audiobookshelf Release Notes

Important: New authentication system was added in v2.26.0. See #4460 for details.

Important: Node.js version updated to 24

Added

• API keys can authenticate websocket connections by @Vito0912 in #4974

Fixed

• Server crash decoding invalid filter groups
• Server crash when collapsing sub-series and sorting by author name #4993
• Get series for library endpoint not checking the series belongs to that library

Updated

• Audible match results now set the explicit flag #5535 by @SharonZhu0122 in #5575
• Server, Docker image, and build scripts now use Node.js 24 by @nichwall in #5578
• API: Library item cover update requires the cover path to be a file already on that library item
• API: Cover and author image cache endpoints require a valid id and positive width/height by @Vito0912
• More strings translated
  • Czech by @CZDanol
  • Norwegian Bokmål by @Mediokris
  • Spanish by @JnBenites
  • Swedish by Daniel Nylander

Internal

• Initial TypeScript compilation for the server by @nichwall in #5510
• Add ESLint for the server and run it in the unit test workflow in #5578
• Fix ReferenceErrors under strict mode when scanning library directories by @binyaminyblatt in #5586

New Contributors

• @binyaminyblatt made their first contribution in #5586
• @SharonZhu0122 made their first contribution in #5575

Full Changelog: v2.36.1...v2.37.0

Important: New authentication system was added in v2.26.0. See #4460 for details.

Fixed

• Collapse series not working when filters are enabled #2807 #3049 by @schummar in #5280
• Podcast rescan emitting stale episodes on item_updated by @mikiher in #5409
• Updating or deleting a narrator in one library applying the change to all libraries
• Author endpoints not checking user can access the author's library
• Share endpoints not sending 404 status
• Upload endpoint not handling directory creation errors
• sqlite3 bindings not installing when using npm v12 #5412 by @Vito0912 in #5429

Updated

• Comic book extractor file path sanitization by @Vito0912
• Auth settings PATCH sanitizes authLoginCustomMessage HTML
• API: Settings PATCH endpoint only accepts a fixed set of general settings (auth settings must go through the auth-settings endpoint)
• API: Cover endpoints only allow webp, jpeg and png as optional format param
• API: Library item media update no longer accepts ebookFile, chapters and audioFiles in request body

More strings translated

• Belarusian by @pavel-miniutka
• Bengali by @ShamiaAkterShanta
• Chinese (Simplified Han script) by @FiendFEARing
• Chinese (Traditional Han script) by @JBlond @violawang0401-cloud
• Croatian by Igor Dobrača
• Czech by @kuci-JK
• Danish by Kim Josefsen
• Dutch by @Kwintenc
• Finnish by @JBlond
• French by Charlie, J. Lavoie
• German by @VoltKraft; J. Lavoie, Zarakkas
• Greek by J. Lavoie
• Hungarian by @ugyes
• Italian by @lollos78; J. Lavoie
• Lithuanian by @Haya25 @PovilasID
• Polish by @MarcinKlejna @TheMatrixan
• Portuguese (Brazil) by @AgenteGabrielofc
• Russian by @vmakeev

Internal

• Restore the mount prefix when handing requests to Next.js by @mikiher in #5507
• Github workflow to generate translator credits for release notes by @nichwall in #5558

New Contributors

• @schummar made their first contribution in #5280

Full Changelog: v2.36.0...v2.36.1

Important: New authentication system was added in v2.26.0. See #4460 for details.

Added

• Logout all devices button on account page (in #5395)
• Auth sessions table on account page w/ ability to logout of individual sessions (in #5400)

Fixed

• Weak protocol validation for OIDC post-login callback URL by @mikiher in #5386
• User delete endpoint allowing for root account deletion by @mikiher in #5370
• API and websocket authentication allowing refresh tokens by @mikiher in #5387
• Bulk library item download endpoint not checking access on individual items by @mikiher in #5388
• Manual podcast episode match not setting the enclosure url #5317 by @mikiher in #5318

Updated

• Changing user password invalidates all auth sessions (in #5393)
• Extend refresh token grace period to 10 minutes and allow REFRESH_TOKEN_GRACE_PERIOD env variable override #5281 by @DanielAshley in #5376
• API: New GET endpoints /api/me/progress, /api/me/bookmarks, /api/me/bookmarks/:libraryItemId by @Vito0912 in #5363
• API: Add all minified fields to expanded library item JSON by @mikiher in #5341
• API: Server settings now include timeZone for server timezone (for giving accurate cron job next schedule date)
• API: /logout endpoint now supports ?allDevices=1 query param to delete all other sessions and rotate current (in #5395)
• API: New endpoint GET /api/me/sessions to get all auth sessions (in #5400 and #5405)
• API: New endpoint DELETE /api/me/sessions/:id to delete an auth session (in #5405)
• New socket event authors_num_books_updated is emitted during a scan when author book count changes by @mikiher in #5354
• Socket event author_added is now emitted during scans by @mikiher in #5354
• UI/UX: Update outdated help links for new docs site by @francisrath in #5336
• More strings translated
  • Chinese (Simplified Han script) by @FiendFEARing
  • Danish by @MikkelOlesen @hhjuhl
  • Greek by @no1ta
  • Icelandic by @axelbjornsson
  • Portuguese (Brazil) by @AgenteGabrielofc
  • Tamil by @TamilNeram

Internal

• Read AllowedDevOrigins from dev.js into ALLOWED_DEV_ORIGINS env var by @mikiher in #5291
• Setup internal-api file upload passthrough for next.js by @mikiher in #5325
• Readme update about frontend rewrite by @nichwall in #5407

New Contributors

• @DanielAshley made their first contribution in #5376
• @francisrath made their first contribution in #5336

Full Changelog: v2.35.1...v2.36.0

Important: New authentication system was added in v2.26.0. See #4460 for details.

Added

• Access token refresh grace period (fixes frequently needing to re-login) #4630 by @nichwall in #5004

Fixed

• Listening sessions from Android app showing device name as Abs iOS
• RSS feeds serving m4b files with incorrect Content-Type #5041 by @brandonfhall in #5221

Changed

• Book & podcast descriptions from audio files are sanitized
• cancel_scan and set_log_listener socket events validate account type and log level
• More strings translated
  • Belarusian by @pavel-miniutka
  • Polish by @TheMatrixan

New Contributors

• @brandonfhall made their first contribution in #5221

Full Changelog: v2.34.0...v2.35.0

Important: New authentication system was added in v2.26.0. See #4460 for details.

Added

• Japanese language and Japan as podcast search region by @na3shkw in #5211
• Autocomplete attributes on login and setup fields for password manager support by @meek2100 in #5089

Fixed

• Recent episodes not updating from cache when media progress changes in #5159
• Error logging when a podcast's auto-download schedule has an invalid cron expression

Changed

• Public media item shares: use start time passed in query parameter for existing sessions by @pjkottke in #5163
• Podcast episode downloads use SSRF filtering on the HTTP request (matches other external requests)
• Podcast create and update validate the auto-download schedule cron expression and sanitizes the HTML description
• Playlists, collections, and library item batch API routes enforce library and per-item access
• More strings translated
• Belarusian by @pavel-miniutka
• Hungarian by @ugyes
• Japanese by @na3shkw

Internal

• ApiCacheManager test coverage for recent-episodes cache invalidation

New Contributors

• @pjkottke made their first contribution in #5163
• @meek2100 made their first contribution in #5089
• @na3shkw made their first contribution in #5211

Full Changelog: v2.33.2...v2.34.0

Important: New authentication system was added in v2.26.0. See #4460 for details.

Fixed

• Matroska audiobooks (.mka) with the Opus codec failing to play in web client by @rktjmp in #5115
• UI/UX: Share player not using libraries cover aspect ratio setting
• Backup uploads leaving temporary files behind when the uploaded file failed validation
• Path traversal check on the filesystem path-exists endpoint not handling all edge cases

Changed

• Bulk download endpoint now ensures all requested items belong to the library being requested
• Backup load and upload now validate the backup details entry exists and is within a reasonable size limit
• Podcast create endpoint validates that the podcast path is inside the selected library folder
• Author and library item cover image endpoints now clamp width/height query params to a maximum of 4096
• Podcast episode subtitles parsed from RSS feeds are now sanitized for HTML
• author_updated/author_added socket events emitted when updating authors in the book details edit modal by @mikiher in #5158
• item_removed socket event payload now includes libraryId so clients can ignore events for other libraries by @mikiher in #5160

More strings translated

• Belarusian by @pavel-miniutka
• Bulgarian by @lembata
• German by @JBlond @LaurinSorgend
• Italian by @tizio04
• Russian by @Hopelite @vmakeev
• Spanish by @cyphra

New Contributors

• @rktjmp made their first contribution in #5115

Full Changelog: v2.33.1...v2.33.2

Important: New authentication system was added in v2.26.0. See #4460 for details.

