Transmute Release Notes

Patch release: v2.1.1 is a small maintenance release. It fixes a privacy issue introduced in v2.1.0, cleans up failed jobs that were piling up, and adds a Korean translation. Updating is recommended for all users.

Telemetry disabled

v2.1.0 pulled in a newer onnxruntime (1.30+, a dependency of pymupdf4llm) that sends usage telemetry to Microsoft by default. Transmute now turns this off (ORT_DISABLE_TELEMETRY=1) in both the Docker image and at backend startup. (#308)

Failed jobs are now cleaned up

Failed and finished jobs are now removed by the cleanup TTL and by Clear Conversions/Compressions in Settings, so they no longer pile up on the Jobs page. Queued and running jobs are never touched. Thanks @vaibhavkr993630-droid! (#298)

Added a Korean translation

Thanks @Ghostincts

Upgrade Notes

No breaking changes and no config changes required.

After upgrading, the first cleanup run will delete old failed, completed and cancelled jobs older than your configured TTL. A job's age is counted from when it finished, not when it was created.

Changes

• fix: disable telemetry for onnxruntime in main.py and Dockerfile (closes #308) (a9a7898)
• fix(jobs): clear failed and finished jobs via TTL cleanup and Clear History (closes #298) (#307) (ed64674)
• feat: add Korean translation (#304) (b55ef57)
• chore(docker): update Pandoc (3.11 → 3.12) and Draw.io (31.5.3 → 31.7.0) versions in Dockerfile (closes #306, closes #297) (7de1265)
• chore(deps): bump pdf2docx from 0.5.8 to 0.5.13 (#305) (241dfbb)
• chore(deps): bump pyjwt from 2.13.0 to 2.15.0 (#301) (321a966)
• chore(deps): bump undici from 7.29.0 to 7.30.0 in /frontend (#302) (e7b5b94)
• chore(deps-dev): bump brace-expansion from 5.0.7 to 5.0.12 in /frontend (#303) (442905c)

Version Information

Full version: v2.1.1

Minor version tag: v2.1

Major version tag: v2

Updated Tags

• v2.1 → v2.1.1 (updated)
• v2 → v2.1.1 (updated)

Security Patch: This release fixes multiple security vulnerabilities, including account takeover via OIDC email linking, guest session hijacking, local file read / SSRF through document conversions, and a DNS-rebinding bypass of the previous URL import SSRF fix (CVE-2026-54054). All users should update promptly, especially instances exposed to untrusted users or with ALLOW_UNAUTHENTICATED=true. Thank you to @tonghuaroot, @GEONWOOHAN, @Tike00, @archnexus707, and @Ankith-B for responsibly reporting these issues!

Beyond security, v2.1.0 brings a big batch of new features and fixes:

• Chunked file uploads and downloads, so large files work behind reverse proxies with request size limits (thanks @veno501)
• Paste files directly into Transmute from your clipboard (thanks @veno501)
• Apple iWork support: convert Pages and Numbers documents (#249)
• Custom CSS support for PDF conversions (thanks @RyoSXu)
• MP3 to M4B audiobook conversion (thanks @AlyanPremani05)
• Animation is now preserved in animated-to-animated conversions, including animated WebP (thanks @A-S-Manoj)
• Added Slovenian (thanks @veno501) and Greek (thanks @pixelschaos) translations
• Settings page and dropdown UI refresh (thanks @ManelTech and @Trithereon)

Security Fixes

• GHSA-gp9p-77f3-j7g5: OIDC login could link to an existing account (including admins) based on an unverified email claim. Linking now requires email_verified from the provider.
• GHSA-38pw-jjq6-6w6p: Guest sessions could be resumed from a known guest UUID. The guest cookie is now HMAC-signed.
• GHSA-8mfq-273g-2cr7: DNS rebinding could bypass URL import SSRF protections. Connections are now pinned to the validated address.
• GHSA-q3fc-r99p-5gj7 / GHSA-jcqc-6m64-4xv6: Document conversions could read local files or fetch arbitrary URLs. Pandoc now runs with --sandbox and WeasyPrint only resolves inline data: URIs.
• GHSA-6h5p-x9v3-h6x5: Changing a password no longer works without the current password.
• GHSA-xv67-5v66-38qv: Disabled accounts can no longer use existing JWTs.

Upgrade Notes

• Changing your password now requires your current password (current_password on PATCH /api/users/me).
• Existing guest sessions will not resume after upgrading; guests will start a fresh session.
• OIDC users whose provider does not send email_verified: true will no longer be automatically linked to an existing local account by email.
• Documents that reference remote or local external resources (images, includes) will no longer pull those in during conversion; unresolvable markdown images fall back to their alt text.

