Grimmory Updates & Release Notes

3.5.0 (2026-09-20)

This minor release primarily fixes three identified security issues in Grimmory:

• The /api/v1/settings endpoint allowed any user to access sensitive server settings. (GHSA-x6vg-344c-qrmv)
• The upload feature did not restrict users to only uploading into libraries they had access to. (GHSA-7f4w-5hc7-j96r)
• An appropriately crafted epub could have lead to CPU / web server request thread exhaustion. (GHSA-mx77-3cq4-g227)

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.4.1...v3.5.0

Features

• api: add metadata provider controller (#2673) (402e89b)
• reader: add epub reader tap navigation for mobile (#1909) (c8a1a59)

Bug Fixes

• api: add library access check to uploads (#2648) (2d7a3e9) …

3.4.1 (2026-09-15)

This patch release fixes a bug with the OpenLibrary metadata search UI and avoids a service worker crash.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.4.0...v3.4.1

Bug Fixes

• angular: remove service worker api passthrough (#2638) (539a0e0)
• ui: modernise the metadata searcher component (#2631) (ba47aaa)

Performance

• tests: use Angular recommended test config (#2632) (6bfb345)

Refactors

• epub: make some epub extraction / creation code reusable (#2629) (e6ac37f)

Contributors

We'd like to thank the contributors for this release for taking the time to make Grimmory better.

Including but not limited to: @alexhb1 @imnotjames

3.4.0 (2026-09-14)

Grimmory 3.4.0 introduces OpenLibrary & Apple Books Metadata Providers, fixes the existing GoodReads & Douban Metadata Providers, fixes bugs with epub generation, handles non-UTF8 headers in archives, and more.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.3.3...v3.4.0

Features

• kobo: show full Kobo API path in sync settings (#2381) (852da00)
• metadata: initial implementation of Apple Books source (#1780) (0660e1d)
• metadata: initial implementation of OpenLibrary source (#1764) (9b38a09)
• opds: add pagination to authors / series navigation (#2315) (7d768a2)
• api: add paged books sorts for author name / author sort name (#2497) (f44a7df)
• api: add paged books random sort (#2451) (0e67549)

Bug Fixes …

3.3.3 (2026-08-21)

This patch release of Grimmory contains bug fixes for OIDC and introduces the environment variable OIDC_ALLOW_UNSAFE_HOSTS.

[!TIP] If you have a local identity provider that Grimmory is trying to use for OIDC, you will need to enable the OIDC_ALLOW_UNSAFE_HOSTS environment variable flag.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.3.2...v3.3.3

Bug Fixes

• api: use FORCE_DISABLE_OIDC on all public / private OIDC flags (#2343) (662b327)
• oidc: allow disable of SSRF filtering for OIDC config (#2413) (1682a98)
• ui: use signals in OIDC test connection (#2417) (4ae1d0b)

Refactors

• oidc: use similar rest client config across OIDC (#2411) (2be679a)

Internationalization

• update language for external API settings (#2341) (7e7faee)

Dependencies …

3.3.2 (2026-08-19)

This patch release of Grimmory contains many bug fixes - including one security related bug fix.

The security fix (#2357) improves our mitigations against SSRF attacks via more complete filters on outbound requests - reported in https://github.com/grimmory-tools/grimmory/security/advisories/GHSA-8gxf-wjv6-jhjj by @tonghuaroot.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.3.1...v3.3.2

Bug Fixes

• api: add refresh token nbf to prevent immediate usage (#2245) (c7d147c)
• api: apply timeout to all restclient instances (#2321) (ef041dd)
• api: book files cannot be left in a detached state (#2389) (eb5d390)
• api: emit correct Content-Type for covers (#2285) (dfa81e3)
• api: prevent NPE with default value in MetadataUpdateWrapper (#2337) (41fa0c1) …

3.3.1 (2026-08-08)

