fix(seerr): reapply the asset cache-bust reverted by the builder (#2975) (#2997)

Restores #2993 verbatim. It was merged, then reverted by the builder's
revert-on-failure job a minute later - not because of anything in it, but
because EndBug/add-and-commit's floating v11 tag had moved to a release whose
action.yml no longer loads, so prebuild-sanitize failed before running a step.
The tag is pinned back to v11.0.0 in #2996, which has to land first for the
builder to get past that job.

The change itself is unchanged and still verified against the real njs module:
the rewritten /_next paths carry the add-on version, njs strips the marker
before proxying, so a browser holding the year-cached rewritten bundle fetches
fresh URLs on the first load after the update.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

seerr/CHANGELOG.md

@@ -1,3 +1,6 @@
+## 3.4.1.3 (2026-08-18)
+
+- Fixed the `404: Not Found` on **Discover** persisting for browsers that had already opened Seerr through ingress, even after 3.4.1.1 and 3.4.1.2 were installed (#2975). Seerr serves its JavaScript bundle with `Cache-Control: public, max-age=31536000, immutable`, and the add-on's nginx rewrites that bundle to carry the ingress prefix - which strips the `ETag` and `Last-Modified` a browser would revalidate with. Since every add-on version served the same upstream build, the chunk URLs never changed either, so a browser kept replaying the broken 3.4.1/3.4.1.1 JavaScript from its own cache for up to a year and no fix could reach it. That is why the report persisted on the origin the reporter uses daily (`https://<domain>/`) while a browser that had never cached it (`http://<ip>:8123/`) already showed the fixed behaviour. The asset paths now carry the add-on version, so each release has its own URLs and the first page load after an update fetches the current bundle. Only ingress was affected; the directly published port 5055 always worked.
 
 ## 3.4.1.2 (2026-08-18)
 

seerr/config.yaml

@@ -96,4 +96,4 @@ schema:
 slug: seerr
 udev: true
 url: https://github.com/alexbelgium/hassio-addons/tree/master/seerr
-version: "3.4.1.2"
+version: "3.4.1.3"

seerr/rootfs/etc/cont-init.d/32-nginx_ingress.sh

@@ -12,10 +12,27 @@ ingress_port=$(bashio::addon.ingress_port)
 ingress_interface=$(bashio::addon.ip_address)
 ingress_entry=$(bashio::addon.ingress_entry)
 
+# Cache-busting marker for the rewritten JavaScript bundle.
+#
+# Seerr serves /_next/static/ as "public, max-age=31536000, immutable", and
+# nginx's sub_filter strips ETag and Last-Modified off every response it
+# rewrites, while the HTML naming those chunks is served "no-store" and keeps
+# naming the same URLs. A browser therefore pins the bundle this add-on rewrote
+# on its first visit for a year, with no request left that could deliver a
+# later change to the sub_filter rules below - which is how #2975 outlived two
+# fixes. Folding the version into the asset path gives every release its own
+# URLs. njs/ingress.js strips the marker again before proxying.
+#
+# BUILD_VERSION is the add-on version baked in at build time (it is also what
+# bashio::addon.version returns). Only [A-Za-z0-9-] survives: the marker ends up
+# inside a regex literal in Seerr's own bundle, where a dot would be a wildcard.
+asset_tag="ha-$(printf '%s' "${BUILD_VERSION:-0}" | tr -c 'A-Za-z0-9' '-')"
+
 # Update ingress.conf with actual values
 sed -i "s|%%port%%|${ingress_port}|g" /etc/nginx/servers/ingress.conf
 sed -i "s|%%interface%%|${ingress_interface}|g" /etc/nginx/servers/ingress.conf
 sed -i "s|%%ingress_entry%%|${ingress_entry}|g" /etc/nginx/servers/ingress.conf
 sed -i "s|%%ingress_entry_escaped%%|${ingress_entry//\//\\\\\/}|g" /etc/nginx/servers/ingress.conf
+sed -i "s|%%asset_tag%%|${asset_tag}|g" /etc/nginx/servers/ingress.conf
 
-bashio::log.info "Nginx ingress configured on ${ingress_interface}:${ingress_port}"
+bashio::log.info "Nginx ingress configured on ${ingress_interface}:${ingress_port} (asset tag ${asset_tag})"

seerr/rootfs/etc/nginx/njs/ingress.js

@@ -47,11 +47,27 @@ function encodePart(part) {
 }
 
 /*
- * Returns the request URI with the path untouched byte-for-byte and only the
+ * The cache-busting marker servers/ingress.conf inserts in front of every
- * query string repaired. Used as the proxy_pass target.
+ * rewritten "/_next" path, e.g. "/ha-3-4-1-3/_next/static/chunks/x.js". It
+ * gives each add-on release its own asset URLs - Seerr serves /_next/static/ as
+ * immutable for a year and sub_filter strips the validators, so identical URLs
+ * would pin the rewritten bundle in the browser forever. Seerr knows nothing
+ * about the marker, so it is removed again here, on the way in.
+ *
+ * Any marker is accepted, not just the one this container serves: a tab opened
+ * before an add-on update keeps requesting its dynamic chunks under the marker
+ * it was handed, and those have to keep working until it is reloaded. The
+ * lookahead keeps a real Seerr path that merely starts with "ha-" untouched.
+ */
+var ASSET_TAG = /^\/ha-[0-9A-Za-z-]+(?=\/_next(\/|$))/;
+
+/*
+ * Returns the request URI with the path untouched byte-for-byte apart from the
+ * cache-busting marker, and only the query string repaired. Used as the
+ * proxy_pass target.
  */
 function uri(r) {
-    var raw = r.variables.request_uri;
+    var raw = r.variables.request_uri.replace(ASSET_TAG, "");
     var split = raw.indexOf("?");
 
     if (split < 0) {

seerr/rootfs/etc/nginx/servers/ingress.conf

@@ -77,8 +77,14 @@ server {
         # because the compiled output spells the prop 'href:"/"' and not
         # 'href="/"'. These are textual substitutions over someone else's minified
         # output: recheck them whenever Seerr or Next.js is upgraded.
-        sub_filter '\/_next' '%%ingress_entry_escaped%%\/_next';
+        # "%%asset_tag%%" is a cache-busting marker carrying the add-on version,
-        sub_filter '/_next' '$app/_next';
+        # substituted by 32-nginx_ingress.sh - which explains why it is needed.
+        # In short: without it a browser replays the bundle this file produced at
+        # the version it first loaded, for a year, and no later change to any
+        # rule here can reach it. njs/ingress.js strips the marker back off
+        # before proxying; the two belong together, do not change one alone.
+        sub_filter '\/_next' '%%ingress_entry_escaped%%\/%%asset_tag%%\/_next';
+        sub_filter '/_next' '$app/%%asset_tag%%/_next';
         sub_filter '/api/v1' '$app/api/v1';
         sub_filter '/login/plex/loading' '$app/login/plex/loading';
         sub_filter '/images/' '$app/images/';