🤖 Update image ghcr.io/advplyr/audiobookshelf to v2.36.0

[foundation-fondue]

This PR contains the following updates:

Package	Update	Change
ghcr.io/advplyr/audiobookshelf	minor	2.31.0 → 2.36.0

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

advplyr/audiobookshelf (ghcr.io/advplyr/audiobookshelf)

v2.36.0

Compare Source

Important: New authentication system was added in v2.26.0. See https://redirect.github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Logout all devices button on account page (in #​5395)
• Auth sessions table on account page w/ ability to logout of individual sessions (in #​5400)

Fixed

• Weak protocol validation for OIDC post-login callback URL by @​mikiher in #​5386
• User delete endpoint allowing for root account deletion by @​mikiher in #​5370
• API and websocket authentication allowing refresh tokens by @​mikiher in #​5387
• Bulk library item download endpoint not checking access on individual items by @​mikiher in #​5388
• Manual podcast episode match not setting the enclosure url #​5317 by @​mikiher in #​5318

Updated

• Changing user password invalidates all auth sessions (in #​5393)
• Extend refresh token grace period to 10 minutes and allow REFRESH_TOKEN_GRACE_PERIOD env variable override #​5281 by @​DanielAshley in #​5376
• API: New GET endpoints /api/me/progress, /api/me/bookmarks, /api/me/bookmarks/:libraryItemId by @​Vito0912 in #​5363
• API: Add all minified fields to expanded library item JSON by @​mikiher in #​5341
• API: Server settings now include timeZone for server timezone (for giving accurate cron job next schedule date)
• API: /logout endpoint now supports ?allDevices=1 query param to delete all other sessions and rotate current (in #​5395)
• API: New endpoint GET /api/me/sessions to get all auth sessions (in #​5400 and #​5405)
• API: New endpoint DELETE /api/me/sessions/:id to delete an auth session (in #​5405)
• New socket event authors_num_books_updated is emitted during a scan when author book count changes by @​mikiher in #​5354
• Socket event author_added is now emitted during scans by @​mikiher in #​5354
• UI/UX: Update outdated help links for new docs site by @​francisrath in #​5336
• More strings translated
  • Chinese (Simplified Han script) by @​FiendFEARing
  • Danish by @​MikkelOlesen @​hhjuhl
  • Greek by @​no1ta
  • Icelandic by @​axelbjornsson
  • Portuguese (Brazil) by @​AgenteGabrielofc
  • Tamil by @​TamilNeram

Internal

• Read AllowedDevOrigins from dev.js into ALLOWED_DEV_ORIGINS env var by @​mikiher in #​5291
• Setup internal-api file upload passthrough for next.js by @​mikiher in #​5325
• Readme update about frontend rewrite by @​nichwall in #​5407

New Contributors

• @​DanielAshley made their first contribution in #​5376
• @​francisrath made their first contribution in #​5336

Full Changelog: advplyr/audiobookshelf@v2.35.1...v2.36.0

v2.35.1

Compare Source

Important: New authentication system was added in v2.26.0. See https://redirect.github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Duplicate refresh tokens across sessions can cause unexpected logout #​5253 by @​nichwall in #​5255
• Server crash when renaming an author to another author when they are both on the same book #​5247 by @​nichwall in #​5256
• Server crash when invalid metadata.json is scanned in #​5268
• Sequelize user queries to use direct case-insensitive username/email matching

Full Changelog: advplyr/audiobookshelf@v2.35.0...v2.35.1

v2.35.0

Compare Source

Important: New authentication system was added in v2.26.0. See https://redirect.github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Access token refresh grace period (fixes frequently needing to re-login) #​4630 by @​nichwall in #​5004

Fixed

• Listening sessions from Android app showing device name as Abs iOS
• RSS feeds serving m4b files with incorrect Content-Type #​5041 by @​brandonfhall in #​5221

Changed

• Book & podcast descriptions from audio files are sanitized
• cancel_scan and set_log_listener socket events validate account type and log level
• More strings translated
  • Belarusian by @​pavel-miniutka
  • Polish by @​TheMatrixan

