v1.5.8-stable v2.0.10-beta
zarazhangrui/frontend-slidesOct 4, 2026 → Oct 4, 20260 days between releases
What's New
Adds forced password changes, env vars, and security fixes
Breaking Changes
- Restricted API tokens (`minimal=false`) can no longer be upgraded to full-permission sessions via `POST /api/auth/renew`.
- Users requiring password changes will be locked out of login until they set a new password.
New Features
- New user setting `requirePasswordChange` forces password updates at next login.
- Configuration YAML now supports `$VAR` and `${VAR}` environment variable expansion.
- Anonymous visitor media playback fixes for inline video/audio.
- LDAP group matching now accepts CN-only values.
- Sidebar navigation rows are now real hyperlinks.
Improvements
- Docker ffmpeg upgraded from 9.0.1 to 9.0.2.
- Public share lyrics and subtitles now honor the share's file-viewer setting.
- Bootstrap passwords use a speakable `word-xxxxx-xx` format instead of hex strings.
Bug Fixes
- Anonymous visitor media playback issues resolved.
- Public share lyrics and subtitle media routes now respect download limits.
- OIDC session expiry handling improved.
Upgrade Notes
Existing users may be locked out of login if they have not yet set a new password due to the new `requirePasswordChange` setting. Integrations relying on upgrading restricted API tokens will need to be updated to use standard web sessions or renew tokens differently. Update configuration files to use environment variables if needed.
The Two Releases
v1.5.8-stable
Oct 4, 2026· 17 days ago
A stable release superseding v1.5.7, primarily focused on security hardening to fix a TOTP re-enrollment bypass vulnerability and restoring TOTP login functionality.
Full release notesv2.0.10-beta
Oct 4, 2026· 17 days ago
A beta release focused on security fixes and user experience improvements, introducing forced password changes and environment variable support in configuration.
Full release notes