This patch release of Grimmory contains bug fixes that didn't make it into the previous release or were detected afterwards. There are fixes of an edge case on the Author sort name generation, better handling of bookdrop errors, improvements to the page header scrolling, and handling in the metadata parser for non-English Amazon domains.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.3.0...v3.3.1

Bug Fixes

• amazon: properly parse non-english series information (#2198) (eeea088)
• api: handle Author sort name generation above field length (#2276) (c71893c)
• bookdrop: handle bookdrop monitoring errors (#2273) (7644e77)
• epub: support safe doctypes in OPF (#2196) (f0cedee)
• komga: add catch-alls for komga endpoint (#2268) (72a27c5) …

3.3.0 (2026-08-06)

This minor release of Grimmory has a large number of bug fixes, features, and refactors to prepare for the performance improvements we're looking to make in the near future. We've made a lot of improvements to our Hardcover and RanobeDB metadata parsers, fixed over twenty outstanding bugs, and have also added Korean and Czech language support.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.2.4...v3.3.0

Features

• author: derive and store author sort name on save (#1897) (55b9d34)
• language: use consistent language normalization across the frontend (#2258) (1d707ff)
• metadata: improve RanobeDB search (#1804) (b68e022)
• metadata: improve hardcover edition selection (#1800) (fbd1d5e)
• ui: app-menu based shelf assignment component (#2058) (daae463) …

3.2.4 (2026-07-01)

This patch release of Grimmory is focused on bug fixes. The Goodreads parser and Audible parser are working more reliably now, translations have been improved, styling when navigation between pages has been improved, the icon library now properly loads, and the task management information refreshes automatically. Also, some prep work for new icons was done, and an accessible font was added.

Note: Grimmory v3.2.3 was skipped.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.2.2...v3.2.4

Bug Fixes

• fonts: increase custom font upload limit to 50MB (#1862) (bda8db5)
• metadata: detect retryable errors in LubimyCzytac parser (#1788) (e9b2eeb)
• metadata: migrate GoodReads parser from HTML scraping to GraphQL (#1734) (90fa4d7) …

3.2.2 (2026-06-19)

This patch release of Grimmory is focused on bug fixes. It fixes folder watcher SQL errors, correctly applies library restrictions to the OPDS shelf catalogs, fixes a bug affecting bookdrop on QNAP devices, ensures non-admin users are assigned at least one library, and more.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.2.1...v3.2.2

Bug Fixes

• bookdrop: directly copy instead of move between filesystems (#1759) (64ddbe5)
• event-processor: avoid invalid query during watch folder processing (#1803) (6d14043)
• metadata-refresh: add audible to metadata refresh (#1779) (e4ebe97)
• opds: add library restrictions to shelf OPDS catalogs (#1731) (0cc48a8) …

3.2.1 (2026-06-14)

This release of Grimmory is focused on bug fixes. It fixes content restrictions applied to the book's page endpoint, drops the Blackbird library to prevent JSON serialization errors, fixes public shelves not showing up for books, fixes bidirectional KOReader sync in some cases, and improves reactivity across the UI. Furthermore, there are performance improvements in the book ingest pipeline and reductions in memory usage due to file downloads.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.2.0...v3.2.1

Bug Fixes

• api: fix content restrictions for api/v1/books/page (#1706) (a93bc5f)
• book-details: fall back from invalid book detail tabs (#1685) (46f4457)
• download: stream book downloads instead of buffering in browser (#1718) (7f38de8) …

3.2.0 (2026-06-04)

Features

• helm: support external MariaDB (#1068) (4afc738)
• kobo: add subtitle to KoboBookMetadata (#1543) (e4bf4c5)
• pdf-reader: add manual save to the top bar functionality for document edits (#1426) (0e76b38)
• ui: light mode and new theming system (#1468) (22ff6d8)
• ui: move settings button to sidebar footer row (#1469) (62c1435)
• ui: OLED dark mode variant (#1560) (5e0eac5) …

3.1.0 (2026-05-14)

This release of Grimmory: features a redesigned sidebar, supports personal ratings from native Kobo devices, has fixes for the book browser sorting/filtering, prevents a PDF corruption bug, swaps the PWA icons to use the light theme for better iOS support, and more.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.0.3...v3.1.0

Features

• deploy: add healthchecks to docker, docker compose, podman quadlet, and helm chart (#1137) (c665359)
• kobo: sync personal ratings from kobo (#1165) (7de39b8)
• oidc: add configurable mobile redirect URI to the admin settings UI (#1287) (ff5f054)
• pdf-reader: PDF reader for vertical/infinite scroll layouts and improved responsiveness (#841) (64945c0) …

3.0.3 (2026-04-25)

This release of Grimmory has various usability fixes for the CBX and PDF readers, fixes a crash when loading some CBX files, adds fields back to the book browser table - among other fixes and code clean ups.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.0.2...v3.0.3

Bug Fixes

ui: allow self frame-src for pdf doc mode (#901) (ed35da2) ui: fall back the book sorting service to primary file (#944) (7da3377) ui: virtual grid scroll restore (#948) (005d2f0) ui: use signals to unfreeze library loading component (#964) (4001b04) …

3.0.2 (2026-04-26)

This release of Grimmory has fixes for the Content-Security-Policy issue seen in 3.0.1 which caused a lack of styling.

Bug Fixes

• ui: add 'self' to worker-src for our angular worker (#894) (08156bb)
• ui: disable critical-inlining to prevent CSP failure (#893) (6b8d916)

Contributors

We'd like to thank the contributors for this release for taking the time to make Grimmory better.

Including but not limited to: @imnotjames

[!CAUTION] We've identified a bug in this release related to the Content-Security-Policy which prevents usage of the UI.

Please use the v3.0.2 release instead.

3.0.1 (2026-04-25)

This release of Grimmory contains bug fixes & dependency updates.

Of note, this release fixes bugs affecting the series listing page, the iOS mobile browser reading experience, and the Kobo Sync reading progress experience.

However, there's a number of other fixes and changes which are detailed below.

Changelog

Full Changelog: https://github.com/grimmory-tools/grimmory/compare/v3.0.0...v3.0.1

Bug Fixes

• api: improve sort feature parity of AppBookService (#828) (c6e8c4d)
• api: use configurable upload limit for author photo / book cover (#783) (55f2255)
• api: use correct field for lastReadTime (#779) (a3616c9) …

3.0.0 (2026-04-22)

Features

• add discord automated release notifications (#564) (e65536d)
• add reading progress endpoints to mobile api (#377) (4bca3f6)
• add Unraid community app template (#62) (b2b01cf)
• api-docs: reintroduce API doc generation (#289) (5ac7b55)
• api: allow disable of kobo store proxy (#337) (91c1973)
• api: use redirect for kobo sync book images (#198) (c4107a9) …

2.3.0 (2026-03-21)

Features

• release: document develop-based stable release previews (930e526)

Bug Fixes

• api: fix potential memory leaks in file processing (031e8ae)
• ci: correct artifact download action pin (37ca101)
• ci: publish PR test results from workflow_run (11a76bf)
• ci: repair release preview and test result publishing (afa5b81)
• drop telemetry from app (#52) (4d82cb7)
• ui: repair frontend compile after rebrand (fea1ec6)

Refactors

• build: rename frontend dist output to grimmory (ecf388f) …

2.2.7 (2026-03-21)

Bug Fixes

• api: fix potential memory leaks in file processing (031e8ae)
• ci: correct artifact download action pin (37ca101)
• ci: publish PR test results from workflow_run (11a76bf)
• drop telemetry from app (#52) (4d82cb7)
• ui: repair frontend compile after rebrand (fea1ec6)

Refactors

• build: rename frontend dist output to grimmory (ecf388f)
• i18n: rename booklore translation keys to grimmory (eb94afa)
• metadata: move default parser from Amazon to Goodreads (e252122) …