Grimmory Release Notes

3.3.3 (2026-08-21)

This patch release of Grimmory contains bug fixes for OIDC and introduces the environment variable
OIDC_ALLOW_UNSAFE_HOSTS.

Tip

If you have a local identity provider that Grimmory is trying to use for OIDC, you will
need to enable the OIDC_ALLOW_UNSAFE_HOSTS environment variable flag.

Changelog

Full Changelog: v3.3.2...v3.3.3

Bug Fixes

api: use FORCE_DISABLE_OIDC on all public / private OIDC flags (#2343) (662b327)

oidc: allow disable of SSRF filtering for OIDC config (#2413) (1682a98)

ui: use signals in OIDC test connection (#2417) (4ae1d0b)

Refactors

oidc: use similar rest client config across OIDC (#2411) (2be679a)

Internationalization

update language for external API settings (#2341) (7e7faee)

Dependencies

bump the gradle-dependencies group in /backend with 2 updates (#2418) (1634047)

3.3.2 (2026-08-19)

This patch release of Grimmory contains many bug fixes - including one security related bug fix.

The security fix (#2357) improves our mitigations against SSRF attacks via more complete filters on outbound requests - reported in GHSA-8gxf-wjv6-jhjj by @tonghuaroot.

Changelog

Full Changelog: v3.3.1...v3.3.2

Bug Fixes

• api: add refresh token nbf to prevent immediate usage (#2245) (c7d147c)
• api: apply timeout to all restclient instances (#2321) (ef041dd)
• api: book files cannot be left in a detached state (#2389) (eb5d390)
• api: emit correct Content-Type for covers (#2285) (dfa81e3)
• api: prevent NPE with default value in MetadataUpdateWrapper (#2337) (41fa0c1)
• api: stricter SSRF protections (#2357) (31b574d)
• api: use ApiException instead of EntityNotFoundExcepion (#2302) (e88de1a)
• api: use Set for BookEntity.bookFiles to mitigate duplicates (#2297) (f85ae0d)
• api: wrap recalc match score in transaction to allow lazy load (#2332) (dbd9106)
• archive: ignore directories when streaming entries from zip (#2327) (b24e104)
• audible: emit external Audible URL with region domain (#2329) (8fa769b)
• audible: use expected URL patterns for product links (#2390) (ddb9d3c)
• books: prevent duplicate book file entries (#2289) (c3b4593)
• hardcover: use injected restclient with expected timeouts (#2320) (9d15192)
• ui: refresh duplicate merger after deleting books (#2284) (97226de)
• ui: use signals to make ISBN import reactive (#2324) (42378ec)

Refactors

• amazon: use predefined domains (#2367) (2a8d8ea)
• ui: app-menu positioning and styling refinements (#2308) (f617650)
• ui: create metadata search provider anchor in template (#2317) (536f6af)

Chores

• epub: avoid EpubContainer in EpubMetadataExtractor (#2128) (f9d39d2)
• epub: avoid EpubContainer in EpubMetadataWriter (#2162) (4f249a6)
• epub: drop unused EpubMetadataExtractor methods (#2312) (df1e1aa)
• epub: move cover detector back into Grimmory (#2108) (c6cbff1)
• epub: use expected imports for epubreader (#2287) (660e95c)
• koreader: move CFI operations back into grimmory (#2107) (124d463)

Dependencies

• bump the frontend group with 17 updates (#2360) (e20c5a3)
• bump the gradle-dependencies group in /backend with 3 updates (#2359) (4a9516d)
• bump the release-tooling group with 2 updates (#2358) (9e6b133)
• drop unused epub4j native (#2303) (589cebe)

Contributors

We'd like to thank the contributors for this release for taking the time to make Grimmory better.

Including but not limited to: @alexhb1 @imnotjames @king-407 @leandroltz0

3.3.1 (2026-08-08)

This patch release of Grimmory contains bug fixes that didn't make it into the previous release or were detected afterwards. There are fixes of an edge case on the Author sort name generation, better handling of bookdrop errors, improvements to the page header scrolling, and handling in the metadata parser for non-English Amazon domains.

