Grimmory Release Notes

3.5.0 (2026-09-20)

This minor release primarily fixes three identified security issues in Grimmory:

• The /api/v1/settings endpoint allowed any user to access sensitive server settings. (GHSA-x6vg-344c-qrmv)
• The upload feature did not restrict users to only uploading into libraries they had access to. (GHSA-7f4w-5hc7-j96r)
• An appropriately crafted epub could have lead to CPU / web server request thread exhaustion. (GHSA-mx77-3cq4-g227)

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.4.1...v3.5.0

Features

• api: add metadata provider controller (#2673) (402e89b)
• reader: add epub reader tap navigation for mobile (#1909) (c8a1a59)

Bug Fixes

• api: add library access check to uploads (#2648) (2d7a3e9) …

3.4.1 (2026-09-15)

This patch release fixes a bug with the OpenLibrary metadata search UI and avoids a service worker crash.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.4.0...v3.4.1

Bug Fixes

• angular: remove service worker api passthrough (#2638) (539a0e0)
• ui: modernise the metadata searcher component (#2631) (ba47aaa)

Performance

• tests: use Angular recommended test config (#2632) (6bfb345)

Refactors

• epub: make some epub extraction / creation code reusable (#2629) (e6ac37f)

Contributors

We'd like to thank the contributors for this release for taking the time to make Grimmory better.

Including but not limited to: @alexhb1 @imnotjames

3.4.0 (2026-09-14)

Grimmory 3.4.0 introduces OpenLibrary & Apple Books Metadata Providers, fixes the existing GoodReads & Douban Metadata Providers, fixes bugs with epub generation, handles non-UTF8 headers in archives, and more.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.3.3...v3.4.0

Features

• kobo: show full Kobo API path in sync settings (#2381) (852da00)
• metadata: initial implementation of Apple Books source (#1780) (0660e1d)
• metadata: initial implementation of OpenLibrary source (#1764) (9b38a09)
• opds: add pagination to authors / series navigation (#2315) (7d768a2)
• api: add paged books sorts for author name / author sort name (#2497) (f44a7df)
• api: add paged books random sort (#2451) (0e67549)

Bug Fixes …

3.3.3 (2026-08-21)

This patch release of Grimmory contains bug fixes for OIDC and introduces the environment variable OIDC_ALLOW_UNSAFE_HOSTS.

[!TIP] If you have a local identity provider that Grimmory is trying to use for OIDC, you will need to enable the OIDC_ALLOW_UNSAFE_HOSTS environment variable flag.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.3.2...v3.3.3

Bug Fixes

• api: use FORCE_DISABLE_OIDC on all public / private OIDC flags (#2343) (662b327)
• oidc: allow disable of SSRF filtering for OIDC config (#2413) (1682a98)
• ui: use signals in OIDC test connection (#2417) (4ae1d0b)

Refactors

• oidc: use similar rest client config across OIDC (#2411) (2be679a)

Internationalization

• update language for external API settings (#2341) (7e7faee)

Dependencies …

3.3.2 (2026-08-19)

This patch release of Grimmory contains many bug fixes - including one security related bug fix.

The security fix (#2357) improves our mitigations against SSRF attacks via more complete filters on outbound requests - reported in https://github.com/grimmory-tools/grimmory/security/advisories/GHSA-8gxf-wjv6-jhjj by @tonghuaroot.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.3.1...v3.3.2

Bug Fixes

• api: add refresh token nbf to prevent immediate usage (#2245) (c7d147c)
• api: apply timeout to all restclient instances (#2321) (ef041dd)
• api: book files cannot be left in a detached state (#2389) (eb5d390)
• api: emit correct Content-Type for covers (#2285) (dfa81e3)
• api: prevent NPE with default value in MetadataUpdateWrapper (#2337) (41fa0c1) …

3.3.1 (2026-08-08)

This patch release of Grimmory contains bug fixes that didn't make it into the previous release or were detected afterwards. There are fixes of an edge case on the Author sort name generation, better handling of bookdrop errors, improvements to the page header scrolling, and handling in the metadata parser for non-English Amazon domains.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.3.0...v3.3.1

Bug Fixes

• amazon: properly parse non-english series information (#2198) (eeea088)
• api: handle Author sort name generation above field length (#2276) (c71893c)
• bookdrop: handle bookdrop monitoring errors (#2273) (7644e77)
• epub: support safe doctypes in OPF (#2196) (f0cedee)
• komga: add catch-alls for komga endpoint (#2268) (72a27c5) …

3.3.0 (2026-08-06)

This minor release of Grimmory has a large number of bug fixes, features, and refactors to prepare for the performance improvements we're looking to make in the near future. We've made a lot of improvements to our Hardcover and RanobeDB metadata parsers, fixed over twenty outstanding bugs, and have also added Korean and Czech language support.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.2.4...v3.3.0

Features

• author: derive and store author sort name on save (#1897) (55b9d34)
• language: use consistent language normalization across the frontend (#2258) (1d707ff)
• metadata: improve RanobeDB search (#1804) (b68e022)
• metadata: improve hardcover edition selection (#1800) (fbd1d5e)
• ui: app-menu based shelf assignment component (#2058) (daae463) …

What's Changed

• chore: drop asc from Grimmory books API call by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/191
• fix: stop refereencing the CFI column in repository code by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/192
• fix: corrected sql for fetching book events by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/193
• fix: resolve plugin path using plugin loader if required by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/194

Full Changelog: https://github.com/grimmory-tools/grimmory.koplugin/compare/v0.0.29...v0.0.30

What's Changed

• chore: remove CFI migration by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/184
• fix: avoid android SIGABRT during sync by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/183
• fix: properly fail requests for get books on error by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/187

Full Changelog: https://github.com/grimmory-tools/grimmory.koplugin/compare/v0.0.27...v0.0.28

3.2.4 (2026-07-01)

This patch release of Grimmory is focused on bug fixes. The Goodreads parser and Audible parser are working more reliably now, translations have been improved, styling when navigation between pages has been improved, the icon library now properly loads, and the task management information refreshes automatically. Also, some prep work for new icons was done, and an accessible font was added.

Note: Grimmory v3.2.3 was skipped.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.2.2...v3.2.4

Bug Fixes

• fonts: increase custom font upload limit to 50MB (#1862) (bda8db5)
• metadata: detect retryable errors in LubimyCzytac parser (#1788) (e9b2eeb)
• metadata: migrate GoodReads parser from HTML scraping to GraphQL (#1734) (90fa4d7) …

What's Changed

• refactor: make withDatabase a helper by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/168
• chore: prevent wifi toggle when no wifi by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/172
• fix: show new cover when individual book is reloaded by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/174
• feat: end session when adopting progress by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/173
• chore: drop writing CFI when recording session events by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/181
• fix: handle CFI for nodes that have no space between them by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/182

Full Changelog: https://github.com/grimmory-tools/grimmory.koplugin/compare/v0.0.26...v0.0.27

What's Changed

• fix: properly wait for automatic wifi without breaking executor by @sabrina553 in https://github.com/grimmory-tools/grimmory.koplugin/pull/149
• fix: proper toggle of syncReadingSessions() by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/150
• refactor: drop unused fields from sync by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/151
• refactor: simplify executor and combine with wifi manager by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/154
• fix: only send progress when needed by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/155
• fix: only emit dismiss callback when not external by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/157
• fix: handle self-closing tags in CFI resolver by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/156
• feat: add session events for annotations by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/160
• refactor: move UI refresh helper into doc_metadata by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/161
• fix: move refresh UI to only when required by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/162
• refactor: set grimmory ID when associating a book by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/163 …

3.2.2 (2026-06-19)

This patch release of Grimmory is focused on bug fixes. It fixes folder watcher SQL errors, correctly applies library restrictions to the OPDS shelf catalogs, fixes a bug affecting bookdrop on QNAP devices, ensures non-admin users are assigned at least one library, and more.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.2.1...v3.2.2

Bug Fixes

• bookdrop: directly copy instead of move between filesystems (#1759) (64ddbe5)
• event-processor: avoid invalid query during watch folder processing (#1803) (6d14043)
• metadata-refresh: add audible to metadata refresh (#1779) (e4ebe97)
• opds: add library restrictions to shelf OPDS catalogs (#1731) (0cc48a8) …

What's Changed

• feat: record CFI with session events by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/139
• feat: refresh doc_settings after sync by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/140
• perf: improve performance of cfi resolver by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/141
• fix: use string quotes in SQL JOIN conditions by @zanivann in https://github.com/grimmory-tools/grimmory.koplugin/pull/142

Full Changelog: https://github.com/grimmory-tools/grimmory.koplugin/compare/v0.0.23...v0.0.24

3.2.1 (2026-06-14)

This release of Grimmory is focused on bug fixes. It fixes content restrictions applied to the book's page endpoint, drops the Blackbird library to prevent JSON serialization errors, fixes public shelves not showing up for books, fixes bidirectional KOReader sync in some cases, and improves reactivity across the UI. Furthermore, there are performance improvements in the book ingest pipeline and reductions in memory usage due to file downloads.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.2.0...v3.2.1

Bug Fixes

• api: fix content restrictions for api/v1/books/page (#1706) (a93bc5f)
• book-details: fall back from invalid book detail tabs (#1685) (46f4457)
• download: stream book downloads instead of buffering in browser (#1718) (7f38de8) …

Features

• Sync configuration was moved to its own menu
  • Added a sync option to sync shelves or not (default on) and an extra option to "sync empty shelves".
  • Updated shelf logic so that all shelves that are applicable to the books you've downloaded (not just target shelves) are pulled over.
• Download configuration was moved to its own menu section as well.
  • Added an option to download config to remove books when they are no longer in Grimmory (either not on the shelf or deleted from Grimmory)
• Added a (for now) internal option of headers that can be added to every API request. This is extra_headers in the grimmory settings lua file.

Bug fixes

• Improved sync messages so that books are either refreshed or downloaded to make things clearer.
• Added a bit of extra logic so that when an open book is attempted to sync, the plugin attempts to find the remote book in Grimmory.
• Also handled cases where books are refreshed / deleted / etc - and then the same book is downloaded again.
• Fixed a bug where the collections were not updating without a KOReader restart after sync in some edge cases.
• Fixed a bug where some toggles were not being properly persisted to the settings lua file.

Full Changelog: https://github.com/grimmory-tools/grimmory.koplugin/compare/v0.0.22...v0.0.23

3.2.0 (2026-06-04)

Features

• helm: support external MariaDB (#1068) (4afc738)
• kobo: add subtitle to KoboBookMetadata (#1543) (e4bf4c5)
• pdf-reader: add manual save to the top bar functionality for document edits (#1426) (0e76b38)
• ui: light mode and new theming system (#1468) (22ff6d8)
• ui: move settings button to sidebar footer row (#1469) (62c1435)
• ui: OLED dark mode variant (#1560) (5e0eac5) …

What's Changed

• fix: push pages as location to sessions rather than xpointer by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/115
• feat: support pushing singular / open books by @imnotjames in https://github.com/grimmory-tools/grimmory.koplugin/pull/109

Full Changelog: https://github.com/grimmory-tools/grimmory.koplugin/compare/v0.0.21...v0.0.22