Added

• Slovak language option by @belpe in #5077
• Belarusian language option by @pavel-miniutka in #5071
• Database indexes for discover query performance by @kevingatera in #5073

Fixed

• IDOR vulnerabilities in listening sessions, media progress, and bookmark endpoints #5062 by @mandreko in #5063
• Server crash filtering by decade with collapsed series
• Server crash on /me/progress/:libraryItemId/:episodeId? when episodeId is not passed in for a podcast library item #5058
• Updating author name merging with same name authors in a different library #4628
• Home page check current user from socket event when updating hide from continue listening
• UI/UX: Match tab "click to use current value" incorrect title attribute
• UI/UX: Aria-label for jump backward button by @KiwiHour in #4973

Changed

• Improved personalized shelves performance by parallelizing shelf queries and reducing search payload size by @kevingatera in #5073
• Improved API cache invalidation for high-churn models (sessions, media progress) by @kevingatera in #5073
• Improved subtitle parsing to account for bare colon in title by @kctdfh in #5036
• Sanitize session DeviceInfo clientDeviceInfo fields
• Sanitize server settings authLoginCustomMessage on save and load
• Fix OpenAPI spec description by @openam in #5042
• UI/UX: Display localized/styled text for selected filter by @sir-wilhelm in #4952
• More strings translated
  • Belarusian by @pavel-miniutka
  • Catalan by @enboig
  • Chinese (Simplified Han script) by @FiendFEARing
  • Czech by @Plazec
  • Danish by @xxzp3
  • French by @dapitch666
  • German by @ShaikaJar @Maxklos @B0rax
  • Greek by @lambolighting
  • Hebrew by @enosh
  • Hungarian by @Kabika82 @ugyes
  • Japanese by @litoma
  • Lithuanian by @mantas3
  • Norwegian Bokmål by @Torstein-Eide @soteland
  • Polish by @Jarsey45
  • Portuguese (Brazil) by @lribeiro
  • Romanian by @hac3ru
  • Slovak by @goozi12345 @pecer
  • Slovenian by @thehijacker
  • Swedish by @Cotignac @karlbe
• New Contributors
  • @KiwiHour made their first contribution in #4973
  • @openam made their first contribution in #5042
  • @belpe made their first contribution in #5077
  • @pavel-miniutka made their first contribution in #5071
  • @kctdfh made their first contribution in #5036
  • @mandreko made their first contribution in #5063
  • @kevingatera made their first contribution in #5073

Full Changelog: v2.32.1...v2.33.0

Important: New authentication system was added in v2.26.0. See #4460 for details.

Fixed

• Bulk matching books with multiple of the same new author only applies author to one book by @TN-SKYC in #4766
• Debian package upgrades failing due to user "audiobookshelf" already exists #1617 by @Yetangitu in #4740
• Multi-select inputs allowing duplicate new items by @votex001 in #4649
• Audible & custom metadata providers allowing duplicate genres & tags #4634 (in #4927)

Updated

• API: Metadata match results return tags as an array of strings instead of a comma separated string (in #4927)

• Playlists are sorted alphabetically in playlist modal by @sir-wilhelm in #4906

• More strings translated

  • Arabic by @kfctatertot
  • Bulgarian by @lembata
  • Chinese (Simplified Han script) by @FiendFEARing
  • Finnish by @Napitauki @pHamala
  • German by @JBlond
  • Greek by @lambolighting
  • Hebrew by @mnavon
  • Italian by @66Bunz
  • Korean by @zardkim
  • Polish by @ahetek
  • Portuguese (Brazil) by @ljaksys
  • Slovenian by @thehijacker
  • Spanish by @kfctatertot @xlbrto

New Contributors

• @TN-SKYC made their first contribution in #4766
• @votex001 made their first contribution in #4649

Full Changelog: v2.31.0...v2.32.0

Added

• Turkish & Korean language option

Fixed

• Chapter editor: Play button is still shown next to chapters with invalid start times #4691
• Switching users does not refresh available libraries #4694
• Admin users unable to close sessions for other users #4746
• Custom metadata providers not showing in library edit modal #3820 by @mikiher in #4750
• HLS transcoding fails for AC3/EAC3 codecs #4798 by @Vito0912 in #4808
• UI/UX: Next/prev buttons not shown on item edit modal when opened using "Files" or "Match" context menu item #4718

Changed

• Increase default access & refresh token expirations. Refresh now 30 days & Access now 1 hour by @Vito0912 in #4756
• Enable OIDC auth auto redirect via query parameter ?autoLaunch=1 on login page by @Yetangitu in #4737
• Improve podcast RSS feed parser to handle feeds not wrapping html in CDATA #4757
• Update "Days in a row" stat to not require today by @jamerst in #4770
• Improved error handling for file system ensureDir by @mikiher in #4881
• UI/UX: Rephrase library watcher setting to "Automatically watch ..." #4095 by @mikiher in #4815
• UI/UX: Uploader shows progress indicator #895 by @Vito0912 in #4702
• API: New GET /search/providers endpoint to fetch all metadata providers by @mikiher in #4750
• More strings translated
  • Catalan by @celigabon
  • Chinese (Simplified Han script) by @FiendFEARing
  • Croatian by @biuklija @milotype
  • Czech by @Plazec @zendiik
  • Danish by @Andersborrits
  • Estonian by @alehandro112
  • Finnish by @pHamala @phewi
  • French by @dapitch666
  • German by @Blubberland @schoenfeldj @Vito0912 @B0rax
  • Hungarian by @ljaksys @ugyes
  • Italian by @burghy86
  • Korean by @zardkim
  • Lithuanian by @waipit
  • Polish by @pryszczoskor
  • Portuguese (Brazil) by @pmangro @nlqog @ljaksys
  • Romanian by @dinuzauri
  • Russian by @renesat
  • Slovenian by @thehijacker
  • Swedish by @3nm1 @Cotignac
  • Ukrainian by @maksim2005UKR