Changelog

Full Changelog: v3.3.0...v3.3.1

Bug Fixes

• amazon: properly parse non-english series information (#2198) (eeea088)
• api: handle Author sort name generation above field length (#2276) (c71893c)
• bookdrop: handle bookdrop monitoring errors (#2273) (7644e77)
• epub: support safe doctypes in OPF (#2196) (f0cedee)
• komga: add catch-alls for komga endpoint (#2268) (72a27c5)
• ui: add angular query params for breadcrumb navigation (#2261) (288f826)
• ui: drop file size link that does not work (#2266) (550c087)
• ui: overlay, menu and button polish (#2264) (e3b0fe7)
• ui: page header scrolling and size polish (#2263) (f1e88ee)

Refactors

• ui: radio group button icon support (#2262) (f38461d)

Dependencies

• deps: bump the frontend group with 13 updates (#2270) (e4248a1)
• deps: bump the gradle-dependencies group in /backend with 6 updates (#2269) (f007c3d)

Contributors

We'd like to thank the contributors for this release for taking the time to make Grimmory better.

Including but not limited to: @alexhb1 @imnotjames

3.3.0 (2026-08-06)

This minor release of Grimmory has a large number of bug fixes, features, and refactors to prepare for the performance improvements we're looking to make in the near future. We've made a lot of improvements to our Hardcover and RanobeDB metadata parsers, fixed over twenty outstanding bugs, and have also added Korean and Czech language support.

Changelog

Full Changelog: v3.2.4...v3.3.0

Features

• author: derive and store author sort name on save (#1897) (55b9d34)
• language: use consistent language normalization across the frontend (#2258) (1d707ff)
• metadata: improve RanobeDB search (#1804) (b68e022)
• metadata: improve hardcover edition selection (#1800) (fbd1d5e)
• ui: app-menu based shelf assignment component (#2058) (daae463)
• emit actual koreader device / device ID (#2025) (e978098)

Internationalization

• i18n: add support for Korean (ko) and Czech (cs) (#1880) (0d287a0)

Bug Fixes

• amazon: parse kindle ebook metadata (#2201) (4d4df8c)
• api: avoid missing-cover.jpg when getting book thumbnails (#2256) (1420634)
• api: use safer default file naming pattern (#2252) (be2ac14)
• api: emit 401 on bad credentials during login (#2130) (3376d33)
• api: ensure JWTs always have a unique JWT ID (#2246) (5a6b0e5)
• api: handle exceptions with status codes (#2160) (6056f8f)
• api: ignore unused tasks to stop warnings (#2213) (38a0c47)
• db: add explicit collation for icon map migration (#1944) (0792e0b)
• docker: disable heap dumps by default (#2027) (1ff4619)
• epub: ignores non-publication dates for published metadata (#2226) (c077551)
• epub: remove refines when referenced elements are removed (#2048) (9dd8bcc)
• fb2: prioritize explicit cover binary elements (#2230) (106a2eb)
• fb2: use base64 decoder aware of newlines (#2229) (027ac6c)
• magic-shelf: remove OPDS permission gate (#2144) (f410ecb)
• magic-shelf: remove timestamp from magic shelf date checks (#2097) (8edf135)
• metadata: require Google Books API key (#1795) (4df5816)
• properly flush books during detach (#2085) (f1f86bc)
• ranobedb: prioritize English results (#2133) (068d006)
• resolve timezone offset in reading session heatmap tooltip (#1870) (2e4f85c)
• support getAuthenticatedUser() in OPDS (#2041) (108c5c1)
• ui: add missing page titles (#2073) (dbc0ccc)
• ui: drop chartjs plugin datalabels (#2021) (15446a8)
• ui: prevent ng-deep overrides from hiding upload modal text (#2227) (754637a)
• use expected ranobedb rate limit (#2051) (e28b911)

Refactors

• api: migrate away from nightcompress (#2103) (134e97f)
• books: add /api/v1/books/facets endpoint (#1898) (d2c0836)
• books: add /api/v1/books/ids select-all endpoint (#1899) (30d8760)
• books: frontend book query service and pagination basics (#2094) (111670e)
• books: initial book command service and shared command options (#2168) (cb88558)
• books: paginate /api/v1/books/page with cursor, sort, facet, search (#1853) (ef51479)
• covers: consolidate cover images into app-cover (#1928) (b4570e3)
• epub: use archiveservice instead of epub4j to read archive (#2066) (b67b32a)
• ui: autocomplete pagination and infinite scroll (#1965) (0b1fa83)
• ui: rebuilt app-menu to angular aria template-based component (#2044) (0b71406)
• ui: migrate controls to lucide (#1840) (891f900)
• ui: mobile enhancements to UI controls (#1916) (88faeb6)
• ui: new page header component and page size foundation (#1966) (a1a6031)
• ui: switch library and shelf menu to app-menu (#2057) (0acd8bc)
• ui: use app-cover for metadata searcher (#2254) (68f024b)
• ui: simplify control transition guard (#2171) (d77a580)

Chores

• drop unused demo-user permission (#2045) (f2b64c1)
• drop unused jsoup connection factory (#2151) (6417224)
• icons: remove bundled svgs and migrate preferences to default library (#1929) (9c59e91)
• repo: add just ui dev-unsafe command (#2142) (1b911b0)
• ui: drop unused missing-cover.jpg (#2260) (41f6c93)
• ui: drop unused secure-src direcctive (#2255) (5898153)
• use SERVER_PORT env var for listening port (#2018) (74642c1)
• use grimmory.local for fake email domains (#2023) (ef707ab)
• use Grimmory branding for basic auth realms (#2049) (a078fd5)
• use grimmory in sidecar generatedby (#2024) (2859e4e)
• use Grimmory branding for fallback koreader device / device ID (#2026) (bd478ce)
• use Grimmory user agent for comicvine / ranobedb / fileservice (#2014) (9e3c503)

Dependencies

• deps: bump @analogjs/vite-plugin-angular from 2.6.2 to 2.6.3 in the frontend group (#1985) (7e6e027)
• deps: bump @angular/* from 21.2.18 to 21.2.19 (#2240) (7b0dfed)
• deps: bump actions/cache/restore from 5.0.5 to 6.1.0 (#1982) (a451984)
• deps: bump actions/cache/save from 5.0.5 to 6.1.0 (#1904) (4bd4542)
• deps: bump actions/checkout from 6.0.3 to 7.0.0 (#1925) (0e483a2)
• deps: bump actions/checkout from 7.0.0 to 7.0.1 (#2208) (349a0c3)
• deps: bump actions/setup-java from 5.2.0 to 5.4.0 (#1908) (c94fc1a)
• deps: bump actions/setup-java from 5.4.0 to 5.6.0 (#2205) (ccc3746)
• deps: bump actions/setup-node from 6.4.0 to 7.0.0 (#2207) (86bf550)
• deps: bump azure/setup-helm from 5.0.0 to 5.0.1 (#1906) (efd8280)
• deps: bump codeql from 4.36.2 to 4.36.3 (#1922) (9838041)
• deps: bump com.github.ben-manes.versions from 0.54.0 to 0.56.0 in /backend in the gradle-dependencies group (#2179) (9d78cba)
• deps: bump conventional-changelog-conventionalcommits from 10.2.0 to 10.2.1 in the release-tooling group across 1 directory (#1970) (35959a6)
• deps: bump conventional-changelog-conventionalcommits from 9.3.1 to 10.2.0 in the release-tooling group across 1 directory (#1919) (5733d43)
• deps: bump docker/build-push-action from 7.2.0 to 7.3.0 (#1926) (4a2aa1f)
• deps: bump docker/login-action from 4.2.0 to 4.4.0 (#1981) (82d5313)
• deps: bump docker/metadata-action from 6.1.0 to 6.2.0 (#1923) (eb28439)
• deps: bump docker/setup-buildx-action from 4.1.0 to 4.2.0 (#1924) (c389c7b)
• deps: bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#1905) (e381ce5)
• deps: bump github/codeql-action from 4.36.3 to 4.37.0 (#1980) (01687be)
• deps: bump github/codeql-action from 4.37.0 to 4.37.3 (#2206) (a4ba65c)
• deps: bump grimmory-epub4j to 1.5.0 (#2163) (a7a8464)
• deps: bump semantic-release from 25.0.5 to 25.0.7 in the release-tooling group (#2042) (2cfe5d2)
• deps: bump semantic-release from 25.0.7 to 25.0.8 in the release-tooling group (#2089) (9741c6d)
• deps: bump taiki-e/install-action from 2.81.11 to 2.82.7 (#1907) (263e54f)
• deps: bump taiki-e/install-action from 2.82.7 to 2.83.1 (#1983) (6154d3e)
• deps: bump taiki-e/install-action from 2.82.7 to 2.85.4 (#2204) (61e9da7)
• deps: bump the frontend group across 1 directory with 10 updates (#2101) (bf093b9)
• deps: bump the frontend group across 1 directory with 18 updates (#2043) (d3c0c29)
• deps: bump the frontend group with 10 updates (#2181) (51afd6c)
• deps: bump the frontend group with 14 updates (#1972) (fa72429)
• deps: bump the frontend group with 19 updates (#1921) (d28aea3)
• deps: bump the gradle-dependencies group across 1 directory with 4 updates (#1920) (db20fcc)
• deps: bump the gradle-dependencies group across 1 directory with 8 updates (#2008) (634e9e2)
• deps: bump the gradle-dependencies group in /backend with 3 updates (#2090) (ce79661)
• deps: bump the release-tooling group across 1 directory with 2 updates (#2180) (2e04b1a)
• deps: drop deprecated angular packages (#2242) (b18c444)
• deps: replace tailwindcss-primeui with optimus-ui-tailwindcss (#2175) (8152cd4)
• deps: switch PrimeNG to Optimus UI (#2093) (cc8a53b)
• deps: update pnpm to 11.18.0 (#2193) (2e60cb4)
• fix pnpm peer dependency issues (#2074) (9be80a4)

