audiobookshelf Release Notes

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Debian install EACCES error #5613
• Clean up abandoned OIDC mobile login sessions #5604 by @SharonZhu0122 in #5606

Updated

• OIDC callback cookie expiration extended to 10 minutes & redirect to login when expired #5614
• More strings translated
  • Estonian by @lupusaesticus
  • Lithuanian by @Haya25
  • Portuguese (Brazil) by @AgenteGabrielofc

Full Changelog: https://github.com/advplyr/audiobookshelf/compare/v2.37.0...v2.37.1

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Important: Node.js version updated to 24

Added

• API keys can authenticate websocket connections by @Vito0912 in #4974

Fixed

• Server crash decoding invalid filter groups
• Server crash when collapsing sub-series and sorting by author name #4993
• Get series for library endpoint not checking the series belongs to that library

Updated

• Audible match results now set the explicit flag #5535 by @SharonZhu0122 in #5575
• Server, Docker image, and build scripts now use Node.js 24 by @nichwall in #5578
• API: Library item cover update requires the cover path to be a file already on that library item
• API: Cover and author image cache endpoints require a valid id and positive width/height by @Vito0912
• More strings translated
  • Czech by @CZDanol
  • Norwegian Bokmål by @Mediokris
  • Spanish by @JnBenites
  • Swedish by Daniel Nylander

Internal

• Initial TypeScript compilation for the server by @nichwall in #5510
• Add ESLint for the server and run it in the unit test workflow in #5578
• Fix ReferenceErrors under strict mode when scanning library directories by @binyaminyblatt in #5586

New Contributors

• @binyaminyblatt made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5586 …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Collapse series not working when filters are enabled #2807 #3049 by @schummar in #5280
• Podcast rescan emitting stale episodes on item_updated by @mikiher in #5409
• Updating or deleting a narrator in one library applying the change to all libraries
• Author endpoints not checking user can access the author's library
• Share endpoints not sending 404 status
• Upload endpoint not handling directory creation errors
• sqlite3 bindings not installing when using npm v12 #5412 by @Vito0912 in #5429

Updated

• Comic book extractor file path sanitization by @Vito0912
• Auth settings PATCH sanitizes authLoginCustomMessage HTML
• API: Settings PATCH endpoint only accepts a fixed set of general settings (auth settings must go through the auth-settings endpoint)
• API: Cover endpoints only allow webp, jpeg and png as optional format param
• API: Library item media update no longer accepts ebookFile, chapters and audioFiles in request body
• More strings translated
  • Belarusian by @pavel-miniutka
  • Bengali by @ShamiaAkterShanta
  • Chinese (Simplified Han script) by @FiendFEARing
  • Chinese (Traditional Han script) by @JBlond @violawang0401-cloud
  • Croatian by Igor Dobrača
  • Czech by @kuci-JK …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Logout all devices button on account page (in #5395)
• Auth sessions table on account page w/ ability to logout of individual sessions (in #5400)

Fixed

• Weak protocol validation for OIDC post-login callback URL by @mikiher in #5386
• User delete endpoint allowing for root account deletion by @mikiher in #5370
• API and websocket authentication allowing refresh tokens by @mikiher in #5387
• Bulk library item download endpoint not checking access on individual items by @mikiher in #5388
• Manual podcast episode match not setting the enclosure url #5317 by @mikiher in #5318

Updated

• Changing user password invalidates all auth sessions (in #5393)
• Extend refresh token grace period to 10 minutes and allow REFRESH_TOKEN_GRACE_PERIOD env variable override #5281 by @DanielAshley in #5376
• API: New GET endpoints /api/me/progress, /api/me/bookmarks, /api/me/bookmarks/:libraryItemId by @Vito0912 in #5363
• API: Add all minified fields to expanded library item JSON by @mikiher in #5341
• API: Server settings now include timeZone for server timezone (for giving accurate cron job next schedule date)
• API: /logout endpoint now supports ?allDevices=1 query param to delete all other sessions and rotate current (in #5395) …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Duplicate refresh tokens across sessions can cause unexpected logout #5253 by @nichwall in #5255
• Server crash when renaming an author to another author when they are both on the same book #5247 by @nichwall in #5256
• Server crash when invalid metadata.json is scanned in #5268
• Sequelize user queries to use direct case-insensitive username/email matching

Full Changelog: https://github.com/advplyr/audiobookshelf/compare/v2.35.0...v2.35.1