Changes

• security: bulk vuln fixes (#296) (7b8b565)
• feat: add Greek (el) translation (#291) (8e77f14 & f369bb7)
• feat(frontend): improve dropdown UI and style (#289) (55fcd29)
• feat(settings): group appearance and conversion in one card with a centered save button (#265) (3d06fac)
• feat: add iWork converter and LibreOffice support for Pages and Numbers (fixes #249) (f09cf8d)
• feat: slovenian localization (#257) (cac2ca0)
• feat: add chunked file uploads and downloads for reverse-proxy compatibility (#241) (#248) (9cc077d)
• feat: file pasting support (#243) (closes #235) (c4552c1)
• feat: add custom CSS support for PDF conversion (#214) (7fdae1f)
• feat: add MP3 to M4B conversion support (#210) (#211) (0bfca37)
• fix(ffmpeg): increase timeout values (closes #284) (#286) (19aecbb)
• fix(settings): use theme primary colour for toggles and save button (#277) (e35ced0)
• fix(auth): style login error as an error box in red for both local and OIDC view (#275) (e94827c)
• fix(i18n): update language detection to prevent caching and ensure live navigator locale (fixes #246) (08dffc0)
• fix(i18n): remove nonExplicitSupportedLngs option from i18next initialization (fixes #237) (03c768c)
• fix: add support for staging animated WebP as APNG for FFmpeg conversion (fixes second part of #213) (e746a7c)
• fix: restore animation in animated-to-animated format conversions (#216) (4fc40d9)
• fix: allow Scout results upload to continue on error (a9ff811)
• fix(tests): add matchMedia mock for jsdom compatibility (510172f)
• fix: correct indentation for sha256 computation status message (55ffeb7)
• refactor: add type hints to ConverterRegistry methods (#293) (30e49d0)
• chore(docker): update Calibre and Drawio versions in Dockerfile (closes #285, closes #287, closes #290) (cfb63c8)
• chore(docker): update Calibre, Pandoc, and Drawio versions in Dockerfile (closes #279, closes #273, closes #270, closes #269, closes #267) (08adbfd)
• chore(deps): update Pandoc and Drawio versions in Dockerfile (fixes #260, fixes #266) (17c9f05)
• chore(docker): update Calibre and Drawio versions in Dockerfile (fixes #251) (3443240)
• chore(deps): update Dockerfile release pins for Calibre, Pandoc, and Draw.io (closes #240, closes #239, closes #233) (97659b2)
• chore: bump DRAWIO_VERSION from 30.3.6 to 30.3.14 (#224) (92b6aa5)
• chore: bump DRAWIO_VERSION from 30.2.6 to 30.3.6 (closes #218) (#219) (6db7b98)
• chore: update Calibre version and checksums to 9.11.0 (fixes #217) (f5078c6)
• chore(deps): bump weasyprint from 68.1 to 70.0 (#281) (66c4fbe)
• chore(deps): bump yt-dlp from 2026.6.9 to 2026.7.4 (#238) (cf24983)
• chore(deps): bump pillow from 12.2.0 to 12.3.0 (#228) (24de48e)
• chore(deps): bump pillow-heif from 1.2.1 to 1.3.0 (#227) (fa7c115)
• chore(deps): bump react-router and react-router-dom in /frontend (#258) (aa028d8)
• chore(deps): bump undici from 7.28.0 to 7.29.0 in /frontend (#250) (339bdde)
• chore(deps): bump @vitest/mocker and vitest in /frontend (#280) (a434f29)
• chore(deps-dev): bump js-yaml from 4.2.0 to 4.3.2 in /frontend (#247, #282) (5dfb596 & 6700584)
• chore(deps-dev): bump browserslist from 4.28.1 to 4.28.9 in /frontend (#278) (11daba4)
• chore(deps-dev): bump @humanfs/node from 0.16.7 to 0.16.8 in /frontend (#272) (b679875)
• chore(deps-dev): bump postcss-selector-parser in /frontend (#271) (17c4ff1)
• chore(deps-dev): bump postcss from 8.5.15 to 8.5.25 in /frontend (#242) (75d881f)
• chore(deps-dev): bump brace-expansion from 5.0.6 to 5.0.7 in /frontend (#230) (3f2db5f)
• chore: update screenshots (d1cb894)
• docs: update YouTube demo link in README (4be1075)
• docs: update README to clarify file conversion and compression capabilities (4de05bd)

Version Information

Full version: v2.1.0

Minor version tag: v2.1

Major version tag: v2

Updated Tags

• v2.1 → v2.1.0 (created)
• v2 → v2.1.0 (updated)

Transmute 2.0.0 expands the project beyond file conversion with the introduction of file compression.

Until now, Transmute has focused on converting files from one format to another. With this release, Transmute can also compress supported files to make them smaller while keeping them in the same format. That means you can now use Transmute not only to turn a file into something else, but also to optimize the files you already have.

Compression currently supports common image, PDF, audio, video, and GIF workflows, with simple compression levels so you can choose the right balance between quality and file size. Like the rest of Transmute, compression runs locally on your own server, keeping files private and avoiding third-party upload services.