New Contributors

• @​brandonfhall made their first contribution in #​5221

Full Changelog: advplyr/audiobookshelf@v2.34.0...v2.35.0

v2.34.0

Compare Source

Important: New authentication system was added in v2.26.0. See https://redirect.github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Japanese language and Japan as podcast search region by @​na3shkw in #​5211
• Autocomplete attributes on login and setup fields for password manager support by @​meek2100 in #​5089

Fixed

• Recent episodes not updating from cache when media progress changes in #​5159
• Error logging when a podcast's auto-download schedule has an invalid cron expression

Changed

• Public media item shares: use start time passed in query parameter for existing sessions by @​pjkottke in #​5163
• Podcast episode downloads use SSRF filtering on the HTTP request (matches other external requests)
• Podcast create and update validate the auto-download schedule cron expression and sanitizes the HTML description
• Playlists, collections, and library item batch API routes enforce library and per-item access
• More strings translated
  • Belarusian by @​pavel-miniutka
  • Hungarian by @​ugyes
  • Japanese by @​na3shkw

Internal

• ApiCacheManager test coverage for recent-episodes cache invalidation

New Contributors

• @​pjkottke made their first contribution in #​5163
• @​meek2100 made their first contribution in #​5089
• @​na3shkw made their first contribution in #​5211

Full Changelog: advplyr/audiobookshelf@v2.33.2...v2.34.0

v2.33.2

Compare Source

Important: New authentication system was added in v2.26.0. See https://redirect.github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Matroska audiobooks (.mka) with the Opus codec failing to play in web client by @​rktjmp in #​5115
• UI/UX: Share player not using libraries cover aspect ratio setting
• Backup uploads leaving temporary files behind when the uploaded file failed validation
• Path traversal check on the filesystem path-exists endpoint not handling all edge cases

Changed

• Bulk download endpoint now ensures all requested items belong to the library being requested
• Backup load and upload now validate the backup details entry exists and is within a reasonable size limit
• Podcast create endpoint validates that the podcast path is inside the selected library folder
• Author and library item cover image endpoints now clamp width/height query params to a maximum of 4096
• Podcast episode subtitles parsed from RSS feeds are now sanitized for HTML
• author_updated/author_added socket events emitted when updating authors in the book details edit modal by @​mikiher in #​5158
• item_removed socket event payload now includes libraryId so clients can ignore events for other libraries by @​mikiher in #​5160
• More strings translated
  • Belarusian by @​pavel-miniutka
  • Bulgarian by @​lembata
  • German by @​JBlond @​LaurinSorgend
  • Italian by @​tizio04
  • Russian by @​Hopelite @​vmakeev
  • Spanish by @​cyphra

New Contributors

• @​rktjmp made their first contribution in #​5115

Full Changelog: advplyr/audiobookshelf@v2.33.1...v2.33.2

v2.33.1

Compare Source

Important: New authentication system was added in v2.26.0. See https://redirect.github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• API Keys not respecting user enabled/disabled flag

Changed

• Podcast episode update endpoint sanitizes HTML for subtitle
• Playlist & collection create/update endpoints strip HTML tags from name
• More strings translated
  • Belarusian by @​pavel-miniutka
  • German by @​fabianjuelich
  • Spanish by @​cyphra

Full Changelog: advplyr/audiobookshelf@v2.33.0...v2.33.1

v2.33.0

Compare Source

Important: New authentication system was added in v2.26.0. See https://redirect.github.com/advplyr/audiobookshelf/discussions/4460 for details.