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Access token refresh grace period (fixes frequently needing to re-login) #4630 by @nichwall in #5004

Fixed

• Listening sessions from Android app showing device name as Abs iOS
• RSS feeds serving m4b files with incorrect Content-Type #5041 by @brandonfhall in #5221

Changed

• Book & podcast descriptions from audio files are sanitized
• cancel_scan and set_log_listener socket events validate account type and log level
• More strings translated
  • Belarusian by @pavel-miniutka
  • Polish by @TheMatrixan

New Contributors

• @brandonfhall made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5221

Full Changelog: https://github.com/advplyr/audiobookshelf/compare/v2.34.0...v2.35.0

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Japanese language and Japan as podcast search region by @na3shkw in #5211
• Autocomplete attributes on login and setup fields for password manager support by @meek2100 in #5089

Fixed

• Recent episodes not updating from cache when media progress changes in #5159
• Error logging when a podcast's auto-download schedule has an invalid cron expression

Changed

• Public media item shares: use start time passed in query parameter for existing sessions by @pjkottke in #5163
• Podcast episode downloads use SSRF filtering on the HTTP request (matches other external requests)
• Podcast create and update validate the auto-download schedule cron expression and sanitizes the HTML description
• Playlists, collections, and library item batch API routes enforce library and per-item access
• More strings translated
  • Belarusian by @pavel-miniutka
  • Hungarian by @ugyes
  • Japanese by @na3shkw

Internal

• ApiCacheManager test coverage for recent-episodes cache invalidation

New Contributors

• @pjkottke made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5163
• @meek2100 made their first contribution in https://github.com/advplyr/audiobookshelf/pull/5089 …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Matroska audiobooks (.mka) with the Opus codec failing to play in web client by @rktjmp in #5115
• UI/UX: Share player not using libraries cover aspect ratio setting
• Backup uploads leaving temporary files behind when the uploaded file failed validation
• Path traversal check on the filesystem path-exists endpoint not handling all edge cases

Changed

• Bulk download endpoint now ensures all requested items belong to the library being requested
• Backup load and upload now validate the backup details entry exists and is within a reasonable size limit
• Podcast create endpoint validates that the podcast path is inside the selected library folder
• Author and library item cover image endpoints now clamp width/height query params to a maximum of 4096
• Podcast episode subtitles parsed from RSS feeds are now sanitized for HTML
• author_updated/author_added socket events emitted when updating authors in the book details edit modal by @mikiher in #5158
• item_removed socket event payload now includes libraryId so clients can ignore events for other libraries by @mikiher in #5160
• More strings translated
  • Belarusian by @pavel-miniutka
  • Bulgarian by @lembata
  • German by @JBlond @LaurinSorgend
  • Italian by @tizio04 …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• API Keys not respecting user enabled/disabled flag

Changed

• Podcast episode update endpoint sanitizes HTML for subtitle
• Playlist & collection create/update endpoints strip HTML tags from name
• More strings translated
  • Belarusian by @pavel-miniutka
  • German by @fabianjuelich
  • Spanish by @cyphra

Full Changelog: https://github.com/advplyr/audiobookshelf/compare/v2.33.0...v2.33.1

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Slovak language option by @belpe in #5077
• Belarusian language option by @pavel-miniutka in #5071
• Database indexes for discover query performance by @kevingatera in #5073

Fixed

• IDOR vulnerabilities in listening sessions, media progress, and bookmark endpoints #5062 by @mandreko in #5063
• Server crash filtering by decade with collapsed series
• Server crash on /me/progress/:libraryItemId/:episodeId? when episodeId is not passed in for a podcast library item #5058
• Updating author name merging with same name authors in a different library #4628
• Home page check current user from socket event when updating hide from continue listening
• UI/UX: Match tab "click to use current value" incorrect title attribute
• UI/UX: Aria-label for jump backward button by @KiwiHour in #4973

Changed

• Improved personalized shelves performance by parallelizing shelf queries and reducing search payload size by @kevingatera in #5073
• Improved API cache invalidation for high-churn models (sessions, media progress) by @kevingatera in #5073
• Improved subtitle parsing to account for bare colon in title by @kctdfh in #5036
• Sanitize session DeviceInfo clientDeviceInfo fields …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Server crash matching with Audible provider #4931

Updated

• More strings translated
  • Finnish by @pHamala
  • Polish by @MarcinKlejna
  • Russian by @renesat
  • Swedish by @bittin

Full Changelog: https://github.com/advplyr/audiobookshelf/compare/v2.32.0...v2.32.1

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Bulk matching books with multiple of the same new author only applies author to one book by @TN-SKYC in #4766
• Debian package upgrades failing due to user "audiobookshelf" already exists #1617 by @Yetangitu in #4740
• Multi-select inputs allowing duplicate new items by @votex001 in #4649
• Audible & custom metadata providers allowing duplicate genres & tags #4634 (in #4927)

Updated

• API: Metadata match results return tags as an array of strings instead of a comma separated string (in #4927)
• Playlists are sorted alphabetically in playlist modal by @sir-wilhelm in #4906
• More strings translated
  • Arabic by @kfctatertot
  • Bulgarian by @lembata
  • Chinese (Simplified Han script) by @FiendFEARing
  • Finnish by @Napitauki @pHamala
  • German by @JBlond
  • Greek by @lambolighting
  • Hebrew by @mnavon
  • Italian by @66Bunz
  • Korean by @zardkim
  • Polish by @ahetek
  • Portuguese (Brazil) by @ljaksys
  • Slovenian by @thehijacker
  • Spanish by @kfctatertot @xlbrto

New Contributors

• @TN-SKYC made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4766
• @votex001 made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4649 …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Turkish & Korean language option

Fixed

• Chapter editor: Play button is still shown next to chapters with invalid start times #4691
• Switching users does not refresh available libraries #4694
• Admin users unable to close sessions for other users #4746
• Custom metadata providers not showing in library edit modal #3820 by @mikiher in #4750
• HLS transcoding fails for AC3/EAC3 codecs #4798 by @Vito0912 in #4808
• UI/UX: Next/prev buttons not shown on item edit modal when opened using "Files" or "Match" context menu item #4718

Changed

• Increase default access & refresh token expirations. Refresh now 30 days & Access now 1 hour by @Vito0912 in #4756
• Enable OIDC auth auto redirect via query parameter ?autoLaunch=1 on login page by @Yetangitu in #4737
• Improve podcast RSS feed parser to handle feeds not wrapping html in CDATA #4757
• Update "Days in a row" stat to not require today by @jamerst in #4770
• Improved error handling for file system ensureDir by @mikiher in #4881
• UI/UX: Rephrase library watcher setting to "Automatically watch ..." #4095 by @mikiher in #4815
• UI/UX: Uploader shows progress indicator #895 by @Vito0912 in #4702 …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Book cover search includes "Best" option (searches audible, google & fantlab) by @mikiher in #4716

Fixed

• OIDC invalid callback URL (incorrect protocol) #4609 by @Vito0912 in #4635
• MultiSelect causing web client to become unresponsive due to duplicate keys #4634 by @nichwall in #4636
• Podcast episodes being downloaded without an audio stream (in #4664)
• UI/UX: Chapter editor overflowing on smaller screen sizes #4652

Changed

• Book cover search is now async, streams results using websockets by @mikiher in #4716
• Decrease timeout to 10s (from 30s) on all metadata providers by @mikiher in #4716
• UI/UX: Chapter editor does not redirect back after saving changes or deleting all chapters #4650
• More strings translated
  • Arabic by @Salmanegr
  • Chinese (Simplified Han script) by @FiendFEARing
  • Croatian by @biuklija @milotype
  • Czech by @kuci-JK @petr-prikryl @Plazec @Losicek
  • Finnish by @pHamala
  • French by @lolly76
  • German by @Vito0912 @pjope @B0rax
  • Hungarian by @ugyes @Kabika82
  • Norwegian Bokmål by @husjon @PSchaug
  • Persian by @aghorbanmehr
  • Polish by @satanowski @ahetek
  • Portuguese (Brazil) by @jhonthan
  • Romanian by @Hnatiucb @Emdisi00
  • Russian by @GrakovNe @Devastator1979 …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Chapter editor tools/enhancements including bulk chapter import & more (see #4384) by @josh-vin in #4384
• Book library sort options for Progress: Started and Progress: Finished #4540 by @tagmeh in #4575

Fixed

• Initial page load failing to load library (on token refreshes) #4567 (in #4590)
• Library path folder browser not working on latest Windows 11 (replace wmic with powershell) #4531 by @sir-wilhelm in #4533
• Podcast itunes id not set on podcasts created from search and podcast matching #4614
• Book match tab last used provider saved in local storage being overriden by itunes when matching a podcast #4615
• Server listening log for ipv6 host by @renesat in #4595
• UI/UX: Podcast match author input not showing the current author value #4617

Changed

• Podcast episode download requests pass */* in Accept header by @renesat in #4596
• Podcast episode downloads always embed meta tags (previously only mp3) (in #4598)
• Remove unnecessary token from HLS playlist files by @laxandrea in #4608
• UI/UX: Changed book library Progress Updated sort option label to Progress: Last Updated
• UI/UX: Replace SVG icons with material-symbols icon equivalents by @Toby222 in #4552 …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Server setting to allow a whitelist of CORS origins by @Vito0912 in #4557

Fixed

• Server crash when transcode requests are made to the direct play endpoint #4555 (in #4565)
• OIDC auto-register still creating a user when groupclaim is invalid #4563
• OIDC callback URL validation

Changed

• More strings translated
  • Belarusian by @i-Nosferatu-i
  • Chinese (Simplified Han script) by @FiendFEARing
  • Croatian by @biuklija
  • Estonian by @alehandro112
  • French by @ThoDon
  • German by @Vito0912 @numerfolt @LaurinSorgend
  • Hindi by @ashishwadekar
  • Norwegian Bokmål by @Erbros
  • Russian by @NickSkier
  • Ukrainian by @Maksim2005UA2

Full Changelog: https://github.com/advplyr/audiobookshelf/compare/v2.27.0...v2.28.0

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Book library sort option for progress last updated #1215 (in #4542)
• Sepia theme in epub e-reader #4407 by @michaeldvinci in #4534

Fixed

• All e-reader devices visible to non-admin users #4529 (in #4530)
• UI/UX: Edit chapter page lookup modal showing incorrect duration when removing branding by @chriscam85 in #4551
• UI/UX: Cursor pointer for version in side rail by @FelixSche in #4528
• UI/UX: Sessions table overflowing horizontally on mobile

Changed

• UI/UX: Localized user stats heatmap tooltip #4550
• More strings translated
  • Belarusian by @i-Nosferatu-i
  • Chinese (Simplified Han script) by @FiendFEARing
  • Danish by @MikkelOlesen
  • Dutch by @RemcoSchrijver @Pepsicola1995
  • German by @B0rax @Vito0912 @networksecurityvodoo
  • Hebrew by @enosh
  • Hungarian by @ugyes @Kabika82
  • Russian by @GrakovNe
  • Slovenian by @thehijacker
  • Swedish by @Cotignac
  • Ukrainian by @Maksim2005UA2

New Contributors

• @FelixSche made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4528
• @michaeldvinci made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4534
• @chriscam85 made their first contribution in https://github.com/advplyr/audiobookshelf/pull/4551 …

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Some podcast episodes always transcoding (in #4520)
• Unable to change root user password when not set #4522 (in #4523)

Changed

• More strings translated
  • Chinese (Simplified Han script) by @FiendFEARing
  • German by @Dalabad
  • Russian by @Nab0y
  • Ukrainian by @Maksim2005UA2

Full Changelog: https://github.com/advplyr/audiobookshelf/compare/v2.26.2...v2.26.3

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Web client page load causing a token refresh #4509 (in #4510)

Changed

• Audible match results return match confidence score, shows in match results by @mikiher in #4319
• More strings translated
  • Chinese (Simplified Han script) by @springsunx @FiendFEARing
  • Croatian by @biuklija
  • Czech by @kuci-JK
  • Italian by @Prangel85
  • Turkish by @SerhatGulasti
  • Ukrainian by @Maksim2005UA2

Full Changelog: https://github.com/advplyr/audiobookshelf/compare/v2.26.1...v2.26.2

Important: New authentication system was added in v2.26.0. See https://github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• OIDC error when auto registering users #4485 (in #4486)
• ALLOW_CORS env variable not working #4497

Changed

• UI/UX: Localize listening time on sessions table (in #4493)
• UI/UX: Sessions modal shows username instead of user id #4496 (in #4503)
• UI/UX: Show deprecated warning message on legacy API token on user page (in #4503)
• API: /api/sessions and /api/users/:id/listening-sessions endpoints always return a user object on sessions (in #4503)
• More strings translated
  • Chinese (Simplified Han script) by @FiendFEARing
  • Croatian by @biuklija
  • German by @networksecurityvodoo
  • Swedish by @Cotignac @Landrash
  • Ukrainian by @Maksim2005UA2

Full Changelog: https://github.com/advplyr/audiobookshelf/compare/v2.26.0...v2.26.1