Changes

• feat(settings): add option to invalidate digital signatures during PDF/A conversion (see comments on #87) (012d259)
• feat(compressor): add FFmpegCompressor for audio/video compression support (#201) (9e11098)
• feat(converter): add AI, CDR, CDT and VSDX support to Inkscape converter (#200) (4bf08b4)
• feat(converter): add PDF, TEX, and ODG support to Inkscape converter (#199) (69c0f74)
• feat: add support for 3d formats (stl, obj, ply, off, glb, 3mf, dxf) (#198) (05cee03)
• feat(converter): add SVGZ, WMF, and EMF support to Inkscape converter (#197) (0ba0e2c)
• feat: implement initial compression architecture with an image and pdf compressor (#183) (66a1f69)
• feat: add manual language selector to settings (#193) (682a142)
• feat: add Portuguese (pt) language support (#192) (631902e)
• fix(converter): pad odd dimensions to even for H.264/yuv420p output (#206) (8eed837)
• chore: bump DRAWIO_VERSION from 30.2.4 to 30.2.6 (#209) (b0e7408)
• chore: bump CALIBRE_VERSION from 9.9.0 to 9.10.0 (#205) (58d4f9b)
• chore(deps): bump py7zr from 1.1.0 to 1.1.3 (#196) (4be6289)
• chore(deps): bump pydantic-settings from 2.13.0 to 2.14.2 (#195) (6f38a92)
• chore(deps): bump undici from 7.24.6 to 7.28.0 (#194) (dfda982)
• chore: update Draw.io version and checksums in Dockerfile (fixes #191) (7246329)
• chore: update babel packages to version 7.29.7 and bump js-yaml to 4.2.0 (545edee)
• chore(deps-dev): bump js-yaml from 4.1.1 to 4.2.0 in /frontend (#186) (233dba8)
• chore(deps): bump yt-dlp from 2026.3.17 to 2026.6.9 (#187) (f187837)
• chore(deps): bump python-multipart from 0.0.27 to 0.0.31 (#185) (26fa178)
• chore: bump vite from 7.3.2 to 8.0.16 (7673884)
• chore: add conversion tests to Makefile (937f0d5)

Version Information

Full version: v2.0.0

Minor version tag: v2.0

Major version tag: v2

Updated Tags

• v2.0 → v2.0.0 (created)
• v2 → v2.0.0 (created)

Fixes a bug with PDF type detection / conversions.

Adds Azerbaijani and Turkish translations (thanks @Elvin0802).

Adds subpath routing support for reverse proxies (thanks @SimonLou-Dev).

Changes

• feat: add BASE_URL for subpath rooting (#176) (c256906)
• feat: Add Turkish translations for the application. (#178) (58a920f)
• feat: Add Azerbaijani translations for the application. (#177) (45d2662)
• fix: broken subtype PDF handling and image-to-PDF conversion support … (#180) (ff4aaaa)
• fix: Just small things (#172) (82d245f)
• chore(vex): add CVE-2026-7010 and CVE-2026-8829 impact statements (9e93a8d)
• chore(deps): update lxml version to 6.1.1 (d7ce08c)
• chore(deps): update Pandoc version to 3.10 (fixes #173) (8d3a77f)
• chore(deps): update PyJWT, fastapi, and uvicorn versions in requirements.txt (cb28642)
• chore(deps): bump react-router, react-router-dom, and brace-expansion (#171) (1a0dfb7)

Version Information

Full version: v1.3.1

Minor version tag: v1.3

Major version tag: v1

Updated Tags

v1.3 → v1.3.1 (updated)

v1 → v1.3.1 (updated)

Security Patch: In previous versions full-read SSRF attacks are possible using the "from url" feature, please update promptly. Thanks for responsibly reporting @tonghuaroot!

Changes

• security: add SSRF prevention to url based downloads Co-authored-by: tonghuaroot [email protected] (be1698c)
• feat: add PDF to DOCX conversion support (#170) (dbbc69e)
• feat: add support for custom OIDC username claims (#164) (dd12da9)
• feat: add Chinese (zh-CN) language support with translations (AI assisted) (f3e8f9d)
• feat: add SHA256 verification for downloaded artifacts in Dockerfile (bdd9b50)
• feat: add customizable datetime display format (#167) (609224b)
• feat: display datetime in the browser's locale (#167) (89056fa)
• chore: update Calibre and Draw.io versions in Dockerfile (fixes #165 and fixes #166) (3c81aee)
• fix: update Dockerfile Calibre download URL to official site (dd10d2a)
• fix: Update fr.json (9e52a53 & 68c6505)

Version Information

Full version: v1.3.0

Minor version tag: v1.3

Major version tag: v1

Updated Tags

• v1.3 → v1.3.0 (created)
• v1 → v1.3.0 (updated)