Documentation

• update instructions on bug reports (#2184) (99f21b5)
• drop agent instructions (#2053) (840837a)
• use actual docker tags instead of fake examples (#2139) (edacce6)

Contributors

We'd like to thank the contributors for this release for taking the time to make Grimmory better.

Including but not limited to: @alexhb1 @ftibi93 @imnotjames @NichaesMol @nightt5879 @pyrox0 @sabrina553 @terminalchai @zachyale @zanivann

New Contributors

@terminalchai made their first contribution in #1795

@NichaesMol made their first contribution in #1804

@nightt5879 made their first contribution in #2027

@pyrox0 made their first contribution in #2075

@zanivann made their first contribution in #1870

@ftibi93 made their first contribution in #2073

3.2.4 (2026-07-01)

This patch release of Grimmory is focused on bug fixes. The Goodreads parser and Audible parser are working more reliably now, translations have been improved, styling when navigation between pages has been improved, the icon library now properly loads, and the task management information refreshes automatically. Also, some prep work for new icons was done, and an accessible font was added.

Note: Grimmory v3.2.3 was skipped.

Changelog

Full Changelog: v3.2.2...v3.2.4

Bug Fixes

• fonts: increase custom font upload limit to 50MB (#1862) (bda8db5)
• metadata: detect retryable errors in LubimyCzytac parser (#1788) (e9b2eeb)
• metadata: migrate GoodReads parser from HTML scraping to GraphQL (#1734) (90fa4d7)
• metadata: use audible API endpoints to avoid strict rate limits (#1799) (c4d602f)
• ui: adjust accessible font scaling (#1872) (938442e)
• ui: avoid CSS transition on page navigation (#1833) (be574d5)
• ui: convert task management websocket update to signals (#1807) (b4b5468)
• ui: improve favicon (#1875) (ff3b76b)
• ui: remove cover timestamp check from metadata lock (#1806) (00f48c3)
• ui: rename font files (#1861) (c2c867e)
• ui: use signals in icon picker / uploader for reactivity (#1881) (5014bb9)

Refactors

• dashboard: move dashboard configuration to view preferences settings (#1822) (284b7a4)
• ui: new icon library and user migration (#1828) (d0d884a)
• ui: new standard and accessible UI font (#1777) (8ce487b)

Chores

• deps: bump the frontend group with 6 updates (#1798) (08ec10b)
• deps: bump the gradle-dependencies group in /backend with 2 updates (#1797) (f3f0a73)
• drop hard coded SVG icons (#1884) (1060c3a)
• i18n: update translations from Weblate (#1838) (2c2933f)
• i18n: update translations from Weblate (#1877) (448d0d4)
• repo: fix sonar failings (#1813) (3225ddb)

CI

• proper sha length for release candidate (#1887) (6fd21da)

Reverts

• remove warning for goodreads metadata provider (#1869) (71f0ed0)

Contributors

We'd like to thank the contributors for this release for taking the time to make Grimmory better.

