVC)
         /Zc:__cplusplus
     )
     target_link_options(qbt_common_cfg INTERFACE
-        /guard:cf
+        /GUARD:CF
         $<$<NOT:$<CONFIG:Debug>>:/OPT:REF /OPT:ICF>
         # suppress linking warning due to /INCREMENTAL and /OPT:ICF being both ON
         $<$<CONFIG:RelWithDebInfo>:/INCREMENTAL:NO>

dist/mac/Info.plist

@@ -55,7 +55,7 @@
 	<key>CFBundlePackageType</key>
 	<string>APPL</string>
 	<key>CFBundleShortVersionString</key>
-	<string>5.0.5</string>
+	<string>5.2.0</string>
 	<key>CFBundleExecutable</key>
 	<string>${EXECUTABLE_NAME}</string>
 	<key>CFBundleIdentifier</key>

dist/unix/CMakeLists.txt

@@ -34,12 +34,12 @@ endforeach()
 
 if (GUI)
     install(FILES org.qbittorrent.qBittorrent.desktop
-        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/applications/
+        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/applications
         COMPONENT data
     )
 
     install(FILES org.qbittorrent.qBittorrent.metainfo.xml
-        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/metainfo/
+        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/metainfo
         COMPONENT data
     )
 
@@ -55,4 +55,9 @@ if (GUI)
         DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/icons/hicolor/scalable/status
         COMPONENT data
     )
+else()
+    install(FILES org.qbittorrent.qBittorrent-nox.metainfo.xml
+        DESTINATION ${CMAKE_INSTALL_DATAROOTDIR}/metainfo
+        COMPONENT data
+    )
 endif()