v1.5.8-stable

datalab-to/suryav1.5.8-stableOct 4, 2026by gtsteffaniak

Upgrading?

AI Summary

Supersedes v1.5.7 to restore TOTP login functionality and updates dependencies and ffmpeg to version 9.0.2.

Key Highlights

  • Restores TOTP login functionality that was broken in v1.5.7.
  • Updated Docker image with ffmpeg 9.0.2.

Full Release Notes

## What's Changed

> [!NOTE]  
> Supersedes v1.5.7-stable, so including its release notes for visibility.

 **Security**:
 - [High] TOTP re-enrollment via `POST /api/auth/otp/generate` and `POST /api/auth/otp/verify` no longer allows anonymous callers to replace an existing second factor using only the account password; reset or replace requires an authenticated self or admin session (first-time enrollment without MFA unchanged) (GHSA-qx86-4v5r-26g5) -- thanks @tao0845.

 **Notes**:
 - [docker] upgraded ffmpeg version from 9.0.1 to 9.0.2

## All Changes
* updated dependencies v1.5.7-stable by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3066
* Fix TOTP re-enrollment MFA bypass (GHSA-qx86-4v5r-26g5). by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3068
* updated docker ffmpeg v1.5.7 by @gtsteffaniak in https://github.com/gtsteffaniak/filebrowser/pull/3069
* fix(auth): restore existing TOTP login on v1.5.7 by @spatiumstas in https://github.com/gtsteffaniak/filebrowser/pull/3079

**Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v1.5.7-stable...v1.5.8-stable

Related Repositories