v3.38.0 v2.0.9-beta
vadimdemedes/inkSep 24, 2026 → Sep 25, 20261 day between releases
What's New
Security hardening and SQLite configuration changes, including the removal of the shared cache option.
Breaking Changes
- SQLite shared cache (`cache=shared`) removed from application database connection
- Webdav behavior changed to always show hidden files, ignoring user preference
- OIDC post-login redirects must be same-app relative paths
New Features
- Random initial password generation for default admin login
- OIDC login binds OAuth state to HttpOnly cookie
- SSRF validation for OnlyOffice document downloads
- Open redirect rejection for login, logout, and session-expiry redirects
Improvements
- SQLite busy_timeout configuration added for lock handling
- WAL mode allows concurrent readers without shared cache
- Session/API token registrations now record JWT expiry for pruning
Bug Fixes
- Fixed SQLite locking issues by removing shared cache
- Fixed SSRF gap in OnlyOffice document downloads
- Fixed intermittent blank page / blocked inline SPA script after CSP hardening
- Fixed token migration lockout regression from v2.0.8-beta
Upgrade Notes
Remove the SQLite `cache=shared` setting from your connection string, as it is no longer supported. Update OIDC post-login redirects to be same-app relative paths. Be aware that Webdav will now always show hidden files regardless of user preferences.
The Two Releases
v3.38.0
Sep 24, 2026· 27 days ago
This release introduces new configuration replacement commands and resolves performance issues related to idle UDP sessions and egress proxying.
Full release notesv2.0.9-beta
Sep 25, 2026· 26 days ago
A security-focused release fixing open redirects, SSRF gaps in OnlyOffice, SQLite locking issues, and hardening OIDC login.
Full release notes