Added

• Slovak language option by @​belpe in #​5077
• Belarusian language option by @​pavel-miniutka in #​5071
• Database indexes for discover query performance by @​kevingatera in #​5073

Fixed

• IDOR vulnerabilities in listening sessions, media progress, and bookmark endpoints #​5062 by @​mandreko in #​5063
• Server crash filtering by decade with collapsed series
• Server crash on /me/progress/:libraryItemId/:episodeId? when episodeId is not passed in for a podcast library item #​5058
• Updating author name merging with same name authors in a different library #​4628
• Home page check current user from socket event when updating hide from continue listening
• UI/UX: Match tab "click to use current value" incorrect title attribute
• UI/UX: Aria-label for jump backward button by @​KiwiHour in #​4973

Changed

• Improved personalized shelves performance by parallelizing shelf queries and reducing search payload size by @​kevingatera in #​5073
• Improved API cache invalidation for high-churn models (sessions, media progress) by @​kevingatera in #​5073
• Improved subtitle parsing to account for bare colon in title by @​kctdfh in #​5036
• Sanitize session DeviceInfo clientDeviceInfo fields
• Sanitize server settings authLoginCustomMessage on save and load
• Fix OpenAPI spec description by @​openam in #​5042
• UI/UX: Display localized/styled text for selected filter by @​sir-wilhelm in #​4952
• More strings translated
  • Belarusian by @​pavel-miniutka
  • Catalan by @​enboig
  • Chinese (Simplified Han script) by @​FiendFEARing
  • Czech by @​Plazec
  • Danish by @​xxzp3
  • French by @​dapitch666
  • German by @​ShaikaJar @​Maxklos @​B0rax
  • Greek by @​lambolighting
  • Hebrew by @​enosh
  • Hungarian by @​Kabika82 @​ugyes
  • Japanese by @​litoma
  • Lithuanian by @​mantas3
  • Norwegian Bokmål by @​Torstein-Eide @​soteland
  • Polish by @​Jarsey45
  • Portuguese (Brazil) by @​lribeiro
  • Romanian by @​hac3ru
  • Slovak by @​goozi12345 @​pecer
  • Slovenian by @​thehijacker
  • Swedish by @​Cotignac @​karlbe

New Contributors

• @​KiwiHour made their first contribution in #​4973
• @​openam made their first contribution in #​5042
• @​belpe made their first contribution in #​5077
• @​pavel-miniutka made their first contribution in #​5071
• @​kctdfh made their first contribution in #​5036
• @​mandreko made their first contribution in #​5063
• @​kevingatera made their first contribution in #​5073

Full Changelog: advplyr/audiobookshelf@v2.32.1...v2.33.0

v2.32.1

Compare Source

Important: New authentication system was added in v2.26.0. See https://redirect.github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Server crash matching with Audible provider #​4931

Updated

• More strings translated
  • Finnish by @​pHamala
  • Polish by @​MarcinKlejna
  • Russian by @​renesat
  • Swedish by @​bittin

Full Changelog: advplyr/audiobookshelf@v2.32.0...v2.32.1

v2.32.0

Compare Source

Important: New authentication system was added in v2.26.0. See https://redirect.github.com/advplyr/audiobookshelf/discussions/4460 for details.

Fixed

• Bulk matching books with multiple of the same new author only applies author to one book by @​TN-SKYC in #​4766
• Debian package upgrades failing due to user "audiobookshelf" already exists #​1617 by @​Yetangitu in #​4740
• Multi-select inputs allowing duplicate new items by @​votex001 in #​4649
• Audible & custom metadata providers allowing duplicate genres & tags #​4634 (in #​4927)

Updated

• API: Metadata match results return tags as an array of strings instead of a comma separated string (in #​4927)
• Playlists are sorted alphabetically in playlist modal by @​sir-wilhelm in #​4906
• More strings translated
  • Arabic by @​kfctatertot
  • Bulgarian by @​lembata
  • Chinese (Simplified Han script) by @​FiendFEARing
  • Finnish by @​Napitauki @​pHamala
  • German by @​JBlond
  • Greek by @​lambolighting
  • Hebrew by @​mnavon
  • Italian by @​66Bunz
  • Korean by @​zardkim
  • Polish by @​ahetek
  • Portuguese (Brazil) by @​ljaksys
  • Slovenian by @​thehijacker
  • Spanish by @​kfctatertot @​xlbrto

New Contributors

• @​TN-SKYC made their first contribution in #​4766
• @​votex001 made their first contribution in #​4649

Full Changelog: advplyr/audiobookshelf@v2.31.0...v2.32.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.