2 releases 9 tags

RSS feed

• v0.6.0 72368cb4bf

  Compare

  v0.6.0 Stable

  jfro released this 2026-10-18 18:22:51 +00:00 | 2 commits to main since this release

  Signed by jfro

  SSH key fingerprint: SHA256:gyXEqeopK9SwJYa2xExMOvoz4iNETFtY5UuVcbvfs50

  [0.6.0] - 2026-10-18

  Upgrade note

  • Registration now defaults to open only until the first account exists. Existing instances that never saved the registration setting will close registration after upgrading. To keep it open, set REGISTRATION_ENABLED=true or turn it on in Admin → Users. REGISTRATION_ENABLED=true|false now fixes registration on or off and locks the admin toggle.
  • OIDC sign-ins still create new accounts even when registration is disabled; your identity provider is the gate for who can sign in (tracked in #42).
  • Only the very first user becomes admin. A first user an admin has demoted now stays demoted.

  Features

  • Ebook libraries: EPUB, PDF, MOBI and CBZ scanning, book matching and downloads (#17) (e58e20f)
  • REGISTRATION_ENABLED env var to fix registration on or off (#38) (df180a7)

  Security

  • Only download covers from http(s) URLs, never local paths (#18) (017e19b)
  • Block cover downloads from private hosts and cap their size (#19) (5dd20bb)
  • Stop book params from setting cover_image_key and confine storage keys (#20) (9e1c3b9)
  • Check the OIDC callback state against the session only (#21) (82c7cda)
  • Keep import/export job file paths inside their storage dirs (#32) (6a8a1c1)
  • Log disabled users out and keep them out (#34) (4104ba4)
  • Only link OIDC logins by email when the provider verified it (#37) (ab47811)
  • Keep rating, tags and custom_metadata out of the book form (#39) (aece619)
  • Don't scan or serve ebook symlinks that lead outside the library (#40) (addba93)
  • Cap how much a ZIP entry can inflate when reading ebooks (#41) (e473a95)
  • Make only the very first user admin, atomically (#38) (df180a7)
  • Keep secrets out of the logs (3c2811b)

  Bug Fixes

  • Uploading a file on Import Data no longer fails with a 400 (#46, fixes #45; broken since v0.5.1) (3fa6a13)
  • Imports actually import books (#30) (92145d4)
  • Use the proper Open Library edition when looking up by ISBN, and add language (ca55593)
  • Fix a missing ? (9c78199)
  • Link books to Open Library and Google Books, not only Open Library (#2) (882ea51)
  • Keep autofilled form fields readable in the dark theme (#3) (76ef5ad)
  • Collapse the navbar into a menu on small screens (#4) (e61cf71)
  • Fix what Elixir 1.20's type checker found (9d12b27)

  Docker

  • Add healthcheck and restart policy for db, improve service dependencies (d83b041)
  • Pin the Postgres version (newer versions changed the data path) (b7a61ec)
  • Update the PostgreSQL healthcheck command and user (e4864d8)
  • Don't require SSL on the Postgres connection (d440967)

  Downloads

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads