v1.60.0 v2.0.9-beta

Name: camofox-browser
Author: jo-inc

high risk

jo-inc/camofox-browserSep 25, 2026 → Sep 25, 20261 day between releases

What's New

Major security hardening and database stability updates.

Breaking Changes

SQLite shared cache removed from connection string.
OIDC login now requires same-app relative redirects.
Public share routes reject expired tokens immediately.

New Features

Random initial password generation on fresh install.
OIDC OAuth state bound to HttpOnly cookie.
Database connection pool busy timeouts.
Session/API token expiry recording.

Improvements

Open-redirect protection implemented for login flows.
Credentials sent in JSON body instead of query parameters.
SQLite WAL mode allows concurrent readers.

Bug Fixes

Fixed token migration lockout regression.
Fixed intermittent blank page/CSP hardening issue.
Fixed ffmpeg unresponsive lock issue.
Public shares now reject OnlyOffice config requests.

Upgrade Notes

Remove 'cache=shared' from SQLite connection; ensure WAL mode is active. OIDC login changes require using same-app relative paths for redirects. Default admin credentials are now random; check logs for the initial password.

The Two Releases

v1.60.0

Sep 25, 2026· 27 days ago

Enhances video handling with transparency hints and fixes HLS/Opus codec string and Matroska segment duration issues.

Full release notes

v2.0.9-beta

Sep 25, 2026· 26 days ago

Focuses on security hardening, including random initial passwords and OIDC login improvements, alongside database stability fixes.

Full release notes