New Contributors

• @Yetangitu made their first contribution in #4737
• @jamerst made their first contribution in #4770

Full Changelog: v2.30.0...v2.31.0

Added

• Book cover search includes "Best" option (searches audible, google & fantlab) by @mikiher in #4716

Fixed

• OIDC invalid callback URL (incorrect protocol) #4609 by @Vito0912 in #4635
• MultiSelect causing web client to become unresponsive due to duplicate keys #4634 by @nichwall in #4636
• Podcast episodes being downloaded without an audio stream (in #4664)
• UI/UX: Chapter editor overflowing on smaller screen sizes #4652

Changed

• Book cover search is now async, streams results using websockets by @mikiher in #4716
• Decrease timeout to 10s (from 30s) on all metadata providers by @mikiher in #4716
• UI/UX: Chapter editor does not redirect back after saving changes or deleting all chapters #4650
• More strings translated
• Arabic by @Salmanegr
• Chinese (Simplified Han script) by @FiendFEARing
• Croatian by @biuklija @milotype
• Czech by @kuci-JK @petr-prikryl @Plazec @Losicek
• Finnish by @pHamala
• French by @lolly76
• German by @Vito0912 @pjope @B0rax
• Hungarian by @ugyes @Kabika82
• Norwegian Bokmål by @husjon @PSchaug
• Persian by @aghorbanmehr
• Polish by @satanowski @ahetek
• Portuguese (Brazil) by @jhonthan
• Romanian by @Hnatiucb @Emdisi00
• Russian by @GrakovNe @Devastator1979
• Slovak by @pecer
• Slovenian by @thehijacker
• Swedish by @Cotignac
• Turkish by @icutehunter @smilefate @oersen
• Ukrainian by @maksim2005UKR

Internal

• Add a script to build an uncompressed windows executable #2998 by @mikiher in #4729

Full Changelog: v2.29.0...v2.30.0

Important: New authentication system was added in v2.26.0. See #4460 for details.

Added

• Chapter editor tools/enhancements including bulk chapter import & more (see #4384) by @josh-vin in #4384
• Book library sort options for Progress: Started and Progress: Finished #4540 by @tagmeh in #4575

Fixed

• Initial page load failing to load library (on token refreshes) #4567 (in #4590)
• Library path folder browser not working on latest Windows 11 (replace wmic with powershell) #4531 by @sir-wilhelm in #4533
• Podcast itunes id not set on podcasts created from search and podcast matching #4614
• Book match tab last used provider saved in local storage being overriden by itunes when matching a podcast #4615
• Server listening log for ipv6 host by @renesat in #4595
• UI/UX: Podcast match author input not showing the current author value #4617

Changed

• Podcast episode download requests pass / in Accept header by @renesat in #4596
• Podcast episode downloads always embed meta tags (previously only mp3) (in #4598)
• Remove unnecessary token from HLS playlist files by @laxandrea in #4608
• UI/UX: Changed book library Progress Updated sort option label to Progress: Last Updated
• UI/UX: Replace SVG icons with material-symbols icon equivalents by @Toby222 in #4552
• UI/UX: Remove unnecessary success toast for podcast episode removed #4606
• More strings translated
  • Belarusian by @i-Nosferatu-i
  • Bulgarian by @jeliozver
  • Chinese (Simplified Han script) by @FiendFEARing
  • Croatian by @biuklija
  • Czech by @kuci-JK
  • Dutch by @matieke
  • German by @Vito0912 @Dalabad @Eragos @B0rax
  • Hungarian by @ugyes @Kabika82
  • Italian by @paolor72 @laxandrea
  • Russian by @renesat
  • Slovenian by @thehijacker
  • Spanish by @idojius86
  • Swedish by @Cotignac @MageSneaky
  • Vietnamese by @phamngocminhhang

New Contributors

• @laxandrea made their first contribution in #4608
• @renesat made their first contribution in #4596
• @sir-wilhelm made their first contribution in #4533
• @tagmeh made their first contribution in #4575

Full Changelog: v2.28.0...v2.29.0