Including but not limited to: @aisaiev @lixiaoyu0123 @alexhb1 @imnotjames @zachyale

New Contributors

@lixiaoyu0123 made their first contribution in #1862

What's Changed

fix: properly wait for automatic wifi without breaking executor by @sabrina553 in #149

fix: proper toggle of syncReadingSessions() by @imnotjames in #150

refactor: drop unused fields from sync by @imnotjames in #151

refactor: simplify executor and combine with wifi manager by @imnotjames in #154

fix: only send progress when needed by @imnotjames in #155

fix: only emit dismiss callback when not external by @imnotjames in #157

fix: handle self-closing tags in CFI resolver by @imnotjames in #156

feat: add session events for annotations by @imnotjames in #160

refactor: move UI refresh helper into doc_metadata by @imnotjames in #161

fix: move refresh UI to only when required by @imnotjames in #162

refactor: set grimmory ID when associating a book by @imnotjames in #163

fix: use step rather than exec when executing statement by @imnotjames in #166

feat: sync annotations with grimmory by @imnotjames in #123

New Contributors

@sabrina553 made their first contribution in #149

Full Changelog: v0.0.25...v0.0.26

3.2.2 (2026-06-19)

This patch release of Grimmory is focused on bug fixes. It fixes folder watcher SQL errors, correctly applies library restrictions to the OPDS shelf catalogs, fixes a bug affecting bookdrop on QNAP devices, ensures non-admin users are assigned at least one library, and more.

Changelog

Full Changelog: v3.2.1...v3.2.2

Bug Fixes

• bookdrop: directly copy instead of move between filesystems (#1759) (64ddbe5)
• event-processor: avoid invalid query during watch folder processing (#1803) (6d14043)
• metadata-refresh: add audible to metadata refresh (#1779) (e4ebe97)
• opds: add library restrictions to shelf OPDS catalogs (#1731) (0cc48a8)
• user-managment: non-admin users must be assigned atleast one lib… (#1741) (2b8ac73)

Refactors

• ui: new component library (#1740) (3e5d85b)

Chores

• deps: bump @angular/common from 21.2.15 to 21.2.17 (#1756) (1afe9de)
• deps: bump @angular/compiler from 21.2.15 to 21.2.17 (#1757) (467aa1b)
• deps: bump @angular/core from 21.2.15 to 21.2.17 (#1753) (a738124)
• deps: bump @angular/service-worker from 21.2.15 to 21.2.17 (#1755) (70a0b51)
• deps: bump EnricoMi/publish-unit-test-result-action from 2.23.0 to 2.24.0 (#1767) (6711aba)
• deps: bump pnpm/action-setup from 6.0.8 to 6.0.9 (#1766) (008f8fe)
• deps: bump semantic-release from 25.0.3 to 25.0.5 in the release-tooling group across 1 directory (#1769) (7729c76)
• deps: bump taiki-e/install-action from 2.81.5 to 2.81.11 (#1768) (dee01c4)
• deps: bump the frontend group across 1 directory with 24 updates (#1771) (692c2ea)
• deps: bump the gradle-dependencies group across 1 directory with 5 updates (#1770) (2f3e3be)
• helm: add extra env to deployment (#1661) (bd5c920)
• i18n: update translations from Weblate (#1748) (763d732)
• pdf-reader: drop redundant pdf in-memory caching (#1754) (8da867d)

Contributors

We'd like to thank the contributors for this release for taking the time to make Grimmory better.

Including but not limited to: @geneliu @imnotjames @idriss-mechkene @alexhb1

New Contributors

• @geneliu made their first contribution in #1661
• @idriss-mechkene made their first contribution in #1741

3.2.1 (2026-06-14)

This release of Grimmory is focused on bug fixes. It fixes content restrictions applied to the book's page endpoint, drops the Blackbird library to prevent JSON serialization errors, fixes public shelves not showing up for books, fixes bidirectional KOReader sync in some cases, and improves reactivity across the UI. Furthermore, there are performance improvements in the book ingest pipeline and reductions in memory usage due to file downloads.

Changelog

Full Changelog: v3.2.0...v3.2.1

Bug Fixes

• api: fix content restrictions for api/v1/books/page (#1706) (a93bc5f)
• book-details: fall back from invalid book detail tabs (#1685) (46f4457)
• download: stream book downloads instead of buffering in browser (#1718) (7f38de8)
• drop blackbird to avoid serialization failure states (#1513) (65f3f85)
• handle multiple book files with the same checksum (#1724) (0cc918f)
• helm: add startup probe to helm chart (#1712) (f13538a)
• koreader: fix bidirectional progress sync (#1687) (590bd9e)
• library stats showing 0KB due to incorrect fileSizeKb field path (#1436) (f3dacb9)
• login: fix oidc login button on light mode (#1682) (d1298af)
• metadata: extract epub titles per spec with regards to ordering (#1637) (d775011)
• reader: switch header/footer hover zones from static heights to dynamic (#1716) (a44197e)
• shelf: fix public shelf book visibility (#1735) (48eefc0)
• ui: convert device settings state to signals (#1635) (f6661fe)
• ui: no libraries assigned label (#1736) (0625095)
• ui: use signals for OIDC settings (#1737) (d5f652f)
• ui: use signals for user management to improve reactivity (#1726) (f2b7cdc)

Performance

• db: add missing book_file indices for ingestion lookups (#1729) (a86dfb2)
• download: stream all book downloads via StreamingResponseBody (#1722) (798767c)

Chores

• deps: bump docker/metadata-action from 6.0.0 to 6.1.0 (#1650) (abe1258)
• deps: bump docker/setup-buildx-action from 4.0.0 to 4.1.0 (#1648) (851fa40)
• deps: bump github/codeql-action from 4.36.1 to 4.36.2 (#1651) (8a06943)
• deps: bump hono from 4.12.18 to 4.12.23 in /frontend (#1642) (43b3c5d)
• deps: bump taiki-e/install-action from 2.77.6 to 2.81.5 (#1649) (436d04c)
• deps: bump the gradle-dependencies group across 1 directory with 4 updates (#1646) (d6a88a3)
• deps: bump the npm-dependencies group in /frontend with 25 updates (#1647) (1ffbd54)
• i18n: update translations from Weblate (#1644) (11febb9)
• i18n: update translations from Weblate (#1665) (2675c4a)
• i18n: update translations from Weblate (#1678) (1037757)
• i18n: update translations from Weblate (#1679) (1b64f13)
• i18n: update translations from Weblate (#1686) (6b28d14)
• repo: migrate from yarn to pnpm (#1598) (e83a143)
• ui: add warning for goodreads metadata provider (#1732) (b25a3f5)
• ui: normalise text size and spacing (#1656) (349f046)

Documentation

• document Weblate translation workflows (#1643) (d929cd2)
• update README badges for consistency (#1645) (7129d3c)

Contributors

We'd like to thank the contributors for this release for taking the time to make Grimmory better.

Including but not limited to: @zachyale @alexhb1 @DeeWooo @imnotjames @raphkun

New Contributors

• @DeeWooo made their first contribution in #1436
• @raphkun made their first contribution in #1726

Features

Sync configuration was moved to its own menu

Added a sync option to sync shelves or not (default on) and an extra option to "sync empty shelves".

Updated shelf logic so that all shelves that are applicable to the books you've downloaded (not just target shelves) are pulled over.

Download configuration was moved to its own menu section as well.

Added an option to download config to remove books when they are no longer in Grimmory (either not on the shelf or deleted from Grimmory)

Added a (for now) internal option of headers that can be added to every API request. This is extra_headers in the grimmory settings lua file.

Bug fixes

Improved sync messages so that books are either refreshed or downloaded to make things clearer.

Added a bit of extra logic so that when an open book is attempted to sync, the plugin attempts to find the remote book in Grimmory.

Also handled cases where books are refreshed / deleted / etc - and then the same book is downloaded again.

Fixed a bug where the collections were not updating without a KOReader restart after sync in some edge cases.

Fixed a bug where some toggles were not being properly persisted to the settings lua file.

Full Changelog: v0.0.22